by clawplays
Spec-driven, agentic workflow framework for AI coding agents. Turn a request into a verifiable goal loop — plan, act, verify — with durable specs and evidence in your repo. Works with Claude Code, Codex, Gemini, OpenCode, and plain CLI.
# Add to your Claude Code skills
git clone https://github.com/clawplays/ospecLast scanned: 6/18/2026
{
"issues": [
{
"type": "npm-audit",
"message": "js-yaml: JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"severity": "high"
}
],
"status": "WARNING",
"scannedAt": "2026-06-18T08:48:27.294Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}ospec is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by clawplays. Spec-driven, agentic workflow framework for AI coding agents. Turn a request into a verifiable goal loop — plan, act, verify — with durable specs and evidence in your repo. Works with Claude Code, Codex, Gemini, OpenCode, and plain CLI. It has 559 GitHub stars.
ospec returned warnings in SkillsLLM's automated security scan. It has no critical vulnerabilities, but review the flagged issues in the Security Report section before adding it to your workflow.
Clone the repository with "git clone https://github.com/clawplays/ospec" and add it to your Claude Code skills directory (see the Installation section above). ospec ships a SKILL.md manifest, so compatible agents can discover and load it automatically.
ospec is primarily written in JavaScript. It is open-source under clawplays on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh ospec against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
Use this root skill as a compact router. Keep invariant safety and workflow-selection rules here; load detailed commands and stage protocols from the initialized project's indexed files only when that stage is active.
When the user asks to initialize a project, run ospec init [path]. In AI-assisted initialization, pass the explicit or conversational language with --document-language. If useful context is missing, ask once for a short project summary or tech stack; if the user skips it, continue with placeholders. Verify the generated files on disk and stop before creating work unless the user explicitly asks for a change or goal.
Initialization is change-ready only when .skillrc, the managed .ospec/ or classic OSpec directory, active and archived change directories, SKILL.md, SKILL.index.json, the index builder, for-ai/ protocol files, and baseline docs/project/ knowledge files exist.
Do not hand-write an approximation of ospec init. Do not assume a web stack, apply business scaffold, generate docs/project/bootstrap-summary.md, create queue work, or create the first change without explicit intent.
ospec new / ospec-change for routine, scoped work. Its source of truth is changes/active/<change>/proposal.md, changes/active/<change>/tasks.md, state.json, verification.md, and review.md.ospec goal / ospec-goal for complex, cross-cutting, high-risk, parallel, or evidence-heavy work. It additionally owns changes/active/<change>/design.md, changes/active/<change>/implementation-plan.md, changes/active/<change>/artifacts/agents/task-graph.json, worker/reviewer artifacts, and evidence gates.For an initialized project, read in this order:
.skillrc for layout, language, workflow policy, plugins, adaptive review policy, and model profiles.SKILL.index.json and docs/project/feature-index.md as routers.Do not load every historical change or every protocol file by default. Open for-ai/ai-guide.md for general execution rules and for-ai/execution-protocol.md only when entering the full goal controller layer. Use ospec help or subcommand help instead of carrying the complete CLI catalog in context.
Announce-Before-Act: before workflow actions, state the OSpec workflow and stage, the command and artifact it writes, native agent count/mechanism, and any blocking gate.Brainstorm-First: before locking a goal design, surface open direction, architecture, API, data, UI, risk, and scope decisions one at a time. Prefer a durable required decision over a silent assumption.Zero-Setup: the user states the requirement; the AI runs OSpec controller commands and the user only answers decisions. Do not ask the user to operate routine setup commands.PENDING, NEEDS_CONTEXT, BLOCKED, DONE_WITH_CONCERNS, and DONE rather than hiding uncertainty.In Claude Code, install the managed hook once with ospec session hook --target claude --apply when missing. Static workflow context is injected on startup, clear, and compact; prompt hooks should stay silent unless a required decision is pending. PreToolUse(Task) remains the hard dispatch gate.
