Borrowing it
Nothing to install: this file belongs to vlad-ryzhkov/ai-context-engineering-for-qa. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/vlad-ryzhkov/ai-context-engineering-for-qa/main/.claude/skills/spec-audit/SKILL.mdgit clone --depth 1 https://github.com/vlad-ryzhkov/ai-context-engineering-for-qaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vlad-ryzhkov/ai-context-engineering-for-qa/spec-audit)<a href="https://agentmods.dev/skills/vlad-ryzhkov/ai-context-engineering-for-qa/spec-audit"><img src="https://agentmods.dev/badge/skills/vlad-ryzhkov/ai-context-engineering-for-qa/spec-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vlad-ryzhkov/ai-context-engineering-for-qa/spec-audit"><img src="https://agentmods.dev/badge/skills/vlad-ryzhkov/ai-context-engineering-for-qa/spec-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.05156 |
| Opus 5 | $0.00037 | $0.02578 |
| Sonnet 5 | $0.00015 | $0.01031 |
| Haiku 4.5 | $0.00007 | $0.00516 |
Grade A, and why
spec-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 300 lines — stays where its author put it; the contents beside it link to each section on GitHub.
🔒 SYSTEM REQUIREMENTS
Before execution the agent MUST:
- Load
.claude/protocols/gardener.md - All output artifacts (
.mdfiles, tables, headers, examples) MUST be written in English. Field names and code identifiers remain as-is.
/spec-audit — Specification Integrity and Risk Analysis
Protocol
- Role: Senior engineer & offensive QA. "Evil tester". Critical QA auditor. Zero tolerance for Ambiguity.
- Objective: Find reasons why implementing this specification will lead to bugs, vulnerabilities, or development Blockers.
- Principle — Shift Left Extreme: We hunt bugs in text while they cost $1, not $1000 in production.
- Principle — Trust No One: Every invocation performs a FRESH, INDEPENDENT audit. Never reuse or reference previous audits. Even if an audit for this specification already exists, create a NEW audit file with a unique timestamp. This ensures consistency, reduces hallucination, and preserves audit history.
- Anti-Hallucination Rule: Never assume a field exists unless it is explicitly listed in the table or schema. If an action (SMS, Push, Email) is mentioned in the text but the field (
phone,device_token,email) is missing from the Request Body — this is a specification ERROR, not a reason to add a field "from memory" or logical inference. Log as Defect 10. - Principle — API Integration Lens: This audit evaluates specification readiness for API integration testing, not unit testing. Prioritize defects that affect the HTTP contract (status codes, response schema, headers, error codes), business logic at the API boundary, and cross-system behavior. Per-field validation gaps that are typically handled by framework-level validators (Zod, Pydantic, Bean Validation) are valid spec-consistency findings but should be deprioritized to Minor (4-5) unless they represent a named business rule or affect the API error contract.
Input Data (Step 0 — execute FIRST, before everything else)
Determine the specification by Priority. Evaluate steps in order. Stop at the first match — do NOT proceed to subsequent steps.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +276 lines · +55 tokens per session 6abf752f76a4
- 10d ago First seen · 24 lines · 20 tokens per session scan A 756de9d1d364
spec-audit is a skill published in the GitHub repository vlad-ryzhkov/ai-context-engineering-for-qa (6 stars, last pushed yesterday), licensed Unlicense. It adds 75 tokens to every session and 5,156 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
tdd-implementation
Use Test-Driven Development for features that benefit from upfront behavior specification.
fix-from-logs
Diagnoses bugs from raw error logs, stack traces, or CI failure output — triages and clusters errors, localizes root cause (file → function → line), enters plan mode with a structured fix + test proposal for human approval, writes a typed pytest regression test using mocks first, then implements a targeted code fix…
auto-research
Autonomously optimizes any Claude skill (SKILL.md) or CLAUDE.md file through a closed hypothesis→test→evaluate→keep/discard loop, producing an updated skill file and an iteration dashboard (baseline score, each hypothesis, keep/discard decision, improvement delta). Use when a user wants to improve a skill's output…
solopi-ai
A command-line framework for testing Android apps and devices with SoloPi, including on-device or cloud AI decision models. It manages devices, test cases, recorded interactions, replays, performance history, and evidence.
ios-simulator
Verify and debug native, React Native, Expo, or Flutter apps on an iOS Simulator with agent-device. Use when an agent needs to launch an app, inspect its live UI, tap, type, scroll, validate a code change, collect failure evidence, or reproduce a workflow on an iPhone or iPad Simulator.
gsd-validate-phase
Retroactively audit and fill Nyquist validation gaps for a completed phase.