Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/wangliquan/specforge/draftnpx skills add WangLiquan/specforge --skill draftgit clone --depth 1 https://github.com/WangLiquan/specforgeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00164 | $0.02124 |
| Opus 5 | $0.00082 | $0.01062 |
| Sonnet 5 | $0.00033 | $0.00425 |
| Haiku 4.5 | $0.00016 | $0.00212 |
Grade A, and why
specforge-draft scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 56 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SpecForge Draft
把一个模糊 idea 变成「人能最小成本拍板、机器能消费」的 spec.html。
流程
-
发散:一次一个问题,挖目标 / 非目标 / 约束 / 成功标准。必要时提 2-3 方案带取舍与推荐。
-
收敛拷问:对每个决策分支穷追到底,把模糊点逼成明确选择,直到没有悬而未决项。这是硬要求——渲染脚本会拒绝带
open决策生成 spec(见 step 4),别把没问清的甩成「待拍板」糊弄过去。每个决策分支带options[],优先用AskUserQuestion逐条弹结构化选项让 user 当场拍板,而不是默认标open。 -
结构化:把结论写成符合
references/spec.schema.json的 JSON 对象(字段见该 schema)。spec.html 是给人 review/拍板看的——优先沉淀人最该看的三类(渲染时置顶展开):
decisions[]决策点:拷问中每个有取舍的分支都显式记一条。ID 用D-1 / D-2 …;question=决策项、options=候选、resolution=当前拍板、rationale=为什么。默认都应拷问到status:"decided"。status:"open"(待拍板)是逃生舱、不是常态——只在 user 明确说「先跳过 / 这条以后再定」 时才允许保留,且渲染必须显式--allow-open(见 step 4)。别把决策只留在对话里。awareness[]知情项:用户该知道的影响 / 边界 / 不改动承诺 / 风险。ID 用A-1 / A-2 …;破坏性或风险类写severity:"warning"(标红),其余info。- 整体流程用
sections[]里的type:"flow"(默认展开)。
其余为次要内容(渲染时默认折叠,按需展开):
summary、背景 / 口径 / 表格类prose/tablesection 默认折叠;要强制展开某节设collapsed:false,要强制折叠某流程设collapsed:true。criteria[]是验收点,给specforge-verify消费的机器契约、默认折叠;不是人 review 的重点,但仍要写全。ID 用AC-1 / AC-2 …,一旦分配不要因排序/增删而重排或复用。- 每个待拍板的
decisions与criteria应能对应:决策落地后才好定验收点。 assumptionReview+assumptions[]现状假设(涉及现有代码/系统时必写):spec 但凡对「现有代码/系统的真实行为」下断言——「复用 X 现有能力」「X 现在的行为是 Y」——就必须把每条断言记进assumptions[],带id(ASM-1 / ASM-2 …,唯一)、claim(断言)、evidence(file:line锚点,逼你去读代码而非凭记忆猜)、verified:null、verifiedDigest:null,并在顶层声明assumptionReview:{applicable:true, reason}。纯需求/决策/提案类(无现状断言)则显式声明assumptionReview:{applicable:false, reason:"…"}、不写 assumptions。漏记会被交付关check-ready拦(缺声明拒交付)——这是为根治「spec 把现有代码行为猜错」而设的硬约束。
每次重大修订
meta.revision++,并把上一版specId填入meta.previousSpecId。 -
渲染:把 JSON 写到临时文件,运行本 skill 自带的渲染脚本生成 spec.html:
node "<SKILL_DIR>/scripts/render.mjs" <spec.json> <out>.spec.html<SKILL_DIR>是本 SKILL.md 所在目录(先用 Glob/Read 定位真实路径,勿猜)。- 默认输出
specs/YYYY-MM-DD-<slug>.spec.html;🔴 同名先问再覆盖,不静默盖掉用户已有 spec。 - 脚本会先按 schema 校验,不合规直接报错——按报错修 JSON 再跑。
- 🔴 Gate(STOP):只要还有
status:"open"的决策,脚本会拒绝生成并退出(列出哪些 D-id 待拍板)。正常路径是回到 step 2 用AskUserQuestion把它们逐条拷问到decided。仅当 user 明确说「先跳过 / 先生成」,才追加--allow-open放行:render.mjs <spec.json> <out> --allow-open。
-
现状假设核验(
assumptionReview.applicable:true时;纯需求/决策类跳过):spec.html 渲染后、交付前——- 核验:对每条
assumptions[],spawn 一个全新 context、有 codebase 访问的 subagent(默认用Agent工具起 Claude subagent;codex 可用时异构模型独立性更高、可选改用),拿evidence的file:line去真实代码核对claim是否属实,逐条产出{id, verified:true|false, note}(判false必须给note)。⚠️ 价值在第二双眼睛重读代码——别让写 spec 的同一次推理自核自己,盲区一致。 - 回写:
node "<SKILL_DIR>/scripts/annotate-assumptions.mjs" <spec.html> <results.json>把核验态写回 spec.html(现状假设块带 ✓/✗ 徽标)。results 的 id 集合须与 assumptions 完全一致,否则整次拒绝。 - 验收:
node "<SKILL_DIR>/scripts/check-ready.mjs" <spec.html>——有未核/不符则非 0 退出。出现 ✗ → 回去修claim或改方案再重核(改了 claim/evidence 指纹自动失效、需重新核验),别带病交付。
- 核验:对每条
-
交付:
check-ready通过(或 applicable:false)后,提示用户双击打开 spec.html 可视化拍板。后续修改走对话——改 JSON、重跑脚本。
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 56 lines · 164 tokens per session scan A ebe36c5347b6
specforge-draft is a skill published in the GitHub repository WangLiquan/specforge (2 stars, last pushed 2mo ago), licensed MIT. It adds 164 tokens to every session and 2,124 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
chinese-git-workflow
国内 Git 平台配置参考——Gitee、Coding.net、极狐 GitLab、CNB 的 SSH/HTTPS/凭据/CI 接入差异与镜像同步配置。仅在用户显式 /chinese-git-workflow 时调用,不要根据上下文自动触发。.
chinese-code-review
中文 review 沟通参考——话术模板、分级标注(必须修复/建议修改/仅供参考)、国内团队常见反模式应对。仅在用户显式 /chinese-code-review 时调用,不要根据上下文自动触发。.
chinese-commit-conventions
中文 commit 与 changelog 配置参考——Conventional Commits 中文适配、commitlint/husky/commitizen 中文模板、conventional-changelog 中文配置。仅在用户显式 /chinese-commit-conventions 时调用,不要根据上下文自动触发。.
chinese-documentation
中文文档排版参考——中英文空格、全半角标点、术语保留、链接格式、中文文案排版指北约定。仅在用户显式 /chinese-documentation 时调用,不要根据上下文自动触发。.
systematic-debugging
Skill "systematic-debugging" from jnMetaCode/superpowers-zh, covering 系统化调试, 概述, 铁律, 何时使用 and 四个阶段.
dispatching-parallel-agents
当面对 2 个以上可以独立进行、无共享状态或顺序依赖的任务时使用.