Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add maksimzayats/specx --skill specx-project-toolinggit clone --depth 1 https://github.com/maksimzayats/specxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/maksimzayats/specx/specx-project-tooling)<a href="https://agentmods.dev/skills/maksimzayats/specx/specx-project-tooling"><img src="https://agentmods.dev/badge/skills/maksimzayats/specx/specx-project-tooling/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/maksimzayats/specx/specx-project-tooling"><img src="https://agentmods.dev/badge/skills/maksimzayats/specx/specx-project-tooling.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00076 | $0.00890 |
| Opus 5 | $0.00038 | $0.00445 |
| Sonnet 5 | $0.00015 | $0.00178 |
| Haiku 4.5 | $0.00008 | $0.00089 |
Grade A, and why
specx-project-tooling scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 71 lines — stays where its author put it; the contents beside it link to each section on GitHub.
specx Project Tooling
Use this skill to make the repository executable and checkable. Read
references/tooling.md before editing tooling files.
Workflow
- Use
specx init <path>for the fresh framework-neutral baseline. It renders the canonicalpyproject.toml, Makefile,.python-version, health core/IOC scaffold, mirrored unit tests, and root guidance, then runsuv add specx diwireanduv add --dev mypy pytest ruffunless--no-syncis passed. Let uv select and record compatible releases rather than rendering dependency floors. - Preserve the repo's Python version if it already exists. For a new repo,
default to Python 3.14. The initializer accepts any
major.minorvalue; do not hardcode a release allowlist that blocks future Python versions. - Use
uvmetadata inpyproject.toml. - For a new project, verify current compatible releases against the official package indexes and documentation before copying reference floors. Preserve intentional versions in an existing repo unless the user asks to upgrade.
- Add runtime dependencies only for real runtime features. For a starter API,
include
specx, FastAPI,diwire,pydantic-settings, and Uvicorn. - Add dev dependencies for pytest, Ruff, mypy, HTTP testing, and ASGI lifespan testing when there is a FastAPI app.
- Keep mypy strict. Do not enable the DIWire mypy plugin for constructor-field
injection; it is only needed if an existing project intentionally uses
resolver_context.injectfunction wrappers. - Enable
select = ["ALL"]for Ruff in new projects. Ignore only formatter conflicts and deliberate file-category conventions, and put a concise comment describing what each ignored rule checks beside its code. - Generate
[tool.specx]withselect = ["ALL"]so every applicable built-in guardrail is explicit. Missing technology surfaces are skipped forALL; explicit technology selectors still warn when their surface is absent. - Add simple Makefile targets:
check,format,lint,test, anddevwhen there is a FastAPI delivery app.lintruns Ruff, mypy, anduv run --locked specx check; do not create separateguardrailsorlock-checktargets. - If SQLAlchemy adapters exist, add Alembic dependency/config and
migrate/makemigrationstargets with$specx-sqlalchemy-migrations. - When adding or changing Makefile targets, update root
AGENTS.mdCommands so coding agents run the right project commands. - Use locked execution for non-mutating validation commands.
- Run the smallest useful checks after changing tooling.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 71 lines · 76 tokens per session scan A 1d69237bab2e
specx-project-tooling is a skill published in the GitHub repository maksimzayats/specx (201 stars, last pushed 1mo ago), licensed MIT. It adds 76 tokens to every session and 890 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
temporal-python-testing
Test Temporal workflows with pytest, time-skipping, and mocking strategies. Covers unit testing, integration testing, replay testing, and local development setup. Use when implementing Temporal workflow tests or debugging test failures.
test-corpus
The testdocuments submodule is a bucket-fetched fixture corpus that is not committed. This skill covers readtestfixture, missing fixtures, valid A/B controls, and submodule push order. Load before running Rust tests on a fresh clone, setting up an A/B control, adding a fixture-backed test, or diagnosing…
python-providers
Create, modify, test, or package Python provider adapters under python/providers, including framework-specific dependencies, public imports, type inference, and provider metadata. Use for Python provider work only; use python-sdk for core SDK changes.
adk-verify-snippets
Checks that every Python code block in a Markdown file actually compiles and runs, by extracting each block to a temporary file, executing it in an isolated subprocess, and writing a pass/fail report with per-snippet coverage. Use when the user asks to verify, test, or validate the code samples in a README, a guide…
adk-setup
Sets up a local ADK Python development environment in a git clone of the open-source adk-python repository: a uv virtual environment, all dependency extras, pre-commit hooks, and a first unit-test run. Runs only when explicitly requested, never on its own. Use when asked to set up, bootstrap, or repair a development…
typescript
TypeScript strict mode with eslint and jest.