Borrowing it
Nothing to install: this file belongs to objectstack-ai/objectstack. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/objectstack-ai/objectstack/main/.claude/skills/spec-property-retirement/SKILL.mdgit clone --depth 1 https://github.com/objectstack-ai/objectstackWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/objectstack-ai/objectstack/spec-property-retirement)<a href="https://agentmods.dev/skills/objectstack-ai/objectstack/spec-property-retirement"><img src="https://agentmods.dev/badge/skills/objectstack-ai/objectstack/spec-property-retirement/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/objectstack-ai/objectstack/spec-property-retirement"><img src="https://agentmods.dev/badge/skills/objectstack-ai/objectstack/spec-property-retirement.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 15 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00172 | $0.07831 |
| Opus 5.5 | $0.00069 | $0.03132 |
| Sonnet 5.5 | $0.00034 | $0.01566 |
| Haiku 4.5 | $0.00017 | $0.00783 |
Grade A, and why
spec-property-retirement scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 338 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Spec 属性退役(ADR-0049 enforce-or-remove)
被解析却不被强制执行的属性是静默 no-op;对安全或能力类属性,它是假合规 ——
tool.permissions 承诺过一道没人强制的调用门,flow.active: false 从未停下过任何
flow。ADR-0049 说这样的属性必须被强制执行、标 experimental,或不存在。
本技能是第三条路:一次删除真正的代价是什么,按什么顺序付。
删掉键本身也许只占 5% 的工作。其余 95% 在于:一个键可以在 ~14 个地方被编写,而守 着每个地方的门禁是分别地、串行地失败的 —— 一个过期面遮住其余全部,于是你得到的 是 每个面一轮红构建,而不是一轮报出全部。
先读验证侧:packages/spec/liveness/README.md(裁定怎么得出、verifiedAt、为什么
preview renderer 不算消费者)与 AGENTS.md §"Touched packages/spec?"(八个生成产
物)。本文不重复它们。
0. 动手删之前:删除是正确的处置吗?
- 它是安全/能力形状的吗? 那么 ADR-0049 约束成立,惰性是缺陷不是债。
rls.enabled曾是「证据错误的 live」而实际无人读取 —— disabled 的 policy 仍在贡献它的授权。那个键最后是被强制执行,不是被删除。功能存在时,强制 执行赢。 - 主流平台有没有这个能力? 声明而未执行的键每族问这句,按维护者原话(裁决评论
5727134555):「有 ⇒ 补消费端(一次做对);没有 ⇒ 退役,而不是看仓里有没有人读」。 文档形状的键(hook.label、flow.description)为下一个读者记录意图(ADR-0033),是「有」的 一例:补渲染、不退役,判定写进台账note,下次审计不再重审。description、tags、icon不自动豁免:RLS 策略的tags主流没有 ⇒ 退役。authorWarn另按 README 判。 - 有已承诺的路线图吗? 那就是
experimental+.describe()里的[EXPERIMENTAL — not enforced]标记,不是删除。 - 同 major 记账。 同一个未发布 major 里更早的 conversion 改名了你现在要删
的键,就吸收它:把改名折进删除,删掉改名条目。二者复合后效果不可观测,而
conversion 表的 fixture 不相交契约(§3)会因叠放而失败。先例:
agent.knowledge在发布前吞掉了topics→sources改名。 - 台账判它
live-elsewhere吗? 本仓实测无消费者、姊妹仓真在强制执行的 键 —— 永不是删除候选。该核的不是删除面,是它的佐证纪律:外仓指针、evidenceScope: "cross-repo"、带日期的verifiedAt、180 天过期 —— 四条由packages/spec/scripts/liveness/elsewhere.mts执行,出处见 README 的live-elsewhere一节。 - 零编写实例普查要并跑一个同族已知存活的键作对照,两读数都报;同得零即没测出。
- 拿
cross-repo行当论据,就当刻重核路径与行号:漂了读作重新取证,⛔ 不是dead。 - 「零编写实例」≠「没有代码读它」。 前者答的是示例应用,后者才证
dead。
1. 裁判是构建,不是台账
台账的 dead 裁定是删除的输入,不能替代构建自己的证明。代码在它底下双向移动
(flow.status 与 action.undoable 都被低估过)。
所以:先尝试删除,让构建来裁。 #3896 收尾里,view.form.data 挂在工作清单上是
dead(「两个仓都没有 form 路径的读者」),而删除打断了 gen:schema。正确的
回应不是硬删:把台账条目改回 live、附真实证据与 verifiedAt,收窄
conversion,钉上 non-warn。十四个键里有一个是这样被证伪的 —— 给它留预算。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago Changed 10dc833e289a
- 14d ago Changed e85621c6b30e
- 17d ago Changed bb4f0d7b1a7e
- 25d ago Changed f17eb3e7951f
- 27d ago Changed f26cd33a8dd7
- 1mo ago Changed b0032f532e31
- 1mo ago Changed 20113d31eabe
- 1mo ago Changed 2a3ef44117d3
- 1mo ago Changed 37d416b3eaa7
- 1mo ago First seen · 338 lines · 172 tokens per session scan A 088fcfdf00ea
spec-property-retirement is a skill published in the GitHub repository objectstack-ai/objectstack (75 stars, last pushed today), licensed Apache-2.0. It adds 172 tokens to every session and 7,831 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ontotect
Systematic ontology engineering for designing, constructing, reviewing, repairing, optimizing, refactoring, validating, documenting, and governing ontologies, vocabularies, taxonomies, knowledge graphs, semantic models, and mappings. Use for RDF/RDFS, OWL 2, SKOS, SHACL, SPARQL, OBO, Turtle, JSON-LD, RDF/XML…
integrate
Build or change a customer-system integration with explicit data mapping, permissions, retries and reconciliation. Use for connectors, imports, write-back and upstream APIs.
mykg
Run mykg knowledge-graph commands inside Claude Code from one slash command /mykg. The user describes intent in natural language (extract, append, sync, resume, approve, walkthrough, parse-docs, fetch-web, query); the skill parses intent, builds the right mykg CLI command from the live --help output, confirms, runs…
exchange-recovery
A recovery workflow for Exchange servers, which are systems used for organisational email and calendars. It covers planning a restoration from backups, creating a recovery job, and checking whether the service works afterward.
demand-deliverability-assessment
Use when a user asks whether a product demand (an existing forecast or a new order) can be delivered on knowledge network supply942verify: locate the forecast, read the inventory metric, run the kitting / net-demand function, and, only after explicit user confirmation, raise the simulated replenishment action.
supplychain-hd
A knowledge guide for tracing a product supply process from demand estimates through suppliers.