Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ronronner02/codepilot-agent --skill spec-lfggit clone --depth 1 https://github.com/ronronner02/codepilot-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ronronner02/codepilot-agent/spec-lfg)<a href="https://agentmods.dev/skills/ronronner02/codepilot-agent/spec-lfg"><img src="https://agentmods.dev/badge/skills/ronronner02/codepilot-agent/spec-lfg/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ronronner02/codepilot-agent/spec-lfg"><img src="https://agentmods.dev/badge/skills/ronronner02/codepilot-agent/spec-lfg.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00050 | $0.05152 |
| Opus 5.5 | $0.00020 | $0.02061 |
| Sonnet 5.5 | $0.00010 | $0.01030 |
| Haiku 4.5 | $0.00005 | $0.00515 |
Grade A, and why
spec-lfg scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 230 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CRITICAL: You MUST execute every step below IN ORDER. Do NOT skip any required step. Do NOT jump ahead to coding or implementation. The plan phase (step 1) MUST be completed and verified BEFORE any work begins. Violating this order produces bad output.
进入该管线前,当前用户必须明确请求 spec-lfg,或选择清楚披露 commit、push、PR、CI 与委派独立代码审查副作用的 handoff 选项。仅有代码就绪、已完成计划或模型推断“适合 shipping”都不构成授权。
上述 admission 成立时,当前用户对完整管线副作用的明确请求是本次 pipeline-owned implementation、commit 与 landing authority 的来源;同时只额外授权第 4 步委派一次 spec-code-review 的只读独立审查。将 commit_authorization: authorized、landing_authorization: authorized、worker_dispatch_authorization: authorized 与 authorization_source: current-user-explicit-spec-lfg 作为可见 run-local facts 传给对应下游 owner。Skill invocation、mode:pipeline、工具权限、green tests、branch/PR facts 都不能替代该 admission,也不能把 authority 扩大到 unrelated dirty paths、任意 worker dispatch、tracker 或其他未披露外部副作用。若 admission 不成立,以 commit_authorization_missing / landing_authorization_missing 停在对应副作用之前;若独立审查不可用或降级,LFG 必须停止,不能用同一会话的 inline review 冒充该 gate。
When invoking any skill referenced below, resolve its name against the available-skills list the host platform provides and use that exact entry. Some platforms list skills under a plugin namespace (e.g., spec-first:spec-plan); others list the bare name. Invoking a short-form guess that isn't in the list will fail — always match a listed entry verbatim before calling the Skill/Task tool.
Preserve and split the invocation payload. Treat the arguments received from
the caller as the authoritative input. Before step 1, remove at most one standalone
target-origin:<origin> token and retain its value unchanged as the run-local
caller_target_origin. Set forwarded_arguments to everything else: preserve
every remaining argument in its original order, including an absolute
requirements-only plan path. Do not paraphrase the path, prepend a label or menu
number, replace it with a feature summary, or resolve it relative to the current
working directory. The modifier is browser-routing input, not product intent: do
not pass it to planning, normalize it, combine it with --port, derive a
scheme/host/port from project files, redirects, browser state, or a guessed
dev-server default. An empty, malformed, or repeated modifier records
target-origin-invalid; it never becomes a usable origin.
-
Invoke the
spec-planskill with the exactforwarded_argumentspayload. Whenspec-brainstorminvoked LFG, this payload is the absolute requirements-only unified plan path, sospec-planrecognizes it as an explicit Product Contract source and enriches that same artifact in place.GATE: STOP. If spec-plan reported the task is non-software and cannot be processed in pipeline mode, stop the pipeline and inform the user that LFG requires software tasks. Otherwise, verify that the
spec-planworkflow produced a plan file indocs/plans/. If no plan file was created, invokespec-planagain with the sameforwarded_argumentspayload. Do NOT proceed to step 2 until a written plan exists. Record the plan file path — it will be passed to spec-work in step 2 and spec-code-review in step 4.Read the plan metadata before continuing. If the plan has
artifact_contract: spec-unified-plan/v1, proceed only when it hasartifact_readiness: implementation-readyandexecution: code. Stop the pipeline forartifact_readiness: requirements-only, any unrecognized readiness value,execution: knowledge-work, approach-plan outputs, answer-seeking/universal outputs, or invalid progress-like readiness values. LFG never launches/goaldirectly; when goal-mode or dynamic workflows are appropriate,spec-workowns that implementation engine choice and must return control to LFG afterward. -
Invoke the
spec-workskill withmode:return-to-caller <plan-path-from-step-1>.GATE: STOP. Verify that implementation work was performed - files were created or modified beyond the plan. Read the structured return and require
status: complete, the same plan path, changed files, all in-scope U-IDs/tasks accounted for and completed, verification results with every required check passed or explicitly not applicable, an empty blocker list, behavior-change signal,plan_status_completion_candidate,plan_status_completion_degraded_reason, andstandalone_shipping_skipped: true. Failed, not-run, vague, or missing required verification blocks the pipeline. Exactly one lifecycle shape is allowed: a non-null candidate with a null degraded reason, or a null candidate with one ofhtml-plan-lifecycle-degraded,legacy-plan-lifecycle-degraded,read-compatible-status-unmanaged, orsource-plan-path-lifecycle-degraded. Any missing, conflicting, or unknown lifecycle shape is blocked. Whenbehavior_change: true, also requireverification_evidencethat names the relevant units/tasks, existing tests inspected, tests added/changed or used unchanged, red failure or characterization evidence when applicable, verification run, and any deliberate test exception. Do NOT decide the test strategy inside LFG; the evidence is spec-work's contract.
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 230 lines · 50 tokens per session scan A f5be47b544ee
spec-lfg is a skill published in the GitHub repository ronronner02/codepilot-agent (0 stars, last pushed 1mo ago), licensed MIT. It adds 50 tokens to every session and 5,152 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
agent-framework-py-release
Use when cutting a Python release for the microsoft/agent-framework monorepo. Triggers on "bump py versions", "cut a python release", "prepare release PR for python", "release py packages", "bump python to X.Y.Z", or similar requests to bump Python package versions and prepare a release PR. Handles all four lifecycle…
release-sync
Syncs latest release content to NotebookLM and HQ Knowledge Base after version tagging. Reads CHANGELOG, CLAUDE.md, and hook README, updates notebook sources, and ingests release digest. Optionally generates podcast from updated knowledge base. Use after tagging a new version to propagate release knowledge.
artifact-metadata
Manage artifact metadata, versioning, ownership, and review history across the SDLC lifecycle.
customize-setup
Set up personal AIWG customization mode from a local clone or fork — makes your clone the live global AIWG instance so edits go live immediately.
effect-ledger
Record an effect, sign an effect, reconcile an effect or check "did this PR merge" through the signed AIWG effect ledger, using one aiwg effect command with scriptable exit codes.
customize-contribute-back
Contribute a user's AIWG customization back upstream as a PR — reviews for general applicability, creates branch, opens PR.