Token导航 LogoToken导航TokenDH.com
前端设计操作浏览器github未标认证来源可访问clear审计通过

moai-workflow-spec摩艾工作流程规范

Agent Skill

用于辅助安全审计、权限检查、凭据风险、认证流程和常见漏洞排查。它适合让 Agent 梳理敏感配置、检查依赖风险、分析鉴权逻辑或生成安全复核清单。使用时不能把工具输出直接当最终结论,涉及密钥、令牌、用户数据或生产系统时,应先确认最小权限、脱敏方式和操作边界。

总安装

1,763

周安装

72

GitHub Stars

964

下载量

570
CodexClaudeCursorGemini CLI

安装说明

本站只整理中文说明和来源信息,不托管安装包,也不代用户安装。

GitHub

来源数

3

许可证

MIT

最后核验

2026-05-01

来源状态

来源可访问

安装方式

通过对话安装

复制提示词发给支持本地命令或 Skills 的 AI 助手,先确认命令和权限,再让它执行。

请帮我安装这个 Agent Skill:moai-workflow-spec(摩艾工作流程规范)
来源仓库:https://github.com/modu-ai/moai-adk
仓库路径:skills/moai-workflow-spec
安装命令:
npx skills add https://github.com/modu-ai/moai-adk --skill moai-workflow-spec
安装前请先检查当前环境是否支持对应 CLI,并向我确认将要执行的命令、安装目录、联网范围和文件读写权限;确认后再执行。

命令行安装

复制命令到本机终端执行。不同来源提供的安装方式可能略有差异;本站展示可直接复制的安装命令,安装前请核对来源页面。

skills.shnpx skills
npx skills add https://github.com/modu-ai/moai-adk --skill moai-workflow-spec

简介

moai-workflow-spec 辅助安全审计、权限检查和认证流程分析。

  • 适合梳理敏感配置、识别依赖风险和生成安全复核清单。
  • 不能将工具输出直接视为最终结论,需人工复核关键判断。
  • 涉及密钥、令牌或生产系统时应先确认最小权限和操作边界。
  • 建议在测试环境先行验证后再应用于实际生产场景。moai-workflow-spec 属于前端设计类 Skill,可作为该场景下的辅助能力补充。

SKILL.md

SPEC Workflow Management

Quick Reference (30 seconds)

SPEC Workflow Orchestration - Comprehensive specification management using EARS format for systematic requirement definition and Plan-Run-Sync workflow integration.

Core Capabilities:

  • EARS Format Specifications: Five requirement patterns for clarity
  • Requirement Clarification: Four-step systematic process
  • SPEC Document Templates: Standardized structure for consistency
  • Plan-Run-Sync Integration: Seamless workflow connection
  • Parallel Development: Git Worktree-based SPEC isolation
  • Quality Gates: TRUST 5 framework validation

EARS Five Patterns:

  • Ubiquitous: The system shall always perform action - Always active
  • Event-Driven: WHEN event occurs THEN action executes - Trigger-response
  • State-Driven: IF condition is true THEN action executes - Conditional behavior
  • Unwanted: The system shall not perform action - Prohibition
  • Optional: Where possible, provide feature - Nice-to-have

When to Use:

  • Feature planning and requirement definition
  • SPEC document creation and maintenance
  • Parallel feature development coordination
  • Quality assurance and validation planning

Quick Commands:

  • Create new SPEC: /moai:1-plan "user authentication system"
  • Create parallel SPECs with Worktrees: /moai:1-plan "login feature" "signup feature" --worktree
  • Create SPEC with new branch: /moai:1-plan "payment processing" --branch
  • Update existing SPEC: /moai:1-plan SPEC-001 "add OAuth support"

Implementation Guide (5 minutes)

Core Concepts

SPEC-First Development Philosophy:

  • EARS format ensures unambiguous requirements
  • Requirement clarification prevents scope creep
  • Systematic validation through test scenarios
  • Integration with DDD workflow for implementation
