Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/nicepkg/ai-workflow/requirementsnpx skills add nicepkg/ai-workflow --skill requirementsgit clone --depth 1 https://github.com/nicepkg/ai-workflowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nicepkg/ai-workflow/requirements)<a href="https://agentmods.dev/skills/nicepkg/ai-workflow/requirements"><img src="https://agentmods.dev/badge/skills/nicepkg/ai-workflow/requirements.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00028 | $0.01885 |
| Opus 5 | $0.00014 | $0.00942 |
| Sonnet 5 | $0.00006 | $0.00377 |
| Haiku 4.5 | $0.00003 | $0.00188 |
Grade A, and why
requirements-specification scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 322 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Requirements & Specification Skill
Transform customer insights into clear, detailed specifications that engineering can build from. Master user story writing, define acceptance criteria, and manage scope ruthlessly.
User Story Writing (INVEST Format)
INVEST Principles
I - Independent (minimal dependencies) N - Negotiable (details can be discussed) V - Valuable (delivers customer value) E - Estimable (team can estimate effort) S - Small (can complete in 1-2 sprints) T - Testable (clear success criteria)
User Story Template
As a [user role]
I want [action/capability]
So that [benefit/outcome]
Acceptance Criteria:
Given [context]
When [user action]
Then [expected result]
Good vs Bad Examples
Bad Story:
As a user
I want a better dashboard
So that I can see my data
Problem: Too vague, not testable, too large
Good Story:
As a project manager
I want to see all tasks assigned to me in the last 24 hours
So that I can track what happened while I was offline
Acceptance Criteria:
Given I'm logged in
When I view the Home dashboard
Then I see a "Recent Tasks" section
And it shows tasks assigned to me from last 24 hours
And tasks are sorted by assignment time (newest first)
And clicking a task opens the task detail page
Acceptance Criteria (BDD Format)
Scenario Template
Scenario: [Specific user action]
Given [initial context/state]
When [user performs action]
Then [expected result]
And [additional verification]
Example: Password Reset Feature
Scenario: User resets password with valid email
Given I'm on the login page
And I'm not logged in
When I click "Forgot Password?"
And enter my email address
And click "Send Reset Email"
Then I see message "Check your email for reset link"
And a password reset email is sent to that address
And the email contains a valid reset link
Scenario: User uses expired reset link
Given I received a password reset email
And the reset link is more than 24 hours old
When I click the reset link
Then I see "Link has expired"
And I'm offered to request a new reset link
Scenario: Password doesn't meet requirements
Given I'm on password reset page
When I enter password "123"
Then I see error "Password must be 8+ characters"
And the form doesn't submit
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 322 lines · 28 tokens per session scan A 84ac3124a9c6
requirements-specification is a skill published in the GitHub repository nicepkg/ai-workflow (282 stars, last pushed 7mo ago), licensed MIT. It adds 28 tokens to every session and 1,885 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
aatmf-t10-confidentiality-breach
AATMF T10 — Integrity & Confidentiality Breach. System prompt extraction, training-data extraction, model-weight leakage, private-key recovery.
ensembl-database
Query Ensembl genome database REST API for 250+ species. Gene lookups, sequence retrieval, variant analysis, comparative genomics, orthologs, VEP predictions, for genomic research.
mochi-remind
Handle due reminders — notify the user with natural language and mark them done.
memory
Use when the user asks to remember, recall, forget, update, search, or inspect durable OpenSquilla memory, including profile facts in USER.md and long-term notes in MEMORY.md or memory//.md.
lazarus-group
Adversary-emulation profile for Lazarus Group (G0032, aka Hidden Cobra / Diamond Sleet / Labyrinth Chollima), a North Korean RGB-linked actor conducting espionage, destructive, and financially motivated operations.
sidewinder-rattlesnake
Adversary-emulation profile for SideWinder (G0121 / Rattlesnake / T-APT-04 / Razor Tiger), India's suspected state-sponsored cyber-espionage actor.