Agent skill

Spec Pov

by leo-kuang-ai in leo-kuang-ai/spec-first

Give a decisive, project-grounded verdict on an external input — judged against the current project, not in the abstract.

MITAuto-check passedSecurity

Install Spec Pov

skills CLI
$ npx skills add leo-kuang-ai/spec-first --skill spec-pov -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install leo-kuang-ai/spec-first spec-pov --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/leo-kuang-ai/spec-first.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/spec-pov .claude/skills/spec-pov && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
spec-pov
GitHub stars
107
Token cost
~4.5k tokens
SKILL.md length
2,358 words
Files
23 (incl. scripts, references)
Skills in repo
35
Repo updated
First seen
Licence
MIT

At a glance

Give a decisive, project-grounded verdict on an external input — judged against the current project, not in the abstract.

  • Works in 5 steps: Frame and Classify → Ground with authorized scouts or bounded… → Verify against the two floors → …
  • Decide whether to adopt
  • SKILL.md covers The one rule that is the whole…, Interaction Method, Model Tiers and Dispatch Authorization Boundary, plus 1 more section
  • Runs Shell and JavaScript scripts from its folder; calls npm

What it does

Spec Pov is an agent skill from leo-kuang-ai/spec-first. Give a decisive, project-grounded verdict on an external input — judged against the current project, not in the abstract. Use to decide whether to adopt, switch to, or revisit a technology, library, pattern, platform, or architecture; to compare a candidate against what the project already uses; to judge whether an external change (a CVE, a deprecation, an ecosystem shift) actually affects this project; or for a mid-session second opinion. Always returns a project-specific verdict, so it is not for neutral…

Its SKILL.md is about 4.5k tokens, which your agent loads only when the skill is triggered. The skill folder holds 31 other files, including scripts and reference files (for example `evals/cases/design-question-not-verdict.yaml`, `evals/cases/r2-real-verdict-works.yaml` and `evals/eval.yaml`).

It sits in Security, covering Vulnerability scanning. The repository describes itself as: 仓库原生 AI Coding Harness —— 把一次性 AI 对话变成可治理、可验证、可沉淀的工程闭环 · spec-first.cn. The licence is MIT.

When your agent uses it

  • Decide whether to adopt
  • Revisit a technology
  • Compare a candidate against what the project already uses
  • Judge whether an external change (a CVE

Example prompts

  • “/spec-pov”

Requirements

  • Node.js
  • A Bash shell

Workflow steps

5 steps, taken from the step headings in SKILL.md.

  1. Frame and Classify
  2. Ground with authorized scouts or bounded inline fallback
  3. Verify against the two floors
  4. Verdict
  5. Follow-up

What it can do on your machine

Read from SKILL.md and the folder at commit 74655dc. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 1 file in scripts/ (Shell and JavaScript, from the files we listed), which the agent can run.

    Shell commands in SKILL.md call:

    • npm

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use npm, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Spec Pov loads about 4.5k tokens when it runs, and up to ~13k if it reads all its reference files. Until then it costs about 139 tokens; SKILL.md has 2,358 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~139
When it runs · the whole SKILL.md, loaded when a task matches
~4.5k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~13k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from leo-kuang-ai/spec-first at commit 74655dc, republished under its MIT licence (© leo-kuang-ai). 2,358 words, ~4,481 tokens.

Download SKILL.mdSave it as .claude/skills/spec-pov/SKILL.md (or your agent's skills folder). This skill also uses 22 other files; get the full folder from GitHub.
name
spec-pov
description
Give a decisive, project-grounded verdict on an external input — judged against the current project, not in the abstract. Use to decide whether to adopt, switch to, or revisit a technology, library, pattern, platform, or architecture; to compare a candidate against what the project already uses; to judge whether an external change (a CVE, a deprecation, an ecosystem shift) actually affects this project; or for a mid-session second opinion. Always returns a project-specific verdict, so it is not for neutral explainers or generating options.
argument-hint
[the external thing to judge, plus any links] — or invoke bare mid-session for a second opinion

Form a Point of View

Return a decisive, graded verdict on something from the outside world — judged against this project, not in the abstract.

Use the user's current request from the conversation as the POV input.

Note: Use the current date from the active host context. Use this when weighting external sources and dating artifacts.

