dev-spec

A workflow that turns conversations, documents, API references, local PDF or Word files, and prototype images into a detailed development specification. A specification describes what to build, how to test it, and which source evidence supports each decision.

In plain words
What is it for?
Use it to collect project context, analyze supporting materials, ask clarifying questions, assess feature size, and write implementation-ready specs in the project's documentation folder.
Why use it?
It turns scattered requirements into an organized plan and highlights unclear points before coding starts. It also records where important facts came from and removes sensitive values from the output.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/linshidream/skill-hub/dev-spec
Any agent
npx skills add linshidream/skill-hub --skill dev-spec
Clone the repo
git clone --depth 1 https://github.com/linshidream/skill-hub

Made for: Claude Code, Codex.

Per session 68 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,520 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00068 $0.02520
Opus 5 $0.00034 $0.01260
Sonnet 5 $0.00014 $0.00504
Haiku 4.5 $0.00007 $0.00252

Measured 2d ago against content hash 9a64cf9b0e3c, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

dev-spec scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

- callback/webhook、签名规则、mock/curl 示例。
skills/dev/dev-spec/SKILL.md · 217 lines

How it starts

The opening of the file, as written. The whole thing — 217 lines — stays where its author put it; the contents beside it link to each section on GitHub.

开发需求规格化

目标

当用户开始一个新功能的开发时,收集需求描述、对接文档、API 文档、本地文件和原型图等材料,将非结构化信息转化为可开发、可测试、可追踪的 spec 文档,输出到项目 docs/specs/ 目录。

使用场景

当用户说出类似需求时触发:

  • "为 xxx 功能写需求文档"
  • "写一个需求文档"
  • "讨论一下新功能"
  • "输出 spec"
  • "整理需求"
  • "根据这份 API 文档整理开发需求"
  • "结合这个 PDF/Word/原型图写 spec"
  • "把这些对接材料整理成可开发的步骤"

前置条件

  • 项目根目录存在 .dev-flow.yml(可选,不存在时使用默认配置)
  • 如果存在 .dev-flow.yml,读取 spec.output-dirspec.namingspec.templatespec.required-sectionsspec.materials
  • 不读取或输出明文密钥、token、密码、证书私钥和数据库连接串;材料中出现敏感值时必须脱敏

执行流程

  1. 读取项目根目录的 .dev-flow.yml(如果存在),获取 spec 配置。

  2. 读取项目 README、现有 spec 目录和相关代码入口,建立项目上下文。

  3. 建立材料清单:

    • 用户直接描述的需求。
    • 公网 HTTP/HTTPS 文档地址。
    • 本地 docxpdfmdtxt、表格或压缩包内的需求文档。
    • 产品原型图、截图、流程图。
    • 第三方 API 文档、联调说明、mock 示例。
  4. 对每个材料生成 evidence note:

    • source_id、类型、路径或 URL、读取时间、可信度、敏感信息处理状态。
    • 与需求相关的关键事实、原文位置或截图引用。
    • 不确定点和需要用户确认的问题。
  5. 进入引导式澄清: a. "这次目标用户和业务目标是什么?"(如果材料已说明则跳过) b. "本次新增/改造的功能边界是什么?" c. "上游 API、原型或文档中哪些点必须严格遵循?" d. "有哪些技术、时间、权限、联调或数据约束?" e. "验收标准是什么?怎样算做完了?"

  6. 判断需求复杂度:

    • S:单点修改,通常 1 个开发步骤。
    • M:1-3 个业务步骤,建议按业务闭环拆分。
    • L:跨业务域、跨系统或高风险对接,必须拆步骤并标注风险。
    • XL:大型改造,V1 只生成计划;worktree 或多分支实施留到 V2。
  7. 根据 spec.template 选择模板生成 spec,并输出推荐实施步骤。

  8. 输出到 {spec.output-dir}/{spec.naming} 路径。

    • 默认:docs/specs/YYYYMMDD-{feature}.md
  9. 确定 feature slug 后,先调 dev-lifecycle 的解析脚本建立活动状态文件并指向该 feature(per-feature 模式下生成 .dev-flow/states/<feature>.json + 写指针 .dev-flow/active):

    python3 skills/dev/dev-lifecycle/scripts/resolve-active-state.py --config .dev-flow.yml set <feature>
    

    再把 spec 文件路径、功能 slug、材料清单、复杂度和实施步骤写入解析出的活动状态文件(resolve 子命令输出的 state-path,供 dev-lifecycle/git-flow 读取)。state.storage: single 时该脚本回退到单一 .dev-flow-state.json,行为不变。

材料输入规范

公网 HTTP/HTTPS 文档

  • 记录 URL、读取时间和标题。
  • 如果页面会变化,在 spec 中写明 retrieved-at
  • 如果需要登录或访问失败,要求用户提供导出的本地文件或可访问副本。
  • 不把含凭据的 URL 原样写入 spec;query 中疑似 token 的值必须脱敏。

本地 DOCX/PDF/Markdown/文本

  • 优先提取正文、标题层级、表格和 API 示例。
  • 对合同、密钥、生产配置等敏感内容只保留脱敏摘要。
  • 大文件只摘取与当前需求有关的章节,不做无关全文总结。

Read the full file on GitHub · 217 lines

Files

What ships with it

7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 217 lines · 68 tokens per session scan A 9a64cf9b0e3c

Subscribe to this mod's changes

dev-spec is a skill published in the GitHub repository linshidream/skill-hub (19 stars, last pushed 21d ago), licensed MIT. It adds 68 tokens to every session and 2,520 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

obra/superpowers · 21 tokens

next-cache-components-adoption

Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…

vercel/next.js · 95 tokens

babysit-pr

Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…

openai/codex · 114 tokens

imagegen

Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…

openai/codex · 113 tokens

cpu-profile-analysis

Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…

microsoft/vscode · 71 tokens

next-cache-components-optimizer

Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…

vercel/next.js · 170 tokens