Mole Bug Patterns
tw93/Mole
A catalog of recurring bug shapes in the Mole Mac cleaner, used to review safety-sensitive diffs for deletion safety, unbounded commands, shell traps and weak tests.
Tech spec generation and review. An agent skill from sd0xdev/sd0x-harness.
$ npx skills add sd0xdev/sd0x-harness --skill tech-spec -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install sd0xdev/sd0x-harness tech-spec --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/sd0xdev/sd0x-harness.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/tech-spec .claude/skills/tech-spec && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "tech-spec" agent skill from https://github.com/sd0xdev/sd0x-harness/tree/main/skills/tech-spec into .claude/skills/tech-spec/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "tech-spec", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/sd0xdev/sd0x-harness/tree/main/skills/tech-specType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add sd0xdev/sd0x-harness --skill tech-spec -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install sd0xdev/sd0x-harness tech-spec --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/sd0xdev/sd0x-harness.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/tech-spec .agents/skills/tech-spec && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "tech-spec" agent skill from https://github.com/sd0xdev/sd0x-harness/tree/main/skills/tech-spec into .agents/skills/tech-spec/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "tech-spec", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add sd0xdev/sd0x-harness --skill tech-spec -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install sd0xdev/sd0x-harness tech-spec --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/sd0xdev/sd0x-harness.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/tech-spec .cursor/skills/tech-spec && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "tech-spec" agent skill from https://github.com/sd0xdev/sd0x-harness/tree/main/skills/tech-spec into .cursor/skills/tech-spec/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "tech-spec", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/sd0xdev/sd0x-harness.git --path skills/tech-spec--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add sd0xdev/sd0x-harness --skill tech-spec -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install sd0xdev/sd0x-harness tech-spec --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/sd0xdev/sd0x-harness.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/tech-spec .gemini/skills/tech-spec && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "tech-spec" agent skill from https://github.com/sd0xdev/sd0x-harness/tree/main/skills/tech-spec into .gemini/skills/tech-spec/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "tech-spec", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install sd0xdev/sd0x-harness tech-specInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add sd0xdev/sd0x-harness --skill tech-spec -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/sd0xdev/sd0x-harness.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/tech-spec .github/skills/tech-spec && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "tech-spec" agent skill from https://github.com/sd0xdev/sd0x-harness/tree/main/skills/tech-spec into .github/skills/tech-spec/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "tech-spec", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add sd0xdev/sd0x-harness --skill tech-spec -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install sd0xdev/sd0x-harness tech-spec --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/sd0xdev/sd0x-harness.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/tech-spec .opencode/skills/tech-spec && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "tech-spec" agent skill from https://github.com/sd0xdev/sd0x-harness/tree/main/skills/tech-spec into .opencode/skills/tech-spec/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "tech-spec", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
tech-specTech spec generation and review. An agent skill from sd0xdev/sd0x-harness.
Tech Spec is an agent skill from sd0xdev/sd0x-harness. Tech spec generation and review. Use when: designing features, writing specs, spec review. Not for: requirements analysis (use req-analyze), implementation (use feature-dev), architecture advice (use codex-architect). Output: numbered tech spec document.
Its SKILL.md is about 2k tokens, which your agent loads only when the skill is triggered. The skill folder holds 3 other files, including reference files (for example `references/native-feature-resolution.md` and `references/template.md`).
It sits in Development. It works with Bash. The repository describes itself as: The harness layer for Claude Code — a reference implementation of harness engineering with hook-enforced dual review, state-machine gates that survive context compaction, and… The licence is MIT.
7 steps, taken from the first numbered list in SKILL.md.
Read from SKILL.md and the folder at commit a4d4bc1. It shows what the files ask for, not the result of running them.
Pre-approves these tools, so the agent can use them without asking each time:
ReadGrepGlobBash(git:*)WriteFrom allowed-tools in the SKILL.md frontmatter.
Shell commands in SKILL.md call:
gitFrom the folder's file list and the shell code blocks in SKILL.md.
No URLs in SKILL.md. Its commands use git, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Tech Spec loads about 2k tokens when it runs, and up to ~3.9k if it reads all its reference files. Until then it costs about 66 tokens; SKILL.md has 941 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
The full file from sd0xdev/sd0x-harness at commit a4d4bc1, republished under its MIT licence (© sd0xdev). 941 words, ~2,041 tokens.
.claude/skills/tech-spec/SKILL.md (or your agent's skills folder). This skill also uses 2 other files; get the full folder from GitHub.| Command | Purpose | When |
|---|---|---|
/tech-spec | Create or update tech spec | Auto-detects create/update from filesystem state |
/deep-analyze | Deepen spec + roadmap | After initial concept |
/review-spec | Review tech spec | Spec confirmation |
When invoked without a full requirement description, the skill auto-detects the target feature using
the cascade in references/native-feature-resolution.md — this skill's own reference, and
deliberately command-free.