The one rule that is the whole moat

Do not issue a verdict you did not earn against the project's own context. Generic web research already covers "tell me about X"; the differentiator is never "research the web" — it is the refusal to answer in the abstract. The verdict must clear two absolute floors (see references/method.md): a project floor (a concrete verified project fact — a named incumbent + a touchpoint, or for a net-new adoption the verified absence of one plus where it would fit, or a prior decision) and an external floor (at least one verified external source). The floors are absolute and independent — strong external evidence never compensates for a thin project leg, and vice versa. Neither the conversation nor the user's own assertions substitute for grounding.

Interaction Method

When you must ask the user a question, use the platform's blocking question tool: AskUserQuestion in Claude Code (call ToolSearch with select:AskUserQuestion first if its schema isn't loaded), request_user_input in Codex. Fall back to numbered options in chat only when no blocking tool exists in the harness or the call errors (e.g., Codex edit modes) — not because a schema load is required. Never silently skip the question. Ask one question at a time.

Model Tiers

Dispatch is tiered by task shape, never hardcoded to a model name:

  • Extraction tier — the project-grounding scout and the precedent-&-activity scout: search-and-quote work. Request the cheapest capable tier only when worker_model_override: supported; otherwise inherit.
  • Generation tier — the external-evidence researcher: web/docs retrieval and entailment checking. Request the balanced mid-tier only when worker_model_override: supported; otherwise inherit.
  • Ceiling tier — the verdict reasoning itself (the two-floor gate, the skeptic synthesis, the verdict contract). This runs in the main conversation on the orchestrator's model; nothing is dispatched for it.

Dispatch Authorization Boundary

在派发 repo profiler、project/precedent scout 或 external researcher 前,记录:

yaml
worker_dispatch_authorization: authorized | missing
capability_probe: not_applicable | attempted | unavailable
worker_dispatch_capability: available | missing | unknown
worker_context_isolation: isolated | inherited | unknown
worker_model_override: supported | unsupported | unknown
worker_bounded_parallelism: supported | unsupported | unknown

workflow invocation does not authorize dispatch。POV tier、外部链接、tool availability、权限设置或需要满足 two floors 都不构成派发授权。只有当前用户或可见 upstream handoff 明确请求 subagent、delegated work、persona 或 parallel work 时才可派发。缺授权时不得探测 tool schema,固定为 capability_probe: not_applicable + worker_dispatch_capability: unknown,采用 bounded inline 或 serial grounding 并记录 dispatch_authorization_missing。只有授权后才把 current-session registry/schema 作为 provider_untrusted evidence 检查:确认缺失时记录 subagent_capability_missing;surface 不可用、schema 不完整或候选不唯一时记录 worker_capability_unproven,均使用同一 fallback。隔离、模型覆盖和有界并发只取 live facts;required isolation 未满足时保持依赖 gate 打开,model unknown 时继承,parallelism unknown 时串行。记录 worker_dispatch_outcome。The inline path must not claim independent scout coverage、fresh-context skepticism 或 multi-agent evidence;它只能声明 orchestrator 自身完成了有界的多 lens 核验。

Degradation rule. When authorized dispatch exists but worker_model_override is unsupported or unknown, dispatch scouts on the inherited model and keep their read budgets. When dispatch capability is missing or unknown, use the bounded inline fallback with the same evidence budgets and the claim limitation above.

Execution Flow

Phase 0: Frame and Classify

Output mode: by default spec-pov writes no document — the verdict is a compact chat block. An optional full write-up and a durable spec-compound capture are available on request at Phase 4. Do not resolve an OUTPUT_FORMAT or load a rendering reference up front.

  1. Detect the invocation context — cold or warm. Warm means spec-pov was invoked mid-session for a second opinion, with the question sitting in the surrounding conversation or absent. For the warm contract beyond the frame — taking only the question and claims-to-verify (never grounding), the guest output, the provenance buckets — read references/invocation.md.

  2. Establish the frame before grounding — orient, then infer or propose; never guess. The same input supports very different verdicts: a bare link to a new sign-in method could mean adopt it, migrate to it, compare it to what we have, or just answer a question about it. Guessing sends the scouts after the wrong question. So orient cheaply on what was provided — fetch a bare link lightly to learn what it is, recognize a bare topic, read a paste (orientation, not grounding) — then settle the subject and the POV intent (adopt / migrate / compare / is-this-our-problem / explainer):

