Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/magebyte-zero/spec-superflow/build-executornpx skills add MageByte-Zero/spec-superflow --skill build-executorgit clone --depth 1 https://github.com/MageByte-Zero/spec-superflowWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00039 | $0.04265 |
| Opus 5 | $0.00019 | $0.02132 |
| Sonnet 5 | $0.00008 | $0.00853 |
| Haiku 4.5 | $0.00004 | $0.00426 |
Grade A, and why
build-executor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 289 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Build Executor
Controls the implementation phase. Uses execution-contract.md as the workflow authority.
Required Inputs
For Full or legacy Hotfix, read execution-contract.md, tasks.md, relevant specs/, and relevant design.md. Quick, direct incident Hotfix, and Tweak require only their receipt, request boundary, changed files, and verification command.
Check workflow mode and receipt first. Tweak → direct edit mode. Quick or a valid direct incident Hotfix → Direct Quick and Hotfix. Full or legacy Hotfix → standard contract-first discipline.
Branch/worktree preflight before ANY implementation edit — workflow-aware:
Full / legacy Hotfix — isolation mandatory (do not skip):
- Run the isolation check:
This script enforces git isolation: if you are onssf isolate <change-dir>main/masterit creates a git worktree (preferred) or a new branch, and exits non-zero if it cannot and you have not approved--force. - If
ssf isolateexits non-zero: STOP. Do not editmain/masterin place. Ask the user for explicit approval (and re-run withssf isolate <change-dir> --forceonly after they approve). A non-zero exit also covers a failed submodule initialization after the isolation context was created — never implement on a half-initialized worktree. - If it succeeds, report the chosen branch/worktree and make all implementation
edits there.
ssf isolatealso recursively initializes submodules in the new isolation context when a.gitmodulesexists, and appends a cwd-persistence warning (isolation path + mandatorycdprefix rule) to<change-dir>/.superpowers/sdd/progress.mdso later Bash calls do not silently edit the trunk. - Closure (including
ssf finish <change-dir>for Full/legacy Hotfix) is owned by release-archivist — route there after review passes.
Quick / direct Hotfix / Tweak / lightweight — skip isolation, edit directly on the current branch. Rationale: no recordReview (R4 never fires), no ssf finish merge, no wave receipts — a worktree would be dead weight. For sensitive scenarios requiring manual isolation, run ssf isolate <change-dir> --force explicitly.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 289 lines · 39 tokens per session scan A 042d41e46dfd
build-executor is a skill published in the GitHub repository MageByte-Zero/spec-superflow (776 stars, last pushed 4d ago), licensed MIT. It adds 39 tokens to every session and 4,265 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
test-driven-development
在实现任何功能或修复 bug 时使用，在编写实现代码之前.
old-coder
Evidence-first development — surround the implementation with an executable spec and a gauntlet of constraints (tests, types, coverage, mutation) so line-by-line review becomes optional. Use when the user explicitly asks for high-assurance or evidence-first work ("reliable", "TDD", "prove it works", "I won't read the…
speq-implement
Orchestrate implementation of a reviewed plan: task breakdown, TDD sub-agents, code review, and verification report. Use when the user asks to implement, build, or execute a plan under specs/plans/ — after /speq-plan, before /speq-record. Arg: .
speq-code-guardrails
TDD cycle and code quality guardrails — failing-test-first, evidence, dependency, error-handling, and test-quality rules. Triggered by /speq-implement, implementer-agent, implementer-expert-agent, and code-reviewer before any implementation or review work.
aiops-implement
Delivery overlay — orchestrates lean ladder, tdd, prune, review with sub-phase gates; commits only on user approval.
tdd
Test-driven development — vertical red-green-refactor slices through public interfaces.