Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/xtyooo/specpilot-codex/specpilot-checknpx skills add xtyooo/specpilot-codex --skill specpilot-checkgit clone --depth 1 https://github.com/xtyooo/specpilot-codexWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xtyooo/specpilot-codex/specpilot-check)<a href="https://agentmods.dev/skills/xtyooo/specpilot-codex/specpilot-check"><img src="https://agentmods.dev/badge/skills/xtyooo/specpilot-codex/specpilot-check.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00048 | $0.01667 |
| Opus 5 | $0.00024 | $0.00834 |
| Sonnet 5 | $0.00010 | $0.00333 |
| Haiku 4.5 | $0.00005 | $0.00167 |
Grade A, and why
specpilot-check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 237 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SpecPilot: 检查需求
手动检查当前需求的最新进度,根据不同阶段进行针对性的深度复核。
参数
the user-provided arguments after the command text- 要检查的需求编号(如 REQ-001)
使用场景
- 中断后恢复工作,需要了解当前进度
- 对当前阶段的工作进行复核确认
- 主动触发代码审查
- 确认需求是否可以进入下一阶段
执行步骤
阶段一:读取需求状态
- 从
the user-provided arguments after the command text解析需求编号 - 如果未提供编号,运行
ls docs/specpilot/requirements/并询问用户要检查哪个需求 - 读取
docs/specpilot/requirements/index.md获取需求当前状态 - 读取草稿文件:
docs/specpilot/requirements/REQ-{编号}-draft.md - 读取项目指南:
docs/specpilot/project-guide.md
阶段二:根据状态执行检查
如果状态是 📝 draft(草稿阶段)
检查内容:需求是否完整可确认
- 读取草稿中的【需求内容】
- 检查需求描述是否清晰完整
- 输出检查结果:
## 需求检查结果 - REQ-{编号}
**当前状态**:📝 草稿
### 需求完整性检查
- [ ] 需求描述是否清晰
- [ ] 是否有明确的业务目标
- [ ] 是否指定了代码位置(如有)
### 建议
- [下一步建议,如执行 /specpilot:confirm]
如果状态是 🔍 confirming(确认中)
检查内容:需求确认是否完整
- 读取【需求内容】和【需求确认】(如有)
- 重新进行完整数据链路分析:
- 数据从哪里来?经过哪些处理?最终到哪里?
- 涉及哪些方法/服务?调用顺序是什么?
- 是否有异步处理?时序是否正确?
- 检查是否还有未确认的问题
- 输出检查结果:
## 需求检查结果 - REQ-{编号}
**当前状态**:🔍 确认中
### 需求确认复核
#### 完整数据链路分析
[重新分析的数据流/调用链路]
#### 已确认项
- [x] [已确认的内容]
#### 待确认项
- [ ] [仍需确认的问题]
### 建议
- [是否可以完成确认,或需要补充什么]
如果状态是 ✅📋 confirmed(已确认)
检查内容:确认内容是否完整,是否可以开始执行
- 读取完整的【需求确认】部分
- 检查确认内容的完整性:
- 术语定义
- 数据模型设计
- 业务规则
- 数据流/调用链路
- 边界条件
- 涉及代码文件
- 读取相关代码文件,验证确认内容的准确性
- 输出检查结果:
## 需求检查结果 - REQ-{编号}
**当前状态**:✅📋 已确认
### 需求确认完整性检查
- [x] 术语定义:已定义
- [x] 数据模型设计:已设计
- [x] 业务规则:已明确
- [x] 数据流/调用链路:已分析
- [x] 边界条件:已覆盖
- [x] 涉及代码文件:已列出
### 代码位置验证
[验证确认中提到的代码文件和方法是否存在]
### 建议
- [是否可以执行 /specpilot:exec,或需要补充什么]
如果状态是 🚧 in_progress(进行中)
检查内容:开发进度和代码完整性(最重要的检查)
- 读取【需求确认】和【技术方案】(如有)
- 检查代码实现状态:
- 读取涉及的代码文件
- 对照需求确认,逐项检查是否已实现
- 执行完整数据链路代码审查:
- 追踪数据从输入到输出的完整路径
- 检查每个改动点是否正确
- 检查是否有遗漏的改动点
- 执行两轮代码自审(如果代码已完成):
- 第一轮:完整性检查
- 第二轮:质量检查
- 输出检查结果:
## 需求检查结果 - REQ-{编号}
**当前状态**:🚧 进行中
### 开发进度检查
#### 需求覆盖情况
| 需求项 | 状态 | 说明 |
|--------|------|------|
| [需求1] | ✅/❌/🚧 | [实现情况] |
| [需求2] | ✅/❌/🚧 | [实现情况] |
#### 代码改动清单
| 文件 | 预期改动 | 实际状态 |
|------|----------|----------|
| xxx.go | xxx | ✅ 已完成 / ❌ 未实现 / 🚧 部分完成 |
### 完整数据链路代码审查
#### 数据流验证
[追踪数据流,验证每个环节]
#### 代码审查结果
**第一轮:完整性检查**
- [x] 需求覆盖:[结果]
- [x] 数据流:[结果]
- [x] 代码一致性:[结果]
**第二轮:质量检查**
- [x] 代码质量:[结果]
- [x] 错误处理:[结果]
- [x] 日志:[结果]
#### 发现的问题
1. [问题描述]:[建议修复方案]
### 建议
- [下一步操作:继续开发 / 修复问题 / 可以存档]
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 237 lines · 48 tokens per session scan A 503879855a4e
specpilot-check is a skill published in the GitHub repository xtyooo/specpilot-codex (10 stars, last pushed 8d ago), licensed MIT. It adds 48 tokens to every session and 1,667 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
chronicle
Analyze Copilot session history for standup reports, usage tips, session search, and session reindexing. Use when the user asks for a standup, daily summary, usage tips, workflow recommendations, wants to search or find past sessions by keyword/file/PR, wants to reindex their session store, or asks about deleting…
imagegen
Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…