Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add joenandez/spectre --skill spectre-testgit clone --depth 1 https://github.com/joenandez/spectreWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/joenandez/spectre/spectre-test)<a href="https://agentmods.dev/skills/joenandez/spectre/spectre-test"><img src="https://agentmods.dev/badge/skills/joenandez/spectre/spectre-test/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/joenandez/spectre/spectre-test"><img src="https://agentmods.dev/badge/skills/joenandez/spectre/spectre-test.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00103 | $0.01369 |
| Opus 5 | $0.00051 | $0.00685 |
| Sonnet 5 | $0.00021 | $0.00274 |
| Haiku 4.5 | $0.00010 | $0.00137 |
Grade A, and why
spectre-test scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 61 lines — stays where its author put it; the contents beside it link to each section on GitHub.
test
Add risk-weighted behavioral tests and commit standalone batches. Test boundaries, prioritize where breakage hurts, skip code that cannot break; risk assessment is inline and no intermediate report files exist.
Inputs
$ARGUMENTS— optional explicit feature name/root or descendant artifact, scope hint, or specific files to focus on, plus--orchestratedwhen a parent workflow owns the next step.- Optional orchestrator-provided risk plan from
spectre-cleanorspectre-ship: files already tiered P0-P3 plus batch assignment. When present, use it as the plan for this batch.
Working Set (late-bound — read at run-time, never inline)
- Reuse a managed
FEATURE_ROOTonly when explicit/current-thread evidence ties it to this work (physical directory wins; never branch/recency/lifecycle/scans); distinct work ignores ambient roots. Otherwise, including on collision, standalone MUST first load and followSkill(spectre-feature-root)through DONE; orchestrated calls escalate. Keep writes beneath it and pass it unchanged. - Repair stale feature/root metadata in artifacts this workflow touches.
- Full Working Set = UNION of: committed changes (validate any provided
commit_id; invalid → STOP and ask), staged (git diff --cached --name-only), unstaged (git diff --name-only), untracked (git ls-files --others --exclude-standard). Keep the projection local/in-thread; write no working-set artifact. - Standalone: baseline-lint the set and map import/dependency edges. All paths absolute from repo root.
Method / guardrails
- Orchestrated Ship/Clean mode: consume the supplied unchanged set/risk plan; do not redo broad analysis. Edit tests/fixtures only—never production/source; do not stage or commit. The test lead may batch testers internally, runs only new/changed focused tests, and returns compact changed-path/check results plus cross-boundary needs to the parent.
- Triage every changed file into a risk tier (inline):
- P0 Critical —
auth/payment/security/crypto/session/token, PII/permissions/user-data mutation, external handlers, DB migrations, or@critical. Cover every user-facing outcome/error path, null/empty/malformed/overflow security inputs, public API/schema, and mutation-resistant assertions. - P1 Core — feature components, API/state/business logic, fetch/cache. Cover public happy/error paths and exported-boundary contracts; skip internal helpers/exhaustive branches.
- P2 Supporting — real-logic utils/validators/transformers/hooks/adapters. Cover exported happy paths; skip private/trivial functions.
- P3 Skip — types, config, styles/docs, logic-free constants/enums/barrels/pass-throughs, generated/build tooling. Types + lint suffice; mark SKIP — {reason}.
- P0 Critical —
- Write or consume the in-thread test plan (3–7 bullets,
- [P{tier}] {file}: {behavior}): P0 → multiple bullets (behaviors + error paths); P1 → 1–2; P2 → 1; P3 → SKIP line. - Dispatch
@spectre_testerin parallel: one message/multiple tasks; P0 = one agent/file, P1 = 2–3 files/agent, P2 = 3–5, up to 8 agents. Give batch paths/tier and require behavioral, outcome-not-call, mutation-resistant tests; wait before verifying. - Quality: one behavior/test; descriptive
when_[cond]_then_[outcome]names; outcome assertions (calls only for prevented side effects), refactor/mutation resilience. Do not mock internals, duplicate type/framework coverage; test API/event schemas at boundaries. - Verify before commit: standalone runs affected lint plus new/changed and related tests across demonstrated dependencies, then spot-checks quality. Branch-caused → repair/reverify; unrelated → route/continue; indeterminate → reproduce only the failing check at base. Never run a repository-wide baseline or full suite from this skill.
- Commit guard:
--no-verify,eslint-disable, and committing code carryingeslint-disableare expressly forbidden without the user's explicit permission.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +3 lines d0e7207164cb
- 4d ago Changed · -39 tokens per session 0f9b0b05c425
- 10d ago First seen · 58 lines · 142 tokens per session scan A 98618d28ceaa
spectre-test is a skill published in the GitHub repository joenandez/spectre (161 stars, last pushed today), licensed MIT. It adds 103 tokens to every session and 1,369 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
research-engineer
An uncompromising Academic Research Engineer. Operates with absolute scientific rigor, objective criticism, and zero flair. Focuses on theoretical correctness, formal verification, and optimal implementation across any required technology.
tika-eval-compare
Compare extracts from two Tika builds over a corpus to detect regressions in content, encoding, exceptions, and embedded-document handling. Use for "compare before/after extracts", "eval this change against the corpus".
neuron-evaluation-engineer
Create and run AI evaluations with datasets, assertions, and output drivers in Neuron AI. Use this skill whenever the user mentions evaluation, testing AI systems, creating evaluators, dataset-driven testing, assertion-based validation, or wants to measure AI system performance. Also trigger for tasks involving…
jetson-validate-image
Use after jetson-flash-image to run static BSP checks, on-target smoke/regression tests on a flashed DUT, or both. Not for build or flash steps. Triggers: validate bsp, on-target validation.
atmos-validation
Validate Atmos projects, components, arbitrary JSON Schema inputs, EditorConfig, and GitHub Actions; use affected-file selection and native CI annotations.
skill-benchmark
Benchmark AI skill effectiveness by measuring implementation quality against legacy constraints.