Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Hulupeep/Specflow --skill duo-buildgit clone --depth 1 https://github.com/Hulupeep/SpecflowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hulupeep/specflow/duo-build)<a href="https://agentmods.dev/skills/hulupeep/specflow/duo-build"><img src="https://agentmods.dev/badge/skills/hulupeep/specflow/duo-build/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hulupeep/specflow/duo-build"><img src="https://agentmods.dev/badge/skills/hulupeep/specflow/duo-build.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00035 | $0.04865 |
| Opus 5.5 | $0.00014 | $0.01946 |
| Sonnet 5.5 | $0.00007 | $0.00973 |
| Haiku 4.5 | $0.00003 | $0.00487 |
Grade A, and why
duo-build scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 355 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Duo build
Tier applicability before this procedure
Read SPECIFICATION.md (source kit: templates/SPECIFICATION.md). Before
using the detailed procedure below, run
node scripts/specflow-tier.cjs inspect <record.json> duo-build inspect.
Follow the installed SPECIFICATION.md working procedure to import current scope,
run bounded experiments, prepare applicable gates and perform promotion inside
this one invocation. Preparation may remain thin. Before any production implementation, require
node scripts/specflow-tier.cjs inspect <record.json> duo-build build.
Stop on exit 2 and report the returned blocker. Production work repeats the
check with resume at re-entry and finish before claiming completion.
A missing record cannot prove readiness; retrieve the current issue and scoped
evidence. Labels alone never grant build-ready status.
The detailed artifact/pre-flight requirements below apply to the selected build-ready slice and its relevant seams. Thin work reports planning state and the next justified decision without generating full schemas, fixture packages or simulations. Contracted work reviews applicable irreversible decisions and includes a paper persona walkthrough for UI flows. Reuse shared decisions; leave future siblings thin. Required privacy, permission, execution and release gates remain in force. Reconcile contradictory custom legacy instructions explicitly using the shared policy; do not claim they passed.
You remain the interactive builder. The peer reviews frozen artifacts and never
owns the conversation, edits product code, runs duo-build or launches another
model. If SPECFLOW_DUO_REVIEWER is set, stop.
Claude Code: /duo-build #905, /duo-build "Explain an employee’s leave balance",
/duo-build resume <run-id>.
Codex: the same requests with $duo-build.
Only these two hosts are supported. Use the actual host identity, never infer it
from installed configuration directories. Claude builds → Codex reviews; Codex
builds → Claude reviews. The helper selects the peer from the current owner.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · +53 lines 00aa6aee348f
- 6d ago Changed · +38 lines 59a32456b759
- 7d ago Changed · +55 lines 91b895bb4390
- 8d ago Changed · +32 lines a1e95477e0f6
- 9d ago Changed · +32 lines a1e6939a1bdc
- 11d ago Changed · +53 lines · -2 tokens per session 24d23dd2c7f8
- 12d ago First seen · 92 lines · 37 tokens per session scan A 933aaac08aa8
duo-build is a skill published in the GitHub repository Hulupeep/Specflow (25 stars, last pushed yesterday), licensed MIT. It adds 35 tokens to every session and 4,865 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-17.
Other skills, from other repositories
argot-setup-ci
Wire argot into a repository's GitHub Actions as a non-blocking configured check on every pull request — a job summary plus code-scanning annotations. Use when the user wants argot "in CI", "on PRs", "as a GitHub Action", or asks to "set up argot CI". Distinct from argot-setup (local checking) and argot-review-pr…
audit
This skill should be used when the user asks to "audit spec coverage", "find uncovered modules", "scan for missing specs", "check wyx coverage", "get spec TODO list", "wyx audit", "wyx", or wants a prioritized list of wyx skill commands for uncovered modules. Scans for coverage gaps, pipeline/sync candidates, and…
ring:migrating-to-lib-observability
Migrating a Lerian Go app off lib-commons observability imports (deprecated shims or removed APIs) to lib-observability via a fixed mapping table, then bumps go.mod and validates the build; ring:backend-go applies the edits. Covers log/zap/runtime/assert, opentelemetry/tracing, HTTP middleware, context helpers, and…
ring:using-lib-systemplane
Using lib-systemplane, the hot-reload runtime-config plane (Postgres LISTEN/NOTIFY or MongoDB change streams), in two modes. Sweep Mode detects DIY config reload (SIGHUP, fsnotify, viper, pgx LISTEN), manual tenant-scoping, hand-built admin CRUD, and v4 residue. Reference Mode catalogs client lifecycle and…
ring:adopting-lib-commons-huma-wrapper
Adopting the lib-commons/v5 shared Huma (OAS 3.1) OpenAPI wrapper + RFC 9457 problem model (commons/net/http/{openapi,problem}) in a Lerian Go service: wire openapi.New/ServeSpec + problem.Install (central >=500 scrub) on BOTH runtime and spec-gen paths, the per-rail problem.MapError flex seam, and rename-only spec…
ring:applying-composition-patterns
React composition patterns that scale. Avoid boolean prop proliferation by using compound components, lifting state, and composing internals. Use when refactoring components with boolean prop proliferation, building flexible component libraries, or during architecture review. Skip for simple components with 1-2 props…