This skill grants Bash(git:*) and not Bash(node:*), so the resolver script is not a command it
may run — and it does not link the shared reference that teaches it, because a file of unrunnable
commands inside this skill's reachable graph is the defect, not the annotation on it. The cascade
needs nothing beyond $ARGUMENTS, git branch --show-current, git diff --name-only HEAD and a
Glob over docs/features/*. What that does not produce is the four document source sets or
scan_error — this skill consumes neither. A skill that needs the sets (/architecture,
/tech-brief, /runbook, /ask) grants Bash(node:*) and reads the shared reference itself.
Canonical discovery is still owed, and testing one literal path does not deliver it. The spec
may have been split into a folder or may carry a variant name, and docs/features/auto-loop-evolution/2-tech-spec/2-tech-spec.md
in this repo is the live proof. Resolve it with a Glob over docs/features/<key>/, in this
order — the first hit wins:
| # | Glob | Meaning |
|---|---|---|
| 1 | docs/features/<key>/2-tech-spec.md | Unsplit canonical spec |
| 2 | docs/features/<key>/2-tech-spec/2-tech-spec.md | Split spec — the folder keeps the lifecycle prefix, the main file keeps the canonical filename (@rules/docs-numbering.md § Size Limit) |
| 3 | docs/features/<key>/2-tech-spec*.md, minus any hit matching -fp-brief.md or -tech-brief.md | A variant (2-tech-spec-v2.md). The two suffixes are excluded because they are not specs: scripts/config/doc-taxonomy.json carries the same exclude_pattern for the same reason, and docs/features/seek-verdict/ holds a live 2-tech-spec-fp-brief.md that this glob would otherwise return as the canonical spec. Two or more remaining hits is ambiguity, not a match — report and take the Need Human exit rather than picking one |
Requirements docs (1-requirements.md) resolve the same three ways, without the suffix
exclusion — doc-taxonomy.json carries exclude_pattern on the tech-spec type only, and copying
it to requirements here would put this skill out of step with the classifier rather than in step. A Glob that errors, or a
<key> that resolved with low confidence and matches nothing, is not the same as "no spec
exists" — say which of the two it was; do not silently drop into create mode.
A fourth lookup resolves the intent artifact: exactly intent-<key>.md in the feature
directory — the exact name, never a wildcard pick. A separate Glob intent-*.md only surfaces
strays or wrong-key files (report them; never adopt one as the intent).
| Filesystem State | Action |
|---|---|
| Canonical discovery finds exactly one spec | Update mode: read that file — at the path discovery returned, not at the literal 2-tech-spec.md — research code changes since last update, incrementally update changed sections |
| All three globs empty | Create mode: generate new spec from template at docs/features/<key>/2-tech-spec.md |
| Glob 3 returns two or more | Gate: Need Human — ambiguous canonical spec, name the candidates |
| Feature not resolved | Gate: Need Human |
In create mode, if intent-<key>.md is absent, write it first from the intent template
bundled with /req-analyze — distilled from the requirement clarification step (constraints
only, ≤60 lines) — then write the spec. If present, read it before designing.
In update mode, focus on sections affected by recent code changes (use git diff to identify). Preserve unchanged sections. If intent-<key>.md is absent, create it exactly as in
create mode (projecting from 1-requirements.md §§ 1–2 when present, else from the spec's
requirement summary) — this is what lets the next-step advisory converge on features whose
spec predates the intent mechanism. When it exists, read it: every spec section that contradicts
an INV-* or Non-goal is a conflict to surface to the user, not to paper over — and never
rewrite intent to match a spec; amending intent is a human re-decision.
sequenceDiagram
participant A as Analyst
participant C as Codebase
participant D as Document
A->>A: 1. Requirement clarification
A->>C: 2. Code research
C-->>A: Related modules
A->>A: 3. Solution design
A->>A: 4. Risk assessment
A->>A: 5. Work breakdown
A->>D: 6. Output documentA spec is cheapest to keep short while it is being written. Enforcing length afterwards means either a split or a prune, and both cost a review round that writing to budget would have avoided.
Lines (wc -l) | At write time |
|---|---|
| ≤ 300 | The target. Aim here |
| 301–400 | Acceptable — trim before adding more |
| > 400 | State the cohesion exception in the document itself, or prune / split before it is written. "I ran out of room" is not the exception |
The exception is a sentence in the spec naming why these sections are one argument that does not
read better apart. Unstated, a spec over 400 lines is over budget, and @rules/docs-numbering.md
§ Size Limit takes it from there — prune first, then merge, then split.
What to leave out: alternatives considered and rejected (one line each, not a section), history of how the design changed (that belongs in a record), and anything the code will state more precisely than prose can.
In update mode, a section the code made obsolete is pruned, not annotated. Rewriting it in place keeps the spec current-authority; layering "previously..." notes turns it into a record it is not.
