dev-spec

dev-spec is a skill for Claude Code, Codex from linshidream/skill-hub. It costs 68 tokens per session (3,405 once invoked), scanned A, original, MIT.

A workflow that turns conversations, documents, API references, local PDF or Word files, and prototype images into a detailed development specification. A specification describes what to build, how to test it, and which source evidence supports each decision.

In plain words
What is it for?
Use it to collect project context, analyze supporting materials, ask clarifying questions, assess feature size, and write implementation-ready specs in the project's documentation folder.
Why use it?
It turns scattered requirements into an organized plan and highlights unclear points before coding starts. It also records where important facts came from and removes sensitive values from the output.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: mentions Claude Code.

Needs its repository: it runs a file that does not travel with it, so clone the repository first. The line is python3 skills/dev/dev-lifecycle/scripts/resolve-active-state.py --config .dev-flow.yml set <feature>.

Good fit Use it to collect project context, analyze supporting materials, ask clarifying questions, assess feature size, and write implementation-ready specs in the project's documentation folder.

Compare 6 skills from other repositories ↓
Install

Getting it into your agent

It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.

Clone the repo
git clone --depth 1 https://github.com/linshidream/skill-hub
agentmods
npx agentmods add skills/linshidream/skill-hub/dev-spec

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for dev-spec

README.md
[![agentmods](https://agentmods.dev/badge/skills/linshidream/skill-hub/dev-spec/github.svg)](https://agentmods.dev/skills/linshidream/skill-hub/dev-spec)
Your own site
<a href="https://agentmods.dev/skills/linshidream/skill-hub/dev-spec"><img src="https://agentmods.dev/badge/skills/linshidream/skill-hub/dev-spec/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for dev-spec

Your own site · 80×15
<a href="https://agentmods.dev/skills/linshidream/skill-hub/dev-spec"><img src="https://agentmods.dev/badge/skills/linshidream/skill-hub/dev-spec.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 68 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 3,405 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00068 $0.03405
Opus 5.5 $0.00027 $0.01362
Sonnet 5.5 $0.00014 $0.00681
Haiku 4.5 $0.00007 $0.00341

Measured 1mo ago against content hash 3313d61b8b04, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

dev-spec scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

- callback/webhook、签名规则、mock/curl 示例。
skills/dev/dev-spec/SKILL.md · 242 lines

How it starts

The opening of the file, as written. The whole thing — 242 lines — stays where its author put it; the contents beside it link to each section on GitHub.

开发需求规格化

目标

当用户开始一个新功能的开发时,收集需求描述、对接文档、API 文档、本地文件和原型图等材料,将非结构化信息转化为可开发、可测试、可追踪的 spec 文档,输出到项目 docs/specs/ 目录。

使用场景

当用户说出类似需求时触发:

  • "为 xxx 功能写需求文档"
  • "写一个需求文档"
  • "讨论一下新功能"
  • "输出 spec"
  • "整理需求"
  • "根据这份 API 文档整理开发需求"
  • "结合这个 PDF/Word/原型图写 spec"
  • "把这些对接材料整理成可开发的步骤"

前置条件

  • 项目根目录存在 .dev-flow.yml(可选,不存在时使用默认配置)
  • 如果存在 .dev-flow.yml,读取 spec.output-dir、spec.naming、spec.template、spec.required-sections、spec.materials
  • 不读取或输出明文密钥、token、密码、证书私钥和数据库连接串;材料中出现敏感值时必须脱敏

执行流程

  1. 读取项目根目录的 .dev-flow.yml(如果存在),获取 spec 配置。

  2. 读取项目 README、现有 spec 目录和相关代码入口,建立项目上下文。

  3. 建立材料清单(优先级:product handoff 已签字材料 > 用户临时描述 > 通用文档):

    • 先查 engagement 工作区根是否有 .opc-sw-flow-state.json 的 handoff.* 块(由 opc-sw-flow 编排传入);有则按「材料输入规范 → product handoff 材料」消费三类已签字冻结材料,其可信度高于口头描述。
    • 用户直接描述的需求。
    • 公网 HTTP/HTTPS 文档地址。
    • 本地 docx、pdf、md、txt、表格或压缩包内的需求文档。
    • 产品原型图、截图、流程图。
    • 第三方 API 文档、联调说明、mock 示例。
  4. 对每个材料生成 evidence note:

    • source_id、类型、路径或 URL、读取时间、可信度、敏感信息处理状态。
    • 与需求相关的关键事实、原文位置或截图引用。
    • 不确定点和需要用户确认的问题。
  5. 进入引导式澄清: a. "这次目标用户和业务目标是什么?"(如果材料已说明则跳过) b. "本次新增/改造的功能边界是什么?" c. "上游 API、原型或文档中哪些点必须严格遵循?" d. "有哪些技术、时间、权限、联调或数据约束?" e. "验收标准是什么?怎样算做完了?"

  6. 判断需求复杂度:

    • S:单点修改,通常 1 个开发步骤。
    • M:1-3 个业务步骤,建议按业务闭环拆分。
    • L:跨业务域、跨系统或高风险对接,必须拆步骤并标注风险。
    • XL:大型改造,V1 只生成计划;worktree 或多分支实施留到 V2。
  7. 根据 spec.template 选择模板生成 spec,并输出推荐实施步骤。

  8. 输出到 {spec.output-dir}/{spec.naming} 路径。

    • 默认:docs/specs/YYYYMMDD-{feature}.md
  9. 确定 feature slug 后,先调 dev-lifecycle 的解析脚本建立活动状态文件并指向该 feature(per-feature 模式下生成 .dev-flow/states/<feature>.json + 写指针 .dev-flow/active):

    python3 skills/dev/dev-lifecycle/scripts/resolve-active-state.py --config .dev-flow.yml set <feature>
    

    再把 spec 文件路径、功能 slug、材料清单、复杂度和实施步骤写入解析出的活动状态文件(resolve 子命令输出的 state-path,供 dev-lifecycle/git-flow 读取)。state.storage: single 时该脚本回退到单一 .dev-flow-state.json,行为不变。

材料输入规范

公网 HTTP/HTTPS 文档

  • 记录 URL、读取时间和标题。
  • 如果页面会变化,在 spec 中写明 retrieved-at。
  • 如果需要登录或访问失败,要求用户提供导出的本地文件或可访问副本。
  • 不把含凭据的 URL 原样写入 spec;query 中疑似 token 的值必须脱敏。

Read the full file on GitHub · 242 lines

Files

What ships with it

7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago Changed · +25 lines 3313d61b8b04
  2. 1mo ago First seen · 217 lines · 68 tokens per session scan A 9a64cf9b0e3c

Subscribe to this mod's changes

dev-spec is a skill published in the GitHub repository linshidream/skill-hub (20 stars, last pushed 1mo ago), licensed MIT. It adds 68 tokens to every session and 3,405 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

local-ai-agents

Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…

microsoft/ai-agents-for-beginners · 200 tokens

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

obra/superpowers · 21 tokens

next-cache-components-adoption

Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…

vercel/next.js · 95 tokens

chat-pet-sprite-creation

Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.

microsoft/vscode · 53 tokens

cpu-profile-analysis

Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…

microsoft/vscode · 71 tokens

insight-error-page

Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…

vercel/next.js · 83 tokens