Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/zzusp/doc-first-dev/spec-firstnpx skills add zzusp/doc-first-dev --skill spec-firstgit clone --depth 1 https://github.com/zzusp/doc-first-devWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00078 | $0.01136 |
| Opus 5 | $0.00039 | $0.00568 |
| Sonnet 5 | $0.00016 | $0.00227 |
| Haiku 4.5 | $0.00008 | $0.00114 |
Grade A, and why
spec-first scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 80 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/spec-first — 文档驱动开发周期管理
本 skill 驱动从需求到交付的完整流程：
需求到来 → 匹配文档 → 分析 → 更新spec → spec确认 → 开发 → 验收 → 收尾
适用于：新功能、Bug修复、需求调整、重构——有或无 spec 均可触发，无 spec 时会在流程中创建。
触发后立即输出以下进度 Checklist；每个阶段完成时，重新输出当前状态的 Checklist（已完成项标为 [x]）：
开发周期进度
- [ ] Step 0 需求接收，文档匹配
- [ ] Step 1 阶段判断
- [ ] Phase A 分析与更新 spec
- [ ] Phase B 按方案开发
- [ ] Phase C 验收
- [ ] Phase D 收尾
异常处理规则见 error-handling.md。
模板文件（按需读取）：
- assets/project-index.md — 项目索引骨架（PROJECT.md）
- assets/tech-spec-blank.md — 技术方案骨架
- assets/api-blank.md — 接口文档骨架
- assets/claude-md-snippet.md — CLAUDE.md 片段
前置检查 — 环境就绪
在执行任何步骤前，依次检查以下两项：
① 检查项目根目录 CLAUDE.md：
- 存在且包含"构建命令"/"启动与认证"等章节 → 正常，继续 ②
- 存在但缺少上述章节 → 立即分析项目文件推断缺失内容并补全写入
CLAUDE.md（参照assets/claude-md-snippet.md对应章节格式；无法推断的字段保留占位符），继续 ② - 不存在 → 读取 assets/claude-md-snippet.md，在项目根目录创建
CLAUDE.md并写入完整片段内容（占位符保留，后续各阶段执行时再实际填写），继续 ②
② 检查 docs/plans/PROJECT.md：
- 存在 → 直接进入 Step 0
- 不存在 → 读取 init.md，完成初始化后进入 Step 0
Step 0 — 接收需求，匹配文档
读取 step0.md 并执行。
Step 1 — 判断当前阶段
前置检查：确认 spec 已加载（本 session 中 Step 0 已执行，或用户提供了 spec 文件路径）。若两者均未满足，输出以下提示后立即终止，不执行后续任何步骤：
⛔ 未找到工作文档。请重新运行 /spec-first 并在 Step 0 选择或创建 spec 文档。
扫描 spec 的任务状态（T-xxx）和验收状态（A-xxx），按以下条件从上到下优先匹配，读取并执行对应 Phase 文档：
第一条"用户描述了新需求或变更"的判断标准：用户本轮消息中包含尚未体现在 spec 中的需求、功能描述或变更说明（包含新功能、Bug 修复、调整要求等）。若用户本轮仅发送"继续"/"接着做"/"开始开发"等不含新信息的指令，跳过第一条，按任务/验收状态向下匹配。
| 条件 | Phase |
|---|---|
| 用户描述了新需求或变更 | 读取 phase-a.md — 分析与更新 |
| 有"待开始"/"进行中"的 T-xxx | 读取 phase-b.md — 按方案开发 |
| 所有 T-xxx 均为 ✅ 或已取消，有"待验证"/"未通过"的 A-xxx | 读取 phase-c.md — 验收 |
| 所有 T-xxx 均为 ✅ 或已取消，且所有 A-xxx ✅（A-xxx 不为空） | 读取 phase-d.md — 收尾 |
| spec 无任务/验收项，或有 T-xxx 但无 A-xxx | 读取 phase-a.md — 分析与更新 |
状态混乱时询问用户确认；用户可显式指定阶段覆盖自动判断。
What ships with it
14 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- assets/api-blank.md 2.7 KB
- assets/claude-md-snippet.md 1.8 KB
- assets/project-index.md 1.7 KB
- assets/tech-spec-blank.md 4.8 KB
- error-handling.md 1.4 KB
- evals/eval-01-new-feature.md 1.8 KB
- evals/eval-02-spec-code-mismatch.md 1.3 KB
- evals/eval-03-init-flow.md 1.2 KB
- init.md 1.2 KB
- phase-a.md 11 KB
- phase-b.md 4.9 KB
- phase-c.md 6.8 KB
- phase-d.md 5.3 KB
- step0.md 3.9 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 80 lines · 78 tokens per session scan A f3e2e61dca54
spec-first is a skill published in the GitHub repository zzusp/doc-first-dev (6 stars, last pushed 4mo ago), licensed MIT. It adds 78 tokens to every session and 1,136 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
pm-init
Skill "pm-init" from wei63w/pm-manager, covering user input, outline, 1. scaffold, 2. lifecycle and type and 3. detect spec kit (required).
pm-arch
Skill "pm-arch" from wei63w/pm-manager, covering user input, outline, done when and shared workflow (all /pm- commands).
pm-all
Skill "pm-all" from wei63w/pm-manager, covering user input, outline and shared workflow (all /pm- commands).
pm-done
Skill "pm-done" from wei63w/pm-manager, covering user input, outline and shared workflow (all /pm- commands).
pm-export
Export desensitized governance summary markdown for sharing or machine switch.
pm-outline
Generate detailed project outline and draft charter from user intent (empty/new projects).