SkillSpec
Make agent skills actually followable: score risk in one command, bind behavior with a contract, and prove every run with an auditable alignment record.
The boundary subcommand explicitly provides a deny-by-default least-privilege policy, static analysis that executes nothing in the package, and pull/update flows that show risk and ask before installing — the strongest trust evidence here. Deductions: the primary install method is a piped curl | sh remote script; sensitive-data handling and log destinations are unspecified; publisher identity is unverified, so source attribution rests on a single unknown party.
CI covers fmt/clippy/locked tests, a three-OS matrix, dogfooding of doctor, examples, and positive/negative conformance fixtures; locked builds aid consistency. Deductions: the stability of doctor scoring thresholds is asserted by docs only, with no executed verification in this static review, and failure messaging is visible mainly at the workflow-script level.
Explicit support for Codex, Claude Code, and AGENTS.md harnesses; boundary works standalone without adopting SkillSpec; the 'It is / It is not' table clearly states capability boundaries (not a sandbox, no cross-harness behavior guarantee). Deduction: trigger precision relies on natural-language invocations (/skillspec import ...) and the underlying trigger files were not in the evidence.
Information architecture is thorough (install notes, security quickstart, boundary guide, design/operations docs, contributing guide), the dual MIT/Apache license is consistent across README and Cargo.toml, and limitations are candid (not a sandbox, private repos not publicly inspected). Deductions: no CHANGELOG in evidence, thin version-history and maintainer/update-path information; the v0.1.0 example suggests an early stage.
Output usability is high: doctor emits text/markdown/html/, severity-ranked findings with evidence loci and next steps. Deductions: marginal value and cost-benefit hinge on the unproven assumption that a contract makes agents follow skills better, and the loop requires adopting multiple components.
Doctor claims every risk condition cites published work and separates measured values from policy thresholds; CI dogfooding and a conformance suite make claims traceable; boundary pins a resolved commit SHA so evidence links stay permanent. Deductions: the cited methodology docs were not themselves in the evidence, so cross-source corroboration is limited to README/workflow consistency, and the referenced content could not be checked.
- The recommended curl | sh install executes a remote script unreviewed; prefer Cargo install or download and verify the .sha256 checksums first.
- Publisher identity is unverified by the FollowAgents registry; audit the source yourself before relying on this tool for security decisions such as boundary guard.
- SkillSpec explicitly states it is not a security sandbox: contracts and alignment reports are auditable records, but tool-boundary enforcement remains the harness's job.
- Doctor risk thresholds are policy choices rather than measured standards, and the claimed follow-through improvement has not been verified by any executed run in this review.
What does this agent do, and when should you use it?
SkillSpec is a Rust CLI that addresses a real gap: a SKILL.md is just prose, and an agent may skip late safety rules, grab undeclared tools, or claim "done" without evidence. The skillspec doctor command scores any skill — local folder or public GitHub URL — and surfaces buried obligations, context load, undeclared dependencies, and missing proof surfaces. skillspec import then ports prose skills into a structured skill.spec.yml contract covering routes, forbidden actions, dependencies, checks, tests, and proof expectations, while compiling a thin loader that keeps the active prompt small. Each run can leave an alignment summary recording the selected route, completed steps, forbidden-action status, and token/wall-clock metrics. The boundary subcommand analyzes what a skill can reach — network hosts, file paths, binaries, credentials — and compiles a deny-by-default least-privilege policy. SkillSpec is explicitly not a new agent runtime or a security sandbox; it is an auditability layer that integrates with Claude Code and Codex via plugin marketplaces, with a standalone boundary tool usable on its own.
The workflow is Assess -> Port -> Prove. 1) Assess: skillspec doctor ./my-skill produces a risk report on a local skill or public GitHub URL (findings, likely consequence, next step), exportable via --markdown/--html/--; the hosted page skillspec.sh accepts a public skill URL with no install. 2) Port: /skillspec import <skill> generates skill.spec.yml (routes, rules, forbidden actions, dependencies, checks, tests, proof expectations) next to SKILL.md and compiles a thin loader. 3) Prove: every run leaves an alignment summary with selected route, completed steps, missing proof, forbidden-action status, and token/wall-clock metrics. skillspec install router routes to the one skill that matters when harness listing budgets crowd out discovery. skillspec boundary map/assess/emit/guard inventories a skill's structure and reachable resources (hosts, paths, binaries, credentials), ranks findings by severity with scope-awareness, emits a deny-by-default policy, and can enforce reviewed policies via guard install; skillspec pull assesses a remote git skill before install, and skillspec update shows capability growth before replacing an installed skill. Boundary is standalone: no skill.spec.yml needed, it executes nothing in the package, and works on GitHub/GitLab/Bitbucket/self-hosted URLs.