Numbered tech spec document with sections: Overview, Requirements, Architecture, Implementation plan, Work breakdown, Testing strategy, Open questions.
references/template.md - Spec template + review dimensionsdocs/features/{feature}/
├── 2-tech-spec.md # Technical spec (numbered per docs-numbering rule)
├── requests/ # Request documents
└── README.md # Feature descriptionInput: /tech-spec "Implement user asset snapshot feature"
Action: Requirement clarification -> Code research -> Solution design -> Output documentInput: /review-spec docs/features/xxx/2-tech-spec.md
Action: Read -> Research -> Review -> Output report + Gate© sd0xdev, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
SKILL.md and 2 other files (references) in skills/tech-spec of sd0xdev/sd0x-harness.
Open the folder on GitHubat commit a4d4bc1
Tech Spec next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Tech Spec this skillsd0xdev/sd0x-harness | 192 | — | ~2k | Automated safety check: Pass | MIT | |
| Mole Bug Patternstw93/Mole | 70k | — | ~2k | Automated safety check: Pass | GPL-3.0 | |
| CLI DeveloperJeffallan/claude-skills | 12k | 2 repos | ~1.2k | Automated safety check: Pass | MIT | |
| JSON Processing with jqcharmbracelet/crush | 29k | — | ~746 | Automated safety check: Pass | Custom licence | |
| Segment CreateJanDeDobbeleer/oh-my-posh | 24k | — | ~1.2k | Automated safety check: Pass | MIT | |
| Coding AgentTermiX-official/cryptoclaw | 100 | 8 repos | ~2.7k | Automated safety check: Pass | MIT |
tw93/Mole
A catalog of recurring bug shapes in the Mole Mac cleaner, used to review safety-sensitive diffs for deletion safety, unbounded commands, shell traps and weak tests.
Jeffallan/claude-skills
Walks through designing, building and polishing a command-line tool: user workflow and command hierarchy, implementation in commander, click, typer or cobra, completions and cross-platform testing.
charmbracelet/crush
Explains the jq command built into Crush for querying, filtering and reshaping JSON, including its supported flags and where it differs from standard jq.
JanDeDobbeleer/oh-my-posh
Full scaffolding workflow for creating a new Oh My Posh segment.
TermiX-official/cryptoclaw
Delegate coding tasks to Codex, Claude Code, or Pi agents via background process.
oh-my-mermaid/oh-my-mermaid
Push architecture docs to oh-my-mermaid cloud. An agent skill from oh-my-mermaid/oh-my-mermaid.
sd0xdev/sd0x-harness
Write an Architecture Decision Record (ADR) for a feature — Context / Decision / Status / Consequences / Alternatives, filed as docs/features/<feature/adr-<NNN-<title.md with a 3-digit zero-padded…
sd0xdev/sd0x-harness
Load GitHub PR review comments into AI session — analyze, triage, plan.
sd0xdev/sd0x-harness
Change-aware next step advisor. An agent skill from sd0xdev/sd0x-harness.
sd0xdev/sd0x-harness
Obsidian vault integration via official CLI. An agent skill from sd0xdev/sd0x-harness.
sd0xdev/sd0x-harness
Agent-driven workflow orchestration (v1 report-only). An agent skill from sd0xdev/sd0x-harness.
sd0xdev/sd0x-harness
Post friendly review comments to a GitHub PR — prepare locally, preview, then submit as atomic review.
Works with
Categories
Tech spec generation and review. An agent skill from sd0xdev/sd0x-harness. Tech Spec is an agent skill from sd0xdev/sd0x-harness. Tech spec generation and review.
Tech Spec fits situations like: : designing features.
Run `npx skills add sd0xdev/sd0x-harness --skill tech-spec -a claude-code`. Or copy the skill folder (skills/tech-spec in sd0xdev/sd0x-harness) into .claude/skills/tech-spec in your project. Claude Code loads it when a task matches its description.
Run `npx skills add sd0xdev/sd0x-harness --skill tech-spec -a codex`. Or copy the skill folder (skills/tech-spec in sd0xdev/sd0x-harness) into .agents/skills/tech-spec in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add sd0xdev/sd0x-harness --skill tech-spec -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/tech-spec, .gemini/skills/tech-spec, .github/skills/tech-spec and .opencode/skills/tech-spec in your project.
Going by SKILL.md and its folder, Tech Spec needs the command-line tools its instructions call (git). Its frontmatter pre-approves these tools: Read, Grep, Glob, Bash(git:*), Write.
SKILL.md contains no URLs. Its commands use git, which can reach the network depending on how they are called. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
Tech Spec is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
About 2k tokens (SKILL.md is roughly 8.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 1.9k tokens, read only when the agent opens those files.
Skills that share tags, products or a category with Tech Spec: Mole Bug Patterns (tw93/Mole, 70k stars), CLI Developer (Jeffallan/claude-skills, 12k stars), JSON Processing with jq (charmbracelet/crush, 29k stars) and Segment Create (JanDeDobbeleer/oh-my-posh, 24k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
sd0xdev (a GitHub user) maintains it in sd0xdev/sd0x-harness, which has 192 GitHub stars. The repository holds 89 skills in this directory. The repository was last updated on October 8, 2026.
Source: sd0xdev/sd0x-harness on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.