Use the full ospec execute ... layer only for goal work or when the user explicitly requests agent/worker execution for a change.
ospec session and ospec execute bootstrap.always policy requires independent review; adaptive may use deterministic inline preflight only when the target document explicitly declares risk_level: low (or none) and no risk signal exists. Missing or unparseable risk context requires specialist review.mechanical, standard, strong_reasoning, review, final_review). Harness-specific model names come from .skillrc; absence is explicit and falls back to the harness default.*.findings.json.Detailed goal artifacts live under changes/active/<change>/artifacts/agents/ and artifacts/reviews/. Read their current packet or for-ai/execution-protocol.md for exact paths and commands instead of expanding the entire inventory here.
Every finalized change and goal automatically receives a generated docs/project/changes/<archive-path>.md knowledge document with its summary, affected areas, implementation files, verification commands, durable project documents, and archived evidence. This guarantees one indexed document per archived change. Before moving the active change, archive preflight refuses to overwrite a human-owned file at that generated path and verifies the managed output directories are writable. Behavior, architecture, module, API, or operational changes must additionally update the relevant human-maintained docs/project/ files. When the task graph enables the documentation contract, every task declares documentation_updates; use [] only when no project documentation changes are needed, include each declared document in target_files, and preserve dispatch-to-completion evidence of a meaningful normalized-content change.
Use ospec verify for the active workflow. For normal closeout, use ospec finalize [changes/active/<change>]; use ospec archive --check only for preview. Finalize must verify completeness, archive, rebuild docs/project/feature-index.md, and rebuild SKILL.index.json so its documents and archived_changes sections locate the completed behavior and link declared durable project documents. Git commit remains separate.
After archive, verify:
docs/project/feature-index.md;docs/project/changes/ and is linked from both indexes;SKILL.index.json;Use ospec docs generate for a docs-only repair or refresh. Do not create a change merely to repair project knowledge unless the user asks for one.
Initialize: ospec init [path] -> verify generated project shell
Change: ospec new <name> -> implement -> ospec verify -> ospec finalize
Goal: ospec goal <name> -> session/bootstrap -> design/plan reviews -> dispatch/review -> verify/finalize
Docs: ospec docs generate [path] -> ospec docs status -> ospec index check
Resume: ospec session [path] -> read brief/index -> run the persisted next safe command
Troubleshoot: ospec status [path] -> ospec help
Use CLI commands for initialization, verification, index generation, and archive. Do not replace managed operations with ad hoc filesystem edits.
Before claiming completion:
The official OSpec CLI package is @clawplays/ospec-cli, and the official command is ospec. OSpec is a spec-driven, agentic workflow framework for AI coding agents — it brings spec-driven development (SDD) and Loop Engineering (a verifiable plan → act → verify goal loop) to Claude Code, Codex, Gemini, OpenCode, MCP-based agents, and plain CLI workflows.
AI coding assistants are powerful, but requirements that live only in chat history are hard to inspect, review, and close out cleanly. OSpec adds a lightweight workflow layer so the repository can hold the change context before code is written and after the work ships.
ospec change — the everyday fast flow — one requirement becomes one active change on a short init -> change -> verify/finalize path, kept lightweight and easy to review.ospec goal for larger or riskier work — describe the result you need; the AI asks important questions, writes an inspectable plan, implements the work, runs tests, requests an independent review, updates project docs, and continues until the result is proven.L1 only checks, L2 may edit but pauses for important choices, and L3 may continue within limits you set. Progress is saved in the repository, so a later session can resume it.npm install -g @clawplays/ospec-cli
Official package: @clawplays/ospec-cli
Command: ospec
Verify install: ospec --help
OSpec only takes 3 steps:
Recommended prompt:
OSpec, initialize this project.