- A skill author checks a SKILL.md with Doctor before publishing to catch buried rules, oversized context load, or undeclared tools that cause agents to drift.
- A team evaluates a third-party skill with skillspec pull and boundary assess — hosts, paths, credentials it can reach — before installing it.
- An engineering team ports a critical prose skill into a contract so every run leaves an auditable alignment summary instead of an unverifiable "done".
- A maintainer of a crowded skill library enables router mode so harness listing budgets don't make skill discovery unreliable.
- A cross-harness team (Claude Code, Codex, AGENTS.md harnesses) publishes baseline Doctor reports, generated contracts, and alignment summaries with PRs so reviewers can compare skills.
- A security reviewer requests a public Doctor report via the issue template; GitHub Actions validates the target and comments with Markdown/HTML/JSON artifacts.
What are this agent's strengths and limitations?
- Doctor's risk scores cite published research and SkillSpec methodology (context-position effects, effective context limits, verifiable instruction following) and explicitly separate measured findings from policy thresholds.
- The contract is a real spec: typed Rust model, JSON Schema, reference grammar, and a conformance suite — auditable and comparable.
- Boundary works as a standalone tool with no skill.spec.yml, changes nothing, executes nothing in the package, and can assess public git skills before they land.
- Documented plugin-marketplace installs for both Claude Code and Codex, plus CLI installs into codex/agents/claude-local targets, making skills comparable across harnesses.
- Run output is an alignment summary (route, steps, forbidden actions, tokens, wall clock), so results can be checked against the contract rather than trusted on the final answer alone.
- SkillSpec is explicitly not a security sandbox: it makes runs auditable, but enforcing tool boundaries remains the harness's job.
- First-class plugin marketplace integrations cover only Claude Code and Codex; other harnesses require manual skillspec install skill steps.
- The public Doctor GitHub Actions do not inspect private repositories — private skills must be assessed locally.
- Enforcing least-privilege requires the extra boundary emit and boundary guard install steps, and policies still need human review.
- Adoption means learning a new spec (skill.spec.yml) and CLI surface on top of your existing harness workflows.
How do you install or deploy this agent?
Option 1 (script): curl -fsSL https://skillspec.sh/install.sh | sh, then verify with skillspec --version. The installer verifies SHA256 checksums and writes to ~/.local/bin by default; pin with SKILLSPEC_VERSION and SKILLSPEC_INSTALL_DIR env vars. Option 2 (Cargo): cargo install skillspec. Option 3 (plugins): Claude Code — claude plugin marketplace add modiqo/skillspec --sparse .claude-plugin plugins/skillspec, then claude plugin install skillspec@skillspec; Codex — codex plugin marketplace add modiqo/skillspec --ref main --sparse .agents --sparse plugins/skillspec, then codex plugin add skillspec@skillspec. Prebuilt binaries (macOS/Linux/Windows) are on the GitHub releases page. No account or API keys required.
How do you use this agent?
Try without installing: paste a public skill URL at skillspec.sh. Local basics: 1) skillspec doctor ./my-skill for a risk baseline; 2) ask your agent in chat: /skillspec import ./my-skill, compile it, verify it, test it, and prove it. Print the alignment summary — this generates skill.spec.yml and installs the compiled skill; 3) review the alignment summary. Security: skillspec boundary map <skill-or-git-url> for structure, boundary assess for severity-ranked reach analysis, boundary emit for a deny-by-default policy, boundary guard install to enforce reviewed policies; skillspec pull <git-url> to assess before installing, skillspec update to see capability growth before replacing. For local development use the Justfile (just install-skill codex, just preflight, etc.).
How does this agent compare with similar options?
The README positions SkillSpec explicitly against agent runtimes and orchestration platforms: it is "a CLI that scores, ports, compiles, and records", complementary to harnesses like Claude Code and Codex rather than a replacement. It also mentions Rote (modiqo.ai) as the engine powering durable execution-trace capture that turns observed CLI/API/MCP work into reusable skills.