Install
$ agentstack add skill-modiqo-skillspec-skillspec Open-source listing, not yet scanned by AgentStack. Follow the source repository for install instructions.
Security review
⚠ Flagged1 finding(s); flagged for manual review. · v0.1.0 How review works →
- • Prompt-injection patterns
- • Secret / credential exfiltration
- • Dangerous shell & filesystem operations
- • Untrusted network calls
- • Known-malicious package signatures
- high Pipes remote content directly into a shell (remote code execution).
What it can access
- ● Network access Used
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
SkillSpec
SkillSpec post-install setup and skill-authoring multiplexer for inspecting skill/repo shape with doctor, mapping multi-skill and plugin-shaped workspaces, importing existing prose skills, inspecting SkillSpec status, installing compiled workspaces with visibility planning, installing/updating/enabling/disabling router mode, installing/updating/enabling/disabling/deleting durable-executor, creating specs from observed durable execution workspaces, revising SkillSpecs, compiling reviewed skills, optional install, and value reporting.
Use the directory that contains this loaded SKILL.md as `. The SkillSpec contract is /skill.spec.yml`; do not assume the user's current working directory contains the spec.
Start the SkillSpec guide with the user's task:
skillspec run-loop /skill.spec.yml --input '' --trace-dir "${PWD}/.skillspec/traces" --guide agent --json
Resume an existing guided run:
skillspec run-loop /skill.spec.yml --resume --guide agent --json
Use the JSON current gate as internal control data. The selected route, matched rules, forbids, allowed commands, open requirements, resume command, and end proof from the CLI guide are authoritative; do not narrate the raw JSON to the user.
Keep SkillSpec mechanics in the background. Do not narrate ledger writes, raw progress commands, checkpoint rows, trace plumbing, or alignment internals as user-facing progress. Show simple intent-level updates only, such as what was assessed, what changed, what passed, and what remains blocked.
Do not run skillspec act, skillspec query, skillspec refs, or skillspec --help during normal execution. Use them only when the guide explicitly names an exact command, a blocker proves the current gate is insufficient, or the user asks to inspect internals.
For read-only diagnostic routes such as Doctor/source-shape assessment, run the diagnostic command or skillspec doctor checklist --json when available, answer directly, and stop. Do not create source maps, import drafts, progress ledgers, final-response proof, or alignment summaries unless the user explicitly asks for proof.
For proof-bearing execution routes, prefer skillspec run checklist --stage entry|loop|exit --json when available for current-phase cues, proof requirements, repeat-until conditions, forbids, and final alignment directives. Otherwise use the run-loop guide's current gate. Record routine successful evidence with one quiet skillspec progress checkpoint ... --quiet command at natural phase boundaries. Use individual skillspec progress record only for failures, blockers, or debugging.
For imports, prefer skillspec import checklist --stage entry|loop|exit --json when available. The generated checklist owns the shape-specific template for single SKILL.md, multi-skill folder, or plugin-shaped source; follow its package/file/block repeat loops, commands, directives, evidence requirements, activation policy, and forbids until complete or blocked. Do not review one representative package, bulk-promote scaffolds, or install generated drafts.
Missing alignment proof is not a prompt-writing task. Do not create route, obligation, elicitation, or phase proof rows after the fact to make alignment pass. If evidence was not captured when the work happened, report partial alignment and the exact missing proof instead of manufacturing progress.
If the skillspec CLI is not installed, report that this skill requires SkillSpec and ask the user to install it before continuing:
curl -fsSL https://raw.githubusercontent.com/modiqo/skillspec/main/install.sh | sh
# or, with Rust installed:
cargo install skillspec
If the user declines or installation is impossible, read /skill.spec.yml directly and manually follow the same route, rule, phase, dependency, forbid, proof, and completion contract. Report that CLI guidance was unavailable and alignment proof is partial.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: modiqo
- Source: modiqo/skillspec
- License: Apache-2.0
- Homepage: https://skillspec.sh
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.