Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/sananthanarayan/skilldrop/nfr-specnpx skills add sananthanarayan/skilldrop --skill nfr-specgit clone --depth 1 https://github.com/sananthanarayan/skilldropWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sananthanarayan/skilldrop/nfr-spec)<a href="https://agentmods.dev/skills/sananthanarayan/skilldrop/nfr-spec"><img src="https://agentmods.dev/badge/skills/sananthanarayan/skilldrop/nfr-spec.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00104 | $0.01526 |
| Opus 5 | $0.00052 | $0.00763 |
| Sonnet 5 | $0.00021 | $0.00305 |
| Haiku 4.5 | $0.00010 | $0.00153 |
Grade A, and why
nfr-spec scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 64 lines — stays where its author put it; the contents beside it link to each section on GitHub.
nfr-spec
Gathers the requirements nobody volunteers: the business says what the feature does, this skill pins down how well — with numbers. Every category in the catalog ends in exactly one of three states: a measurable target with a verification method, an explicit n/a with a reason, or an accepted default tagged [assumption]. Silence is the one forbidden state. Downstream of prd-draft; feeds design-doc (targets shape the architecture), test-plan-generator (verification methods become test cases), and threat-model (security depth lives there, not here).
How to respond
-
Classify the system first — the archetype sets the defaults: customer-facing SaaS, internal tool, public API, batch/pipeline, mobile/edge. Ask at most 2 questions, spent on the two answers that move the most targets: user-facing or internal, and what happens when it's down for an hour (the honest availability requirement hides in that answer). Everything else: archetype default +
[assumption]. -
Sweep every category in
reference.md— performance/latency, throughput/capacity, availability/SLO, durability/backup/DR, privacy/retention/residency, accessibility, i18n/l10n, observability, operability, compatibility, cost. For each: target, verification, or n/a-with-reason. The output includes the full ledger so a reviewer sees the sweep happened — a skipped category is indistinguishable from a forgotten one otherwise. -
Force numbers tied to business reality, not aspiration. ✅ "p95 search < 800ms at 2× current peak (peak = 120 rps
[data: April dashboard])" — ❌ "sub-second response times" (which percentile? at what load?) — ❌ "99.999% availability" for an internal tool whose users sleep at night (five nines costs 100× three nines; the archetype default exists to stop this). -
Attach a verification method to every target — the method that would prove it before launch, not after: load test at stated volume, chaos drill, restore-from-backup rehearsal, axe-core scan + screen-reader pass, locale pseudo-translation run, cost projection at target volume. An NFR without a verification is a hope with units. These methods hand straight to
test-plan-generator.
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 64 lines · 104 tokens per session scan A 6e952b1fc66e
nfr-spec is a skill published in the GitHub repository sananthanarayan/skilldrop (2 stars, last pushed 22d ago), licensed MIT. It adds 104 tokens to every session and 1,526 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
readme
This skill should be used to audit OR elevate the README of a public repository. Trigger with "improve the README", "make the readme high quality", "elevate this readme", "audit the readme", "add badges", "is our README good", or before publishing/releasing a repo. Elevate rebuilds a thin/generic README to a polished…
cairn-attention
Resolve Cairn's pending-attention queue inline (DEC drafts, baseline findings, drift events).
cairn-direction
Spec-tightener + subagent dispatcher. Engage on code-change asks — verbs, bug reports, observations. Pivot-aware on active tasks.
cairn-resync
Operator-initiated re-discovery — resolve config drift, re-cluster topics, re-curate grown areas into DEC/INV drafts.
ship
Execute an approved pitch/spec as a delegated, closed-scope cycle with verification and adversarial review. Invoke it yourself with /ship — a cycle spawns a writer and opens a PR, so it starts when you say so. Enforces the execution playbook: right-size gate, pre-spawn filter, doc-bundle, PR format, review.
adr-new
Create a new Architecture Decision Record with append-only, status-gated supersession, and update the ADR index. Invoke with /adr-new, or let /tdd-author invoke it on approval of an ADR action (this skill stays model-invocable for that reason).