modiqo/skillspec

SkillSpec makes agent skills followable, testable, and provable with Doctor risk reports, guided imports, structured contracts, and alignment proof.

What it solves

AI agents often struggle to follow complex instructions written in prose (like SKILL.md files), frequently skipping critical safety rules or using undeclared tools. SkillSpec solves this by transforming these prose-based skills into structured contracts that agents must follow, providing a verifiable record of execution to ensure the agent didn't just claim "done" without proof.

How it works

SkillSpec provides a CLI and a plugin system that integrates with agent harnesses (such as Claude Code or Codex). It operates through a three-step loop:

  1. Assess: The doctor command analyzes a skill's prose to identify risks like buried obligations or excessive token load.
  2. Port: It converts the prose skill into a skill.spec.yml contract specifying routes, forbidden actions, dependencies, and required proof.
  3. Prove: It generates an alignment summary after execution, allowing users to audit which steps were completed and whether any forbidden actions were taken.

Additionally, the boundary tool analyzes what a skill can reach (network hosts, file paths, binaries) to create least-privilege security policies.

Who it’s for

Developers and operators of AI agents who need high reliability and auditability for the skills their agents use, especially when moving from throwaway prototypes to production-ready skills.

Highlights

  • Risk Scoring: A doctor tool that scores agent follow-through risk based on context-position effects and token limits.
  • Structured Contracts: Moves load-bearing instructions from prose to a YAML-based specification.
  • Audit Trails: Produces alignment summaries to prove an agent followed the specified route and provided required proof.
  • Security Mapping: The boundary feature maps a skill's reach and emits deny-by-default policies to constrain agent capabilities.
  • Harness Agnostic: Works across different platforms like Codex and Claude Code via plugins.

Related

  • Project
    tech-leads-club/agent-skills

    A secure, validated skill registry and CLI for extending AI coding agents with verified, safe, and tested capabilities.

  • Project
    tripleyak/SkillForge

    An evidence-driven framework for creating and maintaining AI agent skills that uses behavioral testing to ensure every skill demonstrably improves performance.

  • Project
    zjunlp/SkillNet

    SkillNet is an open‑source infrastructure that treats AI agent capabilities as reusable, searchable software assets. It offers a public skill library, a Python SDK/CLI, and a public REST API for discovering, downloading, creating, evaluating, analyzing, and orchestrating these skills. The platform enables agents to reuse existing functionality (e.g., PDF parsing, web‑scraping) instead of reinventing it, provides quality scores, builds skill‑relationship graphs, and can generate scene‑specific prompts for downstream LLM agents. Installation is as simple as `pip install skillnet-ai`; no API key is needed for search or public downloads, while creation/evaluation/orchestration require an LLM API key. The project includes a web explorer, MCP server, and integrations with Claude, OpenAI, OpenClaw, and JiuwenClaw, plus benchmark scripts for ALFWorld, WebShop, and ScienceWorld.

  • Project
    NVIDIA/SkillSpector

    SkillSpector is an open‑source NVIDIA tool that scans AI‑agent skills (plugins, prompts, code) for security problems. It supports static analysis of 71 known vulnerability patterns, optional LLM‑based semantic checks, live CVE look‑ups, baseline suppression, and multiple output formats (terminal, JSON, Markdown, SARIF). It can run as a CLI, Docker container, or MCP server, making it useful for developers, CI pipelines, and production agents.

  • Project
    joeseesun/qiaomu-meta-skill

    A meta-skill that transforms prompts and workflows into researched, evaluated, and securely published AI agent skill packages.