Borrowing it
Nothing to install: this file belongs to w00fx/spec-anchored-agentic-development. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/w00fx/spec-anchored-agentic-development/main/.agents/skills/prep/SKILL.mdgit clone --depth 1 https://github.com/w00fx/spec-anchored-agentic-developmentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/w00fx/spec-anchored-agentic-development/prep)<a href="https://agentmods.dev/skills/w00fx/spec-anchored-agentic-development/prep"><img src="https://agentmods.dev/badge/skills/w00fx/spec-anchored-agentic-development/prep/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/w00fx/spec-anchored-agentic-development/prep"><img src="https://agentmods.dev/badge/skills/w00fx/spec-anchored-agentic-development/prep.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00090 | $0.02547 |
| Opus 5.5 | $0.00036 | $0.01019 |
| Sonnet 5.5 | $0.00018 | $0.00509 |
| Haiku 4.5 | $0.00009 | $0.00255 |
Grade A, and why
prep scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 188 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Prepare this repository so the implementation Owner, General Code Reviewer, Mutation Hardener, external review pipeline, and CI have the verification infrastructure they expect. Additive and brownfield-safe: read before writing, extend instead of replacing, flag anything you had to work around. No application code changes.
Phase 0 — Detect
Identify: stacks present (TypeScript? Go? both?), layout (monorepo? capability folders?), existing test runners and configs, existing Makefile / package scripts / justfile, existing CI workflows, current coverage if measurable. Report the findings in one short block before changing anything.
Phase 1 — The commands interface (the contract)
The harness learns how to verify from a three-command core plus two conditional hardening command families. The tool is free (Make, just, npm scripts — follow repo convention); the interface is fixed:
check— lint + typecheck + tests, whole repo.check-<capability>— the same, scoped to one capability folder (the chunk loop's command; a pattern — one target per capability).golden— the reference-value tests only, readingspecs/<capability>/tables/.mutation-<capability>— pinned, differential mutation for one eligible capability/target, with structured coverage and survivor output.fuzz-<capability>— property/fuzz targets for applicable parsers, validators, untrusted-input, serialization, protocol, and state-machine surfaces; the command may explicitly report N/A when no target applies.
Create or extend them. Then declare them in the root AGENTS.md under
## Commands. If a runtime needs an adapter such as CLAUDE.md, configure it
separately; never create a competing operational authority.
Also preserve the shared Spec Anchored routing in AGENTS.md and ensure
.agent-runs/ is present in .gitignore. Runtime logs, approvals, evidence,
hardening handoffs, Owner dispositions, and results never live under
.claude/, .codex/, or .cursor/.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 188 lines · 90 tokens per session scan A faf3664aad5b
prep is a skill published in the GitHub repository w00fx/spec-anchored-agentic-development (7 stars, last pushed 1mo ago), licensed MIT. It adds 90 tokens to every session and 2,547 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
dxkit-action
Read a dxkit report and execute fixes — prioritize findings by severity, plan the fix sequence, run the fix, verify the score moved, re-baseline if appropriate. Supports a SCOPED pass to burn down one category at a time (dependency/BOM vulnerabilities, security, code quality, tests, docs), and a BASELINE-CLEANUP pass…
post-deploy-verifier
Per-slice post-deploy verification plan: acceptance criteria mapped to live signals, plus rollback triggers. Activates after a deploy with no plan, when branch-commit made a deploy without checks, or when slice-closure would close a slice without one. Do not use before the slice ships (use verify-against-rubric), for…
dxkit-feature
Develop a new feature with the code graph as your map — orient cheaply by querying structure instead of reading whole files, implement following the patterns already in the repo, then verify the change did not regress security, tests, or quality before you push. Use when the user says "add a feature", "implement X"…
dxkit-test
Write the tests a repo is missing — read the test-gaps report (blast-radius-weighted), orient on what the untested code actually does via the graph, then write real tests that close the highest-risk gaps and move the Tests score without coverage theater. Use when the user says "write tests", "add tests for this…
tdd
Use this when the user asks for a new pure function, business-logic module, calculator, validator, or anything where input→output is well-defined and easily testable. Drives Red-Green-Refactor instead of writing untested code. Skip for UI components, throwaway scripts, and config changes.
Micro
Write all micro specs for one group — fully self-contained implementation units, plus the group's simulation scenarios and human-testing checklist.