    • Both clear → state the frame in one line and proceed.
    • Intent ambiguous (a bare link or topic with no stated intent, or a warm invocation with no clear question) → read references/intake.md and follow it: propose the concrete candidate framings this input suggests and confirm before grounding. Do not guess and fan out.
  3. Apply the selection escape hatch. If the input is a selection over a field ("what should we use for auth?"), it belongs here only when the realistic field is bounded (roughly five or fewer real candidates) and the criteria are knowable. If the field can't be bounded without inventing options, or the criteria are unclear, stop: return a Hold and route to spec-ideate (to enumerate) or spec-brainstorm (to surface criteria), then offer to re-run. A product-design question the user owns is not a verdict. "How should I design this feature?" (form placement, page structure, UX shape) has no named external candidate to judge — deciding it inside spec-pov makes the product decision for the user in the wrong workflow. Route to spec-brainstorm (WHAT unsettled) or spec-plan (HOW planning), and do not return a verdict on it. Read references/boundaries.md only when the input's fit for spec-pov is genuinely in doubt or the field can't be bounded; skip it for a clearly in-scope verdict.

    Freeze an explicit approach set before grounding: every user-supplied candidate, the status quo when relevant, and the option to reject the framing or all candidates. Preserve this set through grounding, any peer cross-check, and the final verdict. Every approach must finish as recommended, rejected with a reason, deferred for missing evidence, or framing-rejected; narrative omission is not a disposition.

  4. Classify the reversibility tier — three levels. Infer it from project signals:

    • Tier 1 — two-way door: a dependency, lint rule, or config; trivially reversible.
    • Tier 2 — one-way but bounded: a data store, an internal API/contract, or a migration whose blast radius stays inside this codebase.
    • Tier 3 — one-way and high-stakes: a security, legal, or privacy surface; a public API/contract; or an irreversible data migration.

    State the tier in the verdict and let the user override. The tier sizes the rest of the run (Phase 1 scout count, Phase 2 depth, Phase 3 reversal trigger): Tier 1 stays a one-screen verdict off a single combined grounding pass; Tier 2 adds the full scout fleet and an alternatives pass; Tier 3 adds deep external research, a precedent search, and a durable-record offer. Do not run a Tier-3 workup on a trivially reversible npm i, or hand a security-surface decision the moderate Tier-2 treatment.

Show full SKILL.md (1,266 more words)Show less
Phase 1: Ground with authorized scouts or bounded inline fallback

Grounding searches code, git, the issue tracker, PRs, and docs. When the package-local boundary permits dispatch, use scout sub-agents that return only a dossier path plus a short gist. Otherwise apply the same persona budgets serially in the orchestrator, keep raw search notes in the scratch directory, and carry only compact evidence into verdict reasoning.

Resolve current project orientation first. Derive stack, dependency/license surface, conventions, and structure from the current target repo/worktree for this run. Record current git identity and dirty state when available, carry direct source refs, and never persist or reuse the orientation across runs, branches, or worktrees. If git or a required source cannot be read, record the concrete degraded fact and narrow the project-floor claim; do not substitute conversation claims or stale orientation.

Create the scratch dir once, and reuse the echoed path for every scout this run:

bash
umask 077
SCRATCH_DIR="$(mktemp -d "${TMPDIR:-/tmp}/spec-first-pov.XXXXXX")"
[ -d "$SCRATCH_DIR" ] && [ ! -L "$SCRATCH_DIR" ] || { echo 'private scratch creation failed' >&2; exit 1; }
chmod 700 "$SCRATCH_DIR"
echo "$SCRATCH_DIR"

This directory is owner-only, ephemeral scratch. Recheck that it remains a non-symlink directory before atomic publication; durable POV evidence must use its canonical artifact owner rather than this path.

Every scout payload carries the same context. A fresh subagent does not inherit this conversation, so fill the persona files' {subject} / {scratch-dir} placeholders at dispatch: pass each scout the framed question (subject + intent), the named incumbent and the reversibility tier, and the resolved <scratch-dir> path — plus any user-supplied links for the external researcher. A scout seeded with only its generic persona grounds "some external thing" and can produce an empty or unfocused dossier.

