cc-sdd is a spec-driven development workflow for coding agents: it turns approved software specifications into requirements, designs, task plans, and extended autonomous implementation. Developers use it across several AI coding agents, with independent review and task-level continuation for long-running work. The catalogue entries provide commands, skills, agents, and instructions for using this workflow.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add gotalab/cc-sdd --skill kiro-discoverygit clone --depth 1 https://github.com/gotalab/cc-sddWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gotalab/cc-sdd/kiro-discovery)<a href="https://agentmods.dev/skills/gotalab/cc-sdd/kiro-discovery"><img src="https://agentmods.dev/badge/skills/gotalab/cc-sdd/kiro-discovery/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gotalab/cc-sdd/kiro-discovery"><img src="https://agentmods.dev/badge/skills/gotalab/cc-sdd/kiro-discovery.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 234 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.02891 |
| Opus 5.5 | $0.00018 | $0.01156 |
| Sonnet 5.5 | $0.00009 | $0.00578 |
| Haiku 4.5 | $0.00004 | $0.00289 |
Grade A, and why
kiro-discovery scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
2 near-identical copies found in the catalogue:
- kiro-discovery — 94% identical, 34 lines differ
- kiro-discovery — 88% identical, 68 lines differ
How it starts
The opening of the file, as written. The whole thing — 263 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Discovery
<background_information>
- Success Criteria:
- Correct action path or work decomposition identified based on existing project state
- User's intent clarified through questions, not assumptions
- Output is an actionable next step (not just a description) </background_information>
Step 1: Lightweight Scan
Gather only metadata to determine the action path. Do NOT read full file contents yet.
- Specs inventory: Scan
{{KIRO_DIR}}/specs/*/spec.jsonforname,phasefields andapprovalsstatus. Note feature names and their current status. - Steering existence: Check which files exist in
{{KIRO_DIR}}/steering/(product.md, tech.md, structure.md, roadmap.md). Do NOT read their contents yet. - Roadmap check: If
{{KIRO_DIR}}/steering/roadmap.mdexists, read it. This contains project-level context (approach, scope, constraints, spec list) from a previous discovery session. Use it to restore project context. - Top-level structure: List the project root directory to note key directories and files. Do NOT recurse into subdirectories.
This step should consume minimal context. If specs/ is empty and no steering exists, note "greenfield project" and move to Step 2.
Step 2: Determine Action Path
Based on the user's request and the metadata from Step 1, determine which path applies:
Path A: Existing spec covers this
- The request is an extension, enhancement, or fix within an existing spec's domain
- Every meaningful part of the request fits that same spec boundary
- Any remaining small follow-up work can be handled directly without creating a new spec
- Skip remaining steps
Path B: No spec needed
- The request is a bug fix, config change, simple refactor, or trivial addition
- No meaningful part of the request needs a new or updated spec boundary
- The request does not need to update an existing spec either
- Skip remaining steps
Path C: New single-scope feature
- The request is new, doesn't overlap with existing specs, and fits in one spec
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 263 lines · 44 tokens per session scan A 0e00885bce1a
kiro-discovery is a skill published in the GitHub repository gotalab/cc-sdd (3,738 stars, last pushed 3d ago), licensed MIT. It adds 44 tokens to every session and 2,891 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
todo-for-ai-agent-runtime
Runtime integration skill for external agents connecting to Todo for AI over HTTP API Token / Agent Key, including auth, task lease, events, commit, and task logs.
decision-interview
Ask the minimum decision questions needed before turning the task into canonical implementation rules, on behavior, data integrity, rollout safety, or test strategy. Use when missing information is decision-driven (not factual) or undecided policy blocks planning; in an attended chain it records an open decision as…
implementation-plan
Define an incremental plan for the active task as IMPLEMENTATIONPLAN.md plus a TASKSTATE.md update: smallest safe slices with scope, validation and exit criteria. No code is written. A --spec mode derives slices from a spec or PRD. A retrofit mode annotates in-progress plans so they can adopt implement-fleet. Do not…
slice-closure
Decide whether the current slice is ready to close, separating slice completion from task completion, and record the result in slice notes and TASKSTATE.md. Use when a slice was implemented, validated or reviewed and may be ready to close. Do not use before slice implementation, during planning, or for overall task…
task-close
Close a whole finished task: verify the spec done-conditions, set TASKSTATE.md to its final closed state, and move the folder from active/ to archive/. Use when all slices are closed, the work is merged or explicitly waived, and the task is ending. Do not use for one slice (use slice-closure), unfinished work…
autonomous-run
Run one approved task in one supervised session with the direct-use reference dispatcher, delegating verifiable slices to existing commands and emitting PROPOSED diffs only and never creating commits or attestation refs. Use when a maintainer invokes Fhorja directly after approve-plan and a BOOT verdict from…