Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/objectstack-ai/objectstack/spec-property-retirementnpx skills add objectstack-ai/objectstack --skill spec-property-retirementgit clone --depth 1 https://github.com/objectstack-ai/objectstackWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00172 | $0.07289 |
| Opus 5 | $0.00086 | $0.03645 |
| Sonnet 5 | $0.00034 | $0.01458 |
| Haiku 4.5 | $0.00017 | $0.00729 |
Grade A, and why
spec-property-retirement scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 338 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Spec 属性退役(ADR-0049 enforce-or-remove)
被解析却不被强制执行的属性是静默 no-op;对安全或能力类属性,它是假合规 ——
tool.permissions 承诺过一道没人强制的调用门,flow.active: false 从未停下过任何
flow。ADR-0049 说这样的属性必须被强制执行、标 experimental,或不存在。
本技能是第三条路:一次删除真正的代价是什么,按什么顺序付。
删掉键本身也许只占 5% 的工作。其余 95% 在于:一个键可以在 ~14 个地方被编写,而守 着每个地方的门禁是分别地、串行地失败的 —— 一个过期面遮住其余全部,于是你得到的 是 每个面一轮红构建,而不是一轮报出全部。
先读验证侧:packages/spec/liveness/README.md(裁定怎么得出、verifiedAt、为什么
preview renderer 不算消费者)与 AGENTS.md §"Touched packages/spec?"(八个生成产
物)。本文不重复它们。
0. 动手删之前:删除是正确的处置吗?
- 它是安全/能力形状的吗? 那么 ADR-0049 约束成立,惰性是缺陷不是债。
rls.enabled曾是「证据错误的 live」而实际无人读取 —— disabled 的 policy 仍在贡献它的授权。那个键最后是被强制执行,不是被删除。功能存在时,强制 执行赢。 - 它是文档形状的吗?
hook.label、hook.description、flow.description没有运行时消费者,但被有意保留 —— 它们为下一个读者(按 ADR-0033,常是模 型)记录意图。把豁免写进台账note,下次审计不再重审。良性展示元数据 (description、tags、icon)永远谈不上「误导」;不要标authorWarn,也 不要退役它。 - 有已承诺的路线图吗? 那就是
experimental+.describe()里的[EXPERIMENTAL — not enforced]标记,不是删除。 - 同 major 记账。 同一个未发布 major 里更早的 conversion 改名了你现在要删
的键,就吸收它:把改名折进删除,删掉改名条目。二者复合后效果不可观测,而
conversion 表的 fixture 不相交契约(§3)会因叠放而失败。先例:
agent.knowledge在发布前吞掉了topics→sources改名。
1. 裁判是构建,不是台账
台账的 dead 裁定是删除的输入,不能替代构建自己的证明。它是一条带时间戳的声
明,代码在它底下双向移动(flow.status 与 action.undoable 都被低估过)。
所以:先尝试删除,让构建来裁。 #3896 收尾里,view.form.data 挂在工作清单上是
dead(「两个仓都没有 form 路径的读者」),而删除打断了 gen:schema —— defineForm
往每个 *.form.ts 写 data: { provider: 'schema', schemaId },metadata-protocol
把它喂给 metadata-admin 管线。正确的回应不是硬删:把台账条目改回 live、附真实
证据与 verifiedAt,收窄 conversion,钉上 non-warn。十四个键里有一个是这样被证伪的
—— 给它留预算。
两条推论:
tsc和门禁是你最好的清扫器。retiredKey()墓碑把键的类型定为never,于 是 monorepo 里每个编写点都编译失败。examples/app-showcase三处template: true里有两处是 grep 漏掉、墓碑找到的。让墓碑替你找调用者,再去人肉搜。- grep 只能证明存在。 要证明不存在,要么手工闭合调用图(声明 → 注册 →
accessor → 调用者),要么编写该属性并启动应用。见 README 的 "How to verify a
claim without fooling yourself" —— 包括 macOS 上
git grep -E不认\b。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 338 lines · 172 tokens per session scan A a774dd10a3db
spec-property-retirement is a skill published in the GitHub repository objectstack-ai/objectstack (45 stars, last pushed 2d ago), licensed Apache-2.0. It adds 172 tokens to every session and 7,289 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ontotect
Systematic ontology engineering for designing, constructing, reviewing, repairing, optimizing, refactoring, validating, documenting, and governing ontologies, vocabularies, taxonomies, knowledge graphs, semantic models, and mappings. Use for RDF/RDFS, OWL 2, SKOS, SHACL, SPARQL, OBO, Turtle, JSON-LD, RDF/XML…
mykg
Run mykg knowledge-graph commands inside Claude Code from one slash command /mykg. The user describes intent in natural language (extract, append, resume, approve, walkthrough, parse-docs, fetch-web, query); the skill parses intent, builds the right mykg CLI command from the live --help output, confirms, runs it, and…
mykg-github-pages
Set up and maintain the GitHub Pages site for the mykg repo (SenolIsci/mykg) — a purpose-built pages/ folder (landing page adapted from README.md, blog posts, diagrams), built by a GitHub Actions workflow that runs Jekyll and deploys the result to a gh-pages branch. Use whenever the user wants to publish project…
networkx
Build, analyze, and visualize networks and graphs using NetworkX (Python). Use this skill whenever the user wants to: create graphs or networks, analyze graph properties, compute centrality measures, find shortest paths, detect communities, run graph algorithms, convert graphs to/from matrices or dataframes, visualize…
design-architecture
Reviews the current codebase architecture and proposes improvements using four parallel specialist subagents: System Architect, Software Architect, Data Architect, and an Adversarial Architect that red-teams failure paths, LLM adversarial output scenarios, silent corruption risks, and invariant bypasses. Each subagent…
exchange-recovery
Accident Request (用户输入事故请求) ↓ Think (分析事故 → 决策恢复策略) ↓ Risk Evaluate (评估数据覆盖风险) ↓ Plan (列出Exchange服务器 → 查找备份时间点 → 浏览备份邮件 → 生成恢复任务) ↓ Act (执行恢复任务 → 产生恢复作业 → 验证Exchange可用性) ↓ Report (生成恢复报告：状态 + 数据统计 + 时效评估).