cavekit is a Claude Code plugin that organizes software changes through a compact, spec-driven workflow stored in a SPEC.md file. It is for developers who want to plan, research, review, and build changes while preserving project context across sessions; the catalogue entries are its skills, commands, plugin configuration, and workflow rules.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add JuliusBrussee/cavekit --skill checkgit clone --depth 1 https://github.com/JuliusBrussee/cavekitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/juliusbrussee/cavekit/check)<a href="https://agentmods.dev/skills/juliusbrussee/cavekit/check"><img src="https://agentmods.dev/badge/skills/juliusbrussee/cavekit/check/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/juliusbrussee/cavekit/check"><img src="https://agentmods.dev/badge/skills/juliusbrussee/cavekit/check.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00102 | $0.00771 |
| Opus 5.5 | $0.00041 | $0.00308 |
| Sonnet 5.5 | $0.00020 | $0.00154 |
| Haiku 4.5 | $0.00010 | $0.00077 |
Grade A, and why
check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 94 lines — stays where its author put it; the contents beside it link to each section on GitHub.
check — drift report
Pure diagnostic. Reports violations. Writes nothing. User decides remedy.
Spec drifting silently from code is the #1 SDD failure mode. check is the
detector. Run it after each /build and before each ship — drift caught here is
a diff; drift caught in prod is a §B.
LOAD
- Read
SPEC.md. If missing → "no spec, nothing to check." Stop. - Parse invocation args:
§V→ check invariants only (default)§I→ check interfaces§T→ audit task status vs code--all→ all three
CHECK §V — invariants
For each V:
- Translate invariant into verifiable claim about code.
- Grep / read relevant files.
- Classify: HOLD / VIOLATE / UNVERIFIABLE.
- Record address + file:line evidence.
CHECK §I — interfaces
For each I item:
- Locate implementation.
- Classify:
- MATCH — shape in code = shape in spec.
- DRIFT — impl exists, shape differs.
- MISSING — impl absent.
- EXTRA — code exposes surface not in §I.
CHECK §T — tasks
For each T:
- If
x: verify claimed work present. - If
~: note as in-progress. - If
.: note as pending. - Flag
xrows with no evidence as STALE.
REPORT
Caveman. Grouped by severity.
## §V drift
V2 VIOLATE: auth/mw.go:47 uses `<` not `≤`. see §B.1.
V5 UNVERIFIABLE: no test covers ∀ req path.
## §I drift
I.api DRIFT: POST /x returns `{result}` not `{id}`. route.go:112.
I.cmd MISSING: `foo bar` absent from cli/*.go.
## §T drift
T3 STALE: status `x`, no middleware file exists.
## summary
2 violate. 1 missing. 1 stale. 1 unverifiable.
next: spec skill with `bug:` or fix code at cited lines.
REMEDY HINTS (not actions)
End report with one-line hint per class:
- VIOLATE / DRIFT → invoke spec skill
bug: <V.n>or fix code. - MISSING → invoke build skill on
§T.nif task exists; else spec skillamend §T. - STALE → spec skill
amend §Tto uncheck. - EXTRA → spec skill
amend §Ito document, or delete code.
Never invoke fixes. Report only.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 94 lines · 102 tokens per session scan A 6daabb7099f2
check is a skill published in the GitHub repository JuliusBrussee/cavekit (1,156 stars, last pushed 2mo ago), licensed MIT. It adds 102 tokens to every session and 771 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
bug-investigator
Use when encountering any bug, test failure, or unexpected behavior during spec-superflow execution, before proposing fixes. Invoked automatically when build-executor hits a blockage.
speq-audit
Audit a speq project's health — spec-library structure, feature/decision-log/plan validation, ADR noise, mission-to-spec sync, unrecorded plans, and gitignore hygiene — then guide fixes. Use when the user asks to audit, health-check, doctor, lint, or sanity-check the specs or repo, or after cloning or inheriting a…
critical-review
4-phase adversarial review protocol: pre-flight analysis, adversarial execution check, self-correction loop, and [VALIDATION] report.
diagnosing-bugs
Diagnosis loop for hard bugs and performance regressions. Use when the user says diagnose/debug, or reports broken/failing/slow behavior.
gke-workload-scaling-troubleshooting
Diagnoses GKE HorizontalPodAutoscaler (HPA) failures — metrics showing as , FailedGetResourceMetric / FailedGetScale / FailedComputeMetricsReplicas events, missing Pod resource requests, custom/external metrics-pipeline breakage (FailedGetExternalMetric / FailedGetCustomMetric, unavailable metrics adapter…
gke-ai-troubleshooting-jobset-interruption
Diagnoses GKE JobSet interruptions, restarts, and preemptions for AI/ML training workloads autonomously. Use when troubleshooting JobSet restart loops, spot VM preemptions, node readiness failures, host VM issues, or coordinator worker crashes. Don't use for general GKE cluster creation, basic workload deployment, or…