Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add zzusp/doc-first-dev --skill spec-firstgit clone --depth 1 https://github.com/zzusp/doc-first-devWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zzusp/doc-first-dev/spec-first)<a href="https://agentmods.dev/skills/zzusp/doc-first-dev/spec-first"><img src="https://agentmods.dev/badge/skills/zzusp/doc-first-dev/spec-first/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zzusp/doc-first-dev/spec-first"><img src="https://agentmods.dev/badge/skills/zzusp/doc-first-dev/spec-first.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00078 | $0.01136 |
| Opus 5.5 | $0.00031 | $0.00454 |
| Sonnet 5.5 | $0.00016 | $0.00227 |
| Haiku 4.5 | $0.00008 | $0.00114 |
Grade A, and why
spec-first scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 80 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/spec-first — 文档驱动开发周期管理
本 skill 驱动从需求到交付的完整流程：
需求到来 → 匹配文档 → 分析 → 更新spec → spec确认 → 开发 → 验收 → 收尾
适用于：新功能、Bug修复、需求调整、重构——有或无 spec 均可触发，无 spec 时会在流程中创建。
触发后立即输出以下进度 Checklist；每个阶段完成时，重新输出当前状态的 Checklist（已完成项标为 [x]）：
开发周期进度
- [ ] Step 0 需求接收，文档匹配
- [ ] Step 1 阶段判断
- [ ] Phase A 分析与更新 spec
- [ ] Phase B 按方案开发
- [ ] Phase C 验收
- [ ] Phase D 收尾
异常处理规则见 error-handling.md。
模板文件（按需读取）：
- assets/project-index.md — 项目索引骨架（PROJECT.md）
- assets/tech-spec-blank.md — 技术方案骨架
- assets/api-blank.md — 接口文档骨架
- assets/claude-md-snippet.md — CLAUDE.md 片段
前置检查 — 环境就绪
在执行任何步骤前，依次检查以下两项：
① 检查项目根目录 CLAUDE.md：
- 存在且包含"构建命令"/"启动与认证"等章节 → 正常，继续 ②
- 存在但缺少上述章节 → 立即分析项目文件推断缺失内容并补全写入
CLAUDE.md（参照assets/claude-md-snippet.md对应章节格式；无法推断的字段保留占位符），继续 ② - 不存在 → 读取 assets/claude-md-snippet.md，在项目根目录创建
CLAUDE.md并写入完整片段内容（占位符保留，后续各阶段执行时再实际填写），继续 ②
② 检查 docs/plans/PROJECT.md：
- 存在 → 直接进入 Step 0
- 不存在 → 读取 init.md，完成初始化后进入 Step 0
Step 0 — 接收需求，匹配文档
读取 step0.md 并执行。
Step 1 — 判断当前阶段
前置检查：确认 spec 已加载（本 session 中 Step 0 已执行，或用户提供了 spec 文件路径）。若两者均未满足，输出以下提示后立即终止，不执行后续任何步骤：
⛔ 未找到工作文档。请重新运行 /spec-first 并在 Step 0 选择或创建 spec 文档。
扫描 spec 的任务状态（T-xxx）和验收状态（A-xxx），按以下条件从上到下优先匹配，读取并执行对应 Phase 文档：
第一条"用户描述了新需求或变更"的判断标准：用户本轮消息中包含尚未体现在 spec 中的需求、功能描述或变更说明（包含新功能、Bug 修复、调整要求等）。若用户本轮仅发送"继续"/"接着做"/"开始开发"等不含新信息的指令，跳过第一条，按任务/验收状态向下匹配。
| 条件 | Phase |
|---|---|
| 用户描述了新需求或变更 | 读取 phase-a.md — 分析与更新 |
| 有"待开始"/"进行中"的 T-xxx | 读取 phase-b.md — 按方案开发 |
| 所有 T-xxx 均为 ✅ 或已取消，有"待验证"/"未通过"的 A-xxx | 读取 phase-c.md — 验收 |
| 所有 T-xxx 均为 ✅ 或已取消，且所有 A-xxx ✅（A-xxx 不为空） | 读取 phase-d.md — 收尾 |
| spec 无任务/验收项，或有 T-xxx 但无 A-xxx | 读取 phase-a.md — 分析与更新 |
状态混乱时询问用户确认；用户可显式指定阶段覆盖自动判断。
What ships with it
14 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- assets/api-blank.md 2.7 KB
- assets/claude-md-snippet.md 1.8 KB
- assets/project-index.md 1.7 KB
- assets/tech-spec-blank.md 4.8 KB
- error-handling.md 1.4 KB
- evals/eval-01-new-feature.md 1.8 KB
- evals/eval-02-spec-code-mismatch.md 1.3 KB
- evals/eval-03-init-flow.md 1.2 KB
- init.md 1.2 KB
- phase-a.md 11 KB
- phase-b.md 4.9 KB
- phase-c.md 6.8 KB
- phase-d.md 5.3 KB
- step0.md 3.9 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 80 lines · 78 tokens per session scan A f3e2e61dca54
spec-first is a skill published in the GitHub repository zzusp/doc-first-dev (6 stars, last pushed 6mo ago), licensed MIT. It adds 78 tokens to every session and 1,136 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ledger-tasks-yylo
Durable in-repo task state for coding agents — Kanban tasks with stable IDs, evidence-backed status marks, blocked-by dependencies, and next-ready selection. Use when starting, selecting, sequencing, or closing implementation tasks for a coding-agent project.
meeting-notes-to-tasks
Converts unstructured meeting notes into structured, assigned, time-bounded action items. Never leave a meeting without knowing who does what by when.
citruscoastai
Guides agents to engage and transact with citruscoastai, an AI venture-operator agent, when they need hired AI labor or an agent-to-agent collaborator.
task-decomposition
Breaks features into atomic, independently verifiable tasks. No task should take more than 4 hours. Unblocks parallel work and reduces integration risk.
outlook-calendar
A skill for managing Microsoft Outlook and Microsoft 365 calendar events through a connected account.
cron
Use this skill only for scheduled or recurring tasks. Manage jobs with qwenpaw cron list/create/get/state/pause/resume/delete/run, and always pass --agent-id explicitly.