Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ronronner02/codepilot-agent/spec-worknpx skills add ronronner02/codepilot-agent --skill spec-workgit clone --depth 1 https://github.com/ronronner02/codepilot-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ronronner02/codepilot-agent/spec-work)<a href="https://agentmods.dev/skills/ronronner02/codepilot-agent/spec-work"><img src="https://agentmods.dev/badge/skills/ronronner02/codepilot-agent/spec-work.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00047 | $0.07443 |
| Opus 5 | $0.00023 | $0.03721 |
| Sonnet 5 | $0.00009 | $0.01489 |
| Haiku 4.5 | $0.00005 | $0.00744 |
Grade A, and why
spec-work scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 292 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Work Execution Command
Execute work efficiently while maintaining quality and finishing features.
Introduction
This command takes a work document (plan or specification) or a bare prompt describing the work, and executes it systematically. The focus is on shipping complete features by understanding requirements quickly, following existing patterns, and maintaining quality throughout.
Workflow Contract Summary
- Inputs: settled implementation-ready code plan, validated task pack, explicit knowledge-work plan, or concrete bounded implementation prompt.
- Outputs: scoped source changes, task/unit evidence, required review/residual posture, structured verification closeout, and an authorization-aware handoff. A task pack remains derived; its source plan owns scope/lifecycle.
- Hard exits: unresolved target repo/dirty overlap/source owner, requirements-only or invalid unified metadata, task-pack/source-plan drift, scope-changing acceptance/architecture/provider/source-runtime discovery, failed required review/verification, or missing mutation/commit/landing authority for the requested exit.
- Ownership: scripts prepare deterministic facts; LLMs judge semantic fit. Canonical source is modified; generated runtime mirrors are never source fixes. Local mutation, commit, landing, lifecycle, and durable evidence are separate exits.
- Consumers:
spec-code-review, caller-owned LFG/goal flows, commit/PR/release workflows,spec-compound, and human reviewers.
Reference Trigger Map
| Reference | Trigger | If unread/unavailable |
|---|---|---|
| Work intake and task pack | Shallow metadata says type: task-pack. |
Do not execute the pack; return validation/regeneration handoff. |
| Non-code execution | Metadata says execution: knowledge-work. |
Do not enter code/shipping lifecycle; report the missing production route. |
| Execution strategy | Before first write/test/review-fix, task tracking, worker dispatch, commit, or landing. | Lock repo/source/dirty facts inline; use inline/serial; no commit or landing claim. |
| Execution engines | A structured plan/task pack or explicit request makes goal/dynamic/worker engine selection relevant. | Use inline; do not infer a callable non-default engine. |
| Feedback and tests | Before behavior mutation, test design, or verification coverage claim. | Run the narrowest known check and do not claim system-wide coverage. |
| Implementation quality | Before durable-surface mutation or phase-boundary simplification. | Do not add a new durable surface; return to the plan owner if current source fit is unresolved. |
| Shipping workflow | All implementation tasks are accounted for and quality/closeout begins. | No completion/lifecycle/commit/landing claim. |
| Review findings followup | A completed review returned actionable caller-owned findings. | Preserve in-band findings/limitations; do not rerun or silently drop them. |
| Tracker defer | Residual gate explicitly selects external tracker deferral. | Return structured no_sink; do not lose residuals or infer external authority. |
What ships with it
12 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/agents/figma-design-sync.md 9.1 KB
- references/execution-engines.md 12 KB
- references/execution-strategy.md 15 KB
- references/feedback-and-tests.md 12 KB
- references/implementation-quality.md 8.1 KB
- references/non-code-execution.md 3.1 KB
- references/review-findings-followup.md 11 KB
- references/shipping-workflow.md 30 KB
- references/tracker-defer.md 15 KB
- references/work-intake-and-task-pack.md 13 KB
- scripts/source-plan-file-hash.cjs 2.1 KB runs code
- scripts/working-tree-fingerprint.cjs 4.0 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 292 lines · 47 tokens per session scan A ab4ab7848424
spec-work is a skill published in the GitHub repository ronronner02/codepilot-agent (0 stars, last pushed 3d ago), licensed MIT. It adds 47 tokens to every session and 7,443 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
agent-orchestration
Agent orchestration patterns for agentic loops, multi-agent coordination, alternative frameworks, and multi-scenario workflows. Use when building autonomous agent loops, coordinating multiple agents, evaluating CrewAI/AutoGen/Swarm, or orchestrating complex multi-step scenarios.
generate-ai-rules
Generate AI assistant configuration files for a repository — CLAUDE.md, AGENTS.md, and Cursor rules (.cursor/rules/.mdc) — from codebase analysis. Use whenever the user wants to create or update CLAUDE.md, AGENTS.md, agent rules, Cursor rules, AI coding assistant configuration, or "onboard AI tools" to a project, even…
generate-readme
Generate or refresh a comprehensive, professional README.md for a repository, with architecture overview, mermaid and optional C4 diagrams, repository structure, dependencies, and API documentation. Use whenever the user asks to create, write, update, improve, or regenerate a README, project documentation, or a…
analyze-codebase
Run a multi-agent deep analysis of a codebase, producing AI-readable analysis documents in .ai/docs/ covering structure, dependencies, data flow, request flow, and APIs. Use whenever the user asks to analyze a repository, generate codebase analysis, understand an unfamiliar codebase in depth, or before generating…
langgraph-orchestration
Build or modify LangGraph StateGraph agents in vpeetla-ai repos: typed state, nodes, conditional edges, MemorySaver, interruptbefore HITL. Use when adding orchestrators, coding loops, or multi-agent graphs.
aegis-gateway
Integrate AegisAI gateway before tool side effects (notify, publish, deploy). Use when adding Slack/Telegram/WhatsApp notify, content publish, or any irreversible external action in VAP, AegisLoop, or ai-content-factory.