Claude / Codex skill mode:
/ospec initialize this project.
ospec init .
ospec init . --summary "Internal admin portal for operations"
ospec init . --summary "Internal admin portal for operations" --tech-stack node,react,postgres
ospec init . --architecture "Single web app with API and shared auth" --document-language en-US
CLI notes:
--summary: project overview text written into the generated docs--tech-stack: comma-separated stack list such as node,react,postgres--architecture: short architecture description--document-language: generated doc language, choose from en-US, zh-CN, ja-JP, or ar.skillrc--document-language -> persisted project language in .skillrc -> existing project docs / managed for-ai/* guidance / asset manifest -> fallback en-US.skillrc and reuses it for for-ai guidance, ospec new, and ospec updateospec init default to the nested layout: root .skillrc and README.md, with OSpec-managed files under .ospec/.ospec/knowledge/src/ or .ospec/knowledge/tests/; those appear only when a project already has legacy knowledge content to migrate or when future explicit knowledge-generation flows create themchanges/active/<change-name>, but the physical path in nested projects is .ospec/changes/active/<change-name>Use this for requirement delivery, documentation updates, refactors, and bug fixes.
Recommended prompt:
OSpec, create and advance a change for this requirement.
Claude / Codex skill mode:
/ospec-change create and advance a change for this requirement.
/ospec-goal create and advance a full goal for this requirement.
ospec new docs-homepage-refresh .
ospec new fix-login-timeout .
ospec new update-billing-copy .
The classic change flow above stays simple: proposal.md → tasks.md → implement → verification.md → review.md, with no controller layer. The agent controller layer — parallel worker dispatch, reviewer gates, and durable evidence — belongs to the full goal workflow. Use it with ospec goal, or on a single change only when you explicitly opt into agent/worker execution. OSpec keeps the controller state in repo artifacts, and the current AI harness starts native worker agents when available.
ospec session .
ospec execute bootstrap changes/active/<goal-name>
ospec execute workspace changes/active/<goal-name>
ospec execute status changes/active/<goal-name>
ospec execute dispatch changes/active/<goal-name> --limit 2
ospec execute launch changes/active/<goal-name> --task <task-id> --target codex
ospec execute complete <task-id> changes/active/<goal-name> --status DONE --summary "..."
ospec execute review changes/active/<goal-name> --task <task-id>
ospec execute verify changes/active/<goal-name> --command "npm test" --status PASSED --exit-code 0
launch writes artifacts/agents/launch-plan.md; it does not start workers by itself. Codex/GPT use spawn_agent plus bounded wait_agent, Claude Code uses bounded background Task polling when available, Gemini uses @generalist, and OpenCode uses @mention. Every native adapter returns from one wait within 60 seconds, refreshes heartbeats, persists each completed child immediately, and re-ticks. The 60-second boundary limits one controller poll, not the AI task runtime: a live child continues across polls up to its configurable absolute action deadline. OSpec never starts Orca, Codex, Claude, or another agent CLI as a fallback. If the current model harness cannot provide native subagents, executable dispatch blocks until a supported harness reports a fresh capability.
After the requirement has passed deployment, testing, QA, or other acceptance checks, archive the validated change.
Recommended prompt:
OSpec, archive this accepted change.
Claude / Codex skill mode:
/ospec archive this accepted change.
ospec verify changes/active/<change-name>
ospec finalize changes/active/<change-name>
Archive notes:
ospec verify to confirm the active change is readyospec finalize to rebuild indexes and archive the accepted change.ospec/changes/archived/YYYY-MM/YYYY-MM-DD/<change-name>; CLI shorthand under changes/archived/... still worksospec updateUse a goal when the work touches several parts of the project, has important design choices, changes an API or data, carries security or migration risk, or will take several rounds to finish. For a small, well-defined edit, use ospec new instead.
Start from a terminal:
ospec goal improve-checkout --level L2 --target codex --execution-model controller --harness-interactive true --native-subagents supported
Then tell the AI what outcome you need in ordinary language. You can also skip the terminal command and say: "Use OSpec goal for this requirement and