Tier-sensitive execution. For Tier 1 (reversible), run a combined project-grounding and external-evidence pass at tight budgets; use subagents only when authorized, otherwise run the two lenses serially inline. Skip the standalone precedent lens because the project-grounding pass includes the prior-decision scan. For Tier 2/3, use the full fleet when authorized or the same three lenses serially inline:

  • project-grounding scout (extraction tier) — read references/agents/project-grounding-scout.md and seed a generic subagent with it. With the agnostic profile already loaded from the cache, this scout runs only the candidate-specific slice: the named incumbent for this candidate, its call-sites/footprint, incumbent-pain, and the license/compat check against the profile's dependency-license set. Do not re-derive stack, conventions, or structure — those are in the profile. But note the profile may name an incumbent dependency, and a named dep is only a lead — it does not satisfy the project floor (see references/method.md), which still requires a freshly verified call-site the cache never holds. Do not let a cache-named incumbent short-circuit the fresh touchpoint check.
  • precedent-&-activity scout (extraction tier) — read references/agents/precedent-activity-scout.md and seed a generic subagent with it. Always run its local-doc precedent pass (docs/solutions/, ADRs, design docs — file reads, no tools needed); only its tracker/PR portion is capability-gated and degrades gracefully when those interfaces aren't reachable. Do not skip the whole scout for missing tracker access — that would drop the only path that surfaces a prior local adopt/reject decision.
  • external-evidence researcher (generation tier) — read references/agents/external-evidence-researcher.md and seed a generic subagent with it; capability-gated on web tools. Scale the remit to the tier so Tier 3's deeper-workup promise is real, not nominal: at Tier 3, seed it with a deeper brief — a wider source net, a larger read budget, and mandatory two-source corroboration on every load-bearing claim (at Tier 3 a single-source claim cannot anchor the verdict); Tier 2 uses the persona's standard budget and its prefer-two-sources default.

Capability gating is two-level: skip only a scout (or scout-portion) with no reachable surface at all — the project-grounding scout and the precedent scout's local-doc pass are file reads and always run; the tracker/PR reads and the external researcher are tool-gated and degrade. Let a scout that loses a tool mid-run self-report "unavailable." Never block on a missing surface — record it and let it lower the verdict's stated confidence, or trip the external floor (Phase 2) when the external leg is entirely absent.

Populate the provenance buckets from the returned dossiers, keeping them separate for Phase 2: observed-project-facts and verified-external-facts (these count as grounding) vs. conversation-claims and unconfirmed-assumptions from a warm invocation (these do not count until a scout corroborates them). Read dossiers from their paths on demand; do not pull their bulk into this context.

Phase 2: Verify against the two floors

Read references/method.md now, before reasoning about the verdict — it defines the Verify and Verdict steps, the skeptic stance and reversibility tiering as cross-cutting properties, and the two-floor Invalid-Verdict gate. Apply that gate as a pass/fail checklist over the dossiers: a failed floor forbids Adopt/Reject and returns the matching Hold subtype. Do this reasoning on the clean context — read a dossier on demand, never pull its bulk in.

Phase 3: Verdict

When the user or visible upstream handoff explicitly authorized cross-model/delegated work, read references/cross-model-panel.md before final synthesis. Apply its canonical authorization, external-data, allowlisted-input, redaction, source-identity, provider-independence, bounded lifecycle, and reap gates. Use references/agents/pov-peer.md, references/pov-schema.json, and the Skill-local adapter/runner only after every gate passes. Missing authorization or any safety fact means zero peer processes and no independent coverage claim. Reconcile valid peer disagreement against the two floors and the frozen approach set; never decide by vote.

Emit the verdict contract defined in references/method.md — grade vocabulary, schema fields, tier sizing, and output economy are all specified there. The verdict is a compact chat block, not a research report: lead with the grade, keep each schema field terse, and never reprint scout dossiers or raw search output. Size it to the tier — a Tier 1 verdict fits one screen; Tier 2/3 carries the full workup but still leads with the verdict and cites evidence rather than pasting it.

Phase 4: Follow-up

The chat verdict (the TL;DR) is the deliverable. What you offer next is reasoned from the verdict and sized to the tier — never a fixed menu, and never an assumption that everything routes to a plan.

Compute the next step. From the grade and the verdict's Handoff field, reason about the single best next move and a one-clause why — it is not always obvious between plan and brainstorm, so decide in context:

  • Adopt, scope clear → take it into spec-plan.
  • Adopt, scope still fuzzy → spec-brainstorm to pin down what "adopt" means before planning.
  • Trial → scope a timeboxed spike (spec-work).
  • Hold / Reject / Not-our-problem → no handoff; there is nothing to take forward.

