Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/rubenzarroca/sdd-plugin/sdd-validatenpx skills add rubenzarroca/sdd-plugin --skill sdd-validategit clone --depth 1 https://github.com/rubenzarroca/sdd-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rubenzarroca/sdd-plugin/sdd-validate)<a href="https://agentmods.dev/skills/rubenzarroca/sdd-plugin/sdd-validate"><img src="https://agentmods.dev/badge/skills/rubenzarroca/sdd-plugin/sdd-validate.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00067 | $0.03336 |
| Opus 5 | $0.00034 | $0.01668 |
| Sonnet 5 | $0.00013 | $0.00667 |
| Haiku 4.5 | $0.00007 | $0.00334 |
Grade A, and why
sdd-validate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 276 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/sdd:validate — Verify implementation against spec
You are a validation auditor. Your job is to verify that the implementation matches the spec and complies with the constitution. You perform two layers of validation: a deterministic baseline from the MCP server, and a code-level audit that verifies the implementation exists and is correct. Follow these steps exactly, in order. Do NOT auto-fix anything — report findings and let the user decide.
MCP Server integration: This command uses two MCP tools — sdd_validate for deterministic coverage data and sdd_transition for state changes. If the MCP server is not available, fall back to reading artifacts directly.
Step 1: Identify feature and validate state
Parse the feature name from $ARGUMENTS. If no argument is provided, call sdd_get_state (no feature argument) to get the active_feature.
If neither yields a feature name, ask the user to specify one.
Call sdd_get_state with the feature name. Check the feature state:
- If in
validatingstate: this is the expected state (set automatically when all tasks complete). Proceed normally. - If in
implementingstate: the user wants an early check. Proceed normally but note in the report that not all tasks may be complete. - If in any other state: tell the user the current state and explain that validation is intended for features in
validatingorimplementingstate. Do NOT proceed.
Step 2: Get deterministic baseline from MCP
Call the sdd_validate tool with the feature name. This returns:
deterministic.requirement_coverage: For each requirement ID (FR/NFR/EC), which tasks cover it and their completion status (covered,partial,pending,uncovered).deterministic.task_progress: How many tasks are completed, in progress, pending, and blocked.deterministic.orphan_requirements: Requirements not assigned to any task.heuristic.constitution_compliance: Best-effort structural check of constitution.md.summary.can_complete: Boolean — are there any blockers?
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 276 lines · 67 tokens per session scan A 32207376750c
sdd-validate is a skill published in the GitHub repository rubenzarroca/sdd-plugin (6 stars, last pushed 6mo ago), licensed MIT. It adds 67 tokens to every session and 3,336 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
fix
Use to drive a bug fix from first report through close, with a "why didn't we catch it?" loop at the end. Triggers — "/engineer.fix", "a bug came in", "this is broken", "a user reported X", "there's a defect", "we have a regression", "this needs a fix", "another report", "more issues", "still failing", "validation…
next
Use at the start of a work session, or any time the question is "what should I pick up now" across the whole project. Triggers — "/engineer.next", "what's next", "what should I work on", "what should I do next", "where do I pick up".
crap-analyzer
Use to produce a risk-based refactor + test plan for recently-changed code on a diff/branch/PR by computing CRAP (complexity × untested) on changed methods. Multi-language — TypeScript, JavaScript, Python, Java, Kotlin, Go, Ruby, C#, Rust, PHP — auto-discovers how the repo generates coverage. Triggers …
post-merge
Use immediately after a PR is merged to clean up the local feature branch and resync main. Triggers — "/engineer.post-merge", "did we merge", "did we push", "PR merged", "post-merge cleanup", or right after a gh pr merge succeeds in the same session.
session-summary
Use at the end of a work session on a DAE feature, so the next session picks up cleanly. Triggers — "/engineer.session-summary", "wrap up the session", "write the session log", "I'm stopping for the day".
onboard
Use to bring a project into the DAE methodology, or to check an onboarded project for gaps. Triggers — "/engineer.onboard", "onboard this project", "set up DAE here", "adopt the methodology", or when a DAE skill fails because no manifest exists.