Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add wedabro/bro-skills --skill speckit.checkergit clone --depth 1 https://github.com/wedabro/bro-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wedabro/bro-skills/speckit.checker)<a href="https://agentmods.dev/skills/wedabro/bro-skills/speckit.checker"><img src="https://agentmods.dev/badge/skills/wedabro/bro-skills/speckit.checker/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/wedabro/bro-skills/speckit.checker"><img src="https://agentmods.dev/badge/skills/wedabro/bro-skills/speckit.checker.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00019 | $0.00661 |
| Opus 5 | $0.00010 | $0.00331 |
| Sonnet 5 | $0.00004 | $0.00132 |
| Haiku 4.5 | $0.00002 | $0.00066 |
Grade A, and why
speckit.checker scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 75 lines — stays where its author put it; the contents beside it link to each section on GitHub.
🎯 Mission
Detect coding-standard violations, security issues, and performance anti-patterns using commands appropriate to the actual project stack. MUST run applicable checks — do not claim a check passed from visual review.
📥 Input
- Source code and dependency manifests
.agents/memory/constitution.md(coding standards).agents/project.jsonand documented build/test commands- Docker files when the project is containerized
📋 Protocol
Phase 1: Capability Discovery
- Read project configuration and dependency manifests.
- Detect language, package manager, containerization, services, and available build/lint/type-check scripts.
- Build an applicability table. Mark unavailable checks
N/Awith a reason; never treatN/Aas a pass or failure.
Phase 2: Compile, Type, and Lint Checks
- Run the repository-defined compile, type-check, and lint commands.
- If the constitution requires container execution, run them in the matching service. Otherwise use the project's documented runtime.
- Compiler/type errors are 🔴 CRITICAL. Lint severity follows project policy.
- Do not assume TypeScript, npm, a monorepo, or fixed service names.
Phase 3: Container Checks (When Applicable)
- Validate every discovered Compose file with
docker compose ... config. - Verify Dockerfile COPY sources, non-root production runtime, health checks, environment-driven published ports, and no production source shadowing.
- If the project is not containerized, record this phase as
N/A.
Phase 4: Configuration and Security
- Scan source and tracked files for likely secrets, unsafe URL/endpoint literals, injection sinks, unsafe HTML, dynamic evaluation, and SQL concatenation.
- Exclude generated/vendor directories and report redacted locations only.
- Treat intentional public URLs, documentation links, and schema identifiers
according to project policy rather than flagging every
https://literal.
Phase 5: Stack-Specific Integrity
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 75 lines · 19 tokens per session scan A c9ac1b68a5c1
speckit.checker is a skill published in the GitHub repository wedabro/bro-skills (2 stars, last pushed 14d ago), licensed MIT. It adds 19 tokens to every session and 661 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
winui-session-report
Analyze the current or a recent agent session (GitHub Copilot CLI or Claude Code) and generate a diagnostic report. Use only when the user explicitly asks for session feedback, agent debugging, or a review of what happened during a build session. Do not inspect session data automatically.
audit
Project-wide health audit pipeline that fans out to all analysis skills in parallel, evaluates findings, and produces a unified report at .turbo/audit.md. Use when the user asks to "audit the project", "run a full audit", "project health check", "audit my code", "codebase audit", or "comprehensive review".
investigate
Systematically investigate bugs, test failures, build errors, performance issues, or unexpected behavior by cycling through characterize-isolate-hypothesize-test steps. Use when the user asks to "investigate this bug", "debug this", "figure out why this fails", "find the root cause", "why is this broken"…
spm-build-analysis
Analyze Swift Package Manager dependencies, package plugins, module variants, and CI-oriented build overhead that slow Xcode builds. Use when a developer suspects packages, plugins, or dependency graph shape are hurting clean or incremental build performance, mentions SPM slowness, package resolution time, build…
xcode-project-analyzer
Audit Xcode project configuration, build settings, scheme behavior, and script phases to find build-time improvements with explicit approval gates. Use when a developer wants project-level build analysis, slow incremental builds, guidance on target dependencies, build settings review, run script phase analysis…
webflow-code-component:troubleshoot-deploy
Debug deployment failures for Webflow Code Components. Analyzes error messages, identifies root causes, and provides specific fixes for common issues.