Tier-gate the offer (anti-ritual):

  • Tier 1, or a Reject / Not-our-problem grade → end with a single prose line — e.g. "Want the full write-up, or <computed next step>? Otherwise we're done." No blocking menu; silence means done.
  • Tier 2/3 with an actionable grade → ask via the platform's blocking question tool, with the computed next step as the first, dynamically-labeled option:
    1. <computed next step> (e.g. "Plan the adoption with spec-plan") — seeded with the verdict substance, not a file pointer.
    2. Full write-up — the expanded, shareable artifact.
    3. Done. Add spec-compound as a one-line prose nudge under the menu, not a slot: "Want it in our decision history? say 'compound it.'" It is the least-frequent path and is never the first thing offered.

On each selection:

  • Computed next step → invoke that skill via the platform's skill-invocation primitive, seeding it with the verdict substance (the decision, conditions, and verified facts).
  • Full write-up → read references/report.md and follow it (HTML by default; opened locally via an available HTML tool). Opt-in; the default stays chat-only.
  • "compound it" → invoke spec-compound with mode:headless, seeding it with the structured verdict for tooling_decision / architecture_pattern storage (no schema change; headless avoids its interactive prompts). Never mandatory.

Warm invocations stay a guest: output the verdict block, hand control back, and offer none of the above unless the user asks — a mid-session interjection does not push a next-step or capture decision.

© leo-kuang-ai, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 22 other files (scripts, references) in skills/spec-pov of leo-kuang-ai/spec-first.

  • SKILL.md
  • evals/cases/design-question-not-verdict.yaml
  • evals/cases/r2-real-verdict-works.yaml
  • evals/eval.yaml
  • evals/fixtures/repos/mini-ledger/README.md
  • evals/fixtures/repos/mini-ledger/package.json
  • evals/fixtures/repos/mini-ledger/src/server.js
  • evals/fixtures/scripts/asks-a-question.sh
  • evals/fixtures/scripts/check-r2-verdict-given.sh
  • references/agents/external-evidence-researcher.md
  • references/agents/pov-peer.md
  • references/agents/precedent-activity-scout.md
  • … and 11 more

Open the folder on GitHubat commit 74655dc

Compare with similar skills

Spec Pov next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Spec Pov compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Spec Pov this skillleo-kuang-ai/spec-first107—~4.5kAutomated safety check: PassMIT
Deepsec Documentation Guidevercel-labs/deepsec8.1k—~956Automated safety check: PassApache-2.0
Shiro Attack CLISummerSec/ShiroAttack22.6k—~945Automated safety check: PassMIT
Cve Remediationrundeck/rundeck6.3k—~2.9kAutomated safety check: PassApache-2.0
Native Dependency Updatemono/SkiaSharp5.6k—~4.1kAutomated safety check: PassMIT
Forensifyalexgreensh/repo-forensics190—~2.5kAutomated safety check: NotesCustom licence

Similar skills

  • Deepsec Documentation Guide

    vercel-labs/deepsec

    Official

    Points the agent at deepsec's own docs to answer questions about initializing, configuring, resuming, scanning with and extending the vulnerability scanner.

    8.1k GitHub stars~956 tokensUpdated 12 days ago
    SecurityAuto-check passed
  • Shiro Attack CLI

    SummerSec/ShiroAttack2

    当用户要求利用、检测或测试 Apache Shiro rememberMe 反序列化漏洞 (Shiro-550, CVE-2016-4437) 时使用。触发词包括 "Shiro"、"rememberMe"、"shiro attack"、"CVE-2016-4437"、"Shiro-550"、"爆破 Shiro key"、"利用 Shiro"、"Shiro…

    2.6k GitHub stars~945 tokensUpdated 4 mo ago
    SecurityAuto-check passed
  • Cve Remediation

    rundeck/rundeck

    Verify if a CVE affects the project and remediate it. An agent skill from rundeck/rundeck.

    6.3k GitHub stars~2.9k tokensUpdated yesterday
    SecurityAuto-check passed
  • Update native dependencies (libpng, libexpat, zlib, libwebp, harfbuzz, freetype, libjpeg-turbo, etc.) in SkiaSharp's Skia fork.

    5.6k GitHub stars~4.1k tokensUpdated yesterday
    SecurityAuto-check passed
  • Forensify

    alexgreensh/repo-forensics

    Cross-agent self-inspection of your AI-agent stack. An agent skill from alexgreensh/repo-forensics.

    190 GitHub stars~2.5k tokensUpdated 14 days ago
    SecurityAuto-check: notes
  • Write Cve Rule

    evdenis/cvehound

    Write, debug, or validate a CVEhound detection rule (.cocci or .grep) for a Linux kernel CVE.

