Borrowing it
Nothing to install: this file belongs to jentic/jentic-api-scorecard. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/jentic/jentic-api-scorecard/main/.claude/skills/sdd-implement-spec/SKILL.mdgit clone --depth 1 https://github.com/jentic/jentic-api-scorecardWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jentic/jentic-api-scorecard/sdd-implement-spec)<a href="https://agentmods.dev/skills/jentic/jentic-api-scorecard/sdd-implement-spec"><img src="https://agentmods.dev/badge/skills/jentic/jentic-api-scorecard/sdd-implement-spec/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jentic/jentic-api-scorecard/sdd-implement-spec"><img src="https://agentmods.dev/badge/skills/jentic/jentic-api-scorecard/sdd-implement-spec.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 163 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 249 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00215 | $0.07896 |
| Opus 5.5 | $0.00086 | $0.03158 |
| Sonnet 5.5 | $0.00043 | $0.01579 |
| Haiku 4.5 | $0.00021 | $0.00790 |
Grade A, and why
sdd-implement-spec scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 365 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/sdd-implement-spec — implement a feature spec
You are operating within a Spec-Driven Development (SDD) workflow. See .claude/rules/sdd-constitution.md.
This skill takes one unprocessed feature spec (a specs/YYYY-MM-DD-<slug>/ directory whose ## Phase N — ... heading in specs/roadmap.md does not yet carry the ✅ lifecycle marker) and drives the work end-to-end: cuts the feature branch, walks plan.md task groups, runs the verification gates, commits atomically per group, runs a pre-push review (built-in /review plus three parallel deep-review subagents), pushes, opens a PR, and reports back on implementation, review, and verification.
The skill drives implementation — it is not merely scaffolding around it. The actual code changes happen in the main loop guided by plan.md. The spec itself is read-only.
Inputs
Argument in $ARGUMENTS (optional):
- empty → enumerate unprocessed specs and pick via AskUserQuestion
- integer (
24,25) → spec whoserequirements.mdH1 starts with# Phase <N> - slug fragment (
"gate-allowlist") → case-insensitive contains match against spec dir slugs (the portion after the date prefix); if ambiguous, list matches and ask - relative path (
specs/2026-05-21-gate-allowlist) → use directly; verify it exists and is a valid spec dir
Hard constraints
- The spec is read-only during implementation. Do not edit
specs/<dir>/requirements.md,plan.md, orvalidation.md. If the spec is wrong, incomplete, or contradicts current code, stop and surface the gap; the user owns spec edits and may re-run the skill after revising. plan.mdis the source of truth for ordering and scope. Walk groups sequentially. Each non-Verify group produces one primary atomic commit; verification (Phase 7) may add small fix-up commits if a check fails. Tasks within a group can interleave as needed for the change to make sense.validation.mdis the source of truth for done. Every numbered check must pass before opening the PR. If a check fails and cannot be fixed without changing the spec, stop and surface it.- Roadmap completion marking is part of
plan.md. The convention is forplan.mdto include "Append✅to the## Phase N — <Title>heading inspecs/roadmap.md" as a numbered task in its final docs/lifecycle group; respect it. Ifplan.mddoes not include the completion-marking task, surface the gap before starting — do not improvise it. - Conventional Commits + DCO sign-off. Per
.claude/rules/conventional-commits.mdand.claude/rules/git-workflow.md. Every commitgit commit -s; header ≤ 69 chars; type+scope reflect the group's primary subject; lowercase imperative description, no trailing period. - Atomic, surgical commits. Per
.claude/rules/git-workflow.mdand.claude/rules/karpathy-guidelines.md: one logical change per commit (applies equally to primary group commits and Phase 7 verification fix-ups), touch only what the change requires, do not improve adjacent code. - No destructive git. No
--force, noreset --hard, no--no-verify. If a pre-commit hook rejects the commit, no commit was created — fix the underlying issue, restage, and retry the samegit commit(don't add a duplicate). The "never amend" rule applies after a commit already exists and you discover a problem; in that case add a fix-up commit on top instead of amending. - Stage explicit paths. Never
git add -Aorgit add .— name the files the group touched. After staging, verifygit diff --cached --name-onlylists only those paths. - Ask the user when work surfaces a real decision. During Phase 6 (implementation) and Phase 7 (verification), if a task surfaces a choice the spec doesn't lock down — multiple valid approaches a reasonable engineer would weigh, an adjacent change the spec didn't anticipate, drift between spec and code that has more than one reasonable resolution, ambiguous validation expectations — use
AskUserQuestionto surface it inline rather than picking silently or halting outright. Halting is for genuine blockers; questions are for genuine choices. The user is the source of truth when the spec isn't. - Track spec deviations and draft a retrospective. Maintain a running list across Phases 6, 7, and 8 of any concrete divergence between what the spec said and what the implementation had to do. Sources of deviations: file/line targets in
plan.mdthat drifted, scope the spec missed but the work required, validation checks that needed clarification, fix-up commits that revealed a gap. Each tracked item is one sentence naming the spec file (requirements.md/plan.md/validation.md), the section, and what changed in practice. Phase 9 emits this list in the PR body's## Spec deviationssection; Phase 8.5 commits aspecs/<date>-<slug>/retrospective.draft.mdon the branch so the reviewer has a structured starting point. The draft is provisional — the reviewer promotes it toretrospective.md(edit + rename) or deletes it before merge. Root cause and lessons are left as placeholders; the human fills them in. See.claude/rules/sdd-constitution.md(post-implementation feedback loop).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 365 lines · 215 tokens per session scan A fcd16af03662
sdd-implement-spec is a skill published in the GitHub repository jentic/jentic-api-scorecard (21 stars, last pushed 3d ago), licensed Apache-2.0. It adds 215 tokens to every session and 7,896 once invoked, about $0.0009 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
scalar-design-system
Scalar's design system — design tokens, theming (@scalar/themes), CSS variables, and the @scalar/components library. Use when designing or implementing Scalar UI, especially with Paper (code-to-design / design-to-code), so output matches real Scalar tokens, colors, typography, spacing, and components instead of…
bug-reporting-excellence
Write high-quality bug reports that get fixed quickly. Use when reporting bugs, training teams on bug reporting, or establishing bug report standards.
notion-sync
Standardize Notion task updates across all modes.
phasing
Group slices into risk-optimized phases with timeline generation.
lap
LAP CLI -- compile, search, and manage API specs for AI agents. Use when working with API specifications (OpenAPI, GraphQL, AsyncAPI, Protobuf, Postman), compiling specs to LAP format, searching the LAP registry, generating skills from API specs, or publishing APIs. Commands: init, compile, search, get, skill…
lap
LAP CLI -- compile, search, and manage API specs for AI agents. Use when working with API specifications (OpenAPI, GraphQL, AsyncAPI, Protobuf, Postman), compiling specs to LAP format, searching the LAP registry, generating skills from API specs, or publishing APIs. Commands: init, compile, search, get, skill…