    138 GitHub stars~2.5k tokensUpdated 2 days ago
    SecurityAuto-check passed

More from leo-kuang-ai/spec-first

All 35 skills in this repo
  • Spec App Consistency Audit

    leo-kuang-ai/spec-first

    Audit mobile App PRD/Figma/local-source consistency across page routes, KMP/Clean Architecture, components, analytics, i18n, engineering quality, and industry lenses before runtime validation; use…

    107 GitHub stars~4.6k tokensUpdated 3 days ago
    Auto-check passed
  • Spec Handoff

    leo-kuang-ai/spec-first

    Create a durable cross-session handoff or resume from a user-selected continuity source.

    107 GitHub stars~1.8k tokensUpdated 3 days ago
    Auto-check passed
  • Spec Resolve PR Feedback

    leo-kuang-ai/spec-first

    Resolve PR review feedback by evaluating validity and fixing issues with conflict-aware resolver dispatch.

    107 GitHub stars~1.8k tokensUpdated 3 days ago
    Auto-check: notes
  • Spec Riffrec Feedback Analysis

    leo-kuang-ai/spec-first

    Analyze explicit Riffrec product-feedback captures, including riffrec-.zip, the Riffrec session.json + events.json + recording.webm + voice.webm bundle, or media/notes the user identifies as a…

    107 GitHub stars~1.4k tokensUpdated 3 days ago
    Auto-check passed
  • Spec Compound

    leo-kuang-ai/spec-first

    Document a recently solved problem or durable project vocabulary in docs/solutions/ or CONCEPTS.md.

    107 GitHub stars~18k tokensUpdated 3 days ago
    Auto-check passed
  • Spec Prd

    leo-kuang-ai/spec-first

    Public workflow entrypoint (spec-prd): create, write, refine, or validate planning-readiness of brownfield PRD-grade requirements for existing systems before implementation planning.

    107 GitHub stars~16k tokensUpdated 3 days ago
    Auto-check passed

Categories

Questions about Spec Pov

What does Spec Pov do?

Give a decisive, project-grounded verdict on an external input — judged against the current project, not in the abstract. Spec Pov is an agent skill from leo-kuang-ai/spec-first. Give a decisive, project-grounded verdict on an external input — judged against the current project, not in the abstract.

When should I use Spec Pov?

Spec Pov fits situations like: decide whether to adopt; revisit a technology; compare a candidate against what the project already uses; judge whether an external change (a CVE.

How do I install Spec Pov in Claude Code?

Run `npx skills add leo-kuang-ai/spec-first --skill spec-pov -a claude-code`. Or copy the skill folder (skills/spec-pov in leo-kuang-ai/spec-first) into .claude/skills/spec-pov in your project. Claude Code loads it when a task matches its description.

How do I install Spec Pov in Codex?

Run `npx skills add leo-kuang-ai/spec-first --skill spec-pov -a codex`. Or copy the skill folder (skills/spec-pov in leo-kuang-ai/spec-first) into .agents/skills/spec-pov in your project. Codex loads it when a task matches its description.

Can I use Spec Pov in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add leo-kuang-ai/spec-first --skill spec-pov -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/spec-pov, .gemini/skills/spec-pov, .github/skills/spec-pov and .opencode/skills/spec-pov in your project.

What does Spec Pov need to run?

Going by SKILL.md and its folder, Spec Pov needs a shell and JavaScript for the scripts in its folder and the command-line tools its instructions call (npm). Our summary lists: Node.js; A Bash shell.

Does Spec Pov access the network?

SKILL.md contains no URLs. Its commands use npm, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Spec Pov safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Spec Pov use?

Spec Pov is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Spec Pov use?

About 4.5k tokens (SKILL.md is roughly 18k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 8.8k tokens, read only when the agent opens those files.

What are the alternatives to Spec Pov?

Skills that share tags, products or a category with Spec Pov: Deepsec Documentation Guide (vercel-labs/deepsec, 8.1k stars), Shiro Attack CLI (SummerSec/ShiroAttack2, 2.6k stars), Cve Remediation (rundeck/rundeck, 6.3k stars) and Native Dependency Update (mono/SkiaSharp, 5.6k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Spec Pov?

leo-kuang-ai (a GitHub user) maintains it in leo-kuang-ai/spec-first, which has 107 GitHub stars. The repository holds 35 skills in this directory. The repository was last updated on October 8, 2026.

Source: leo-kuang-ai/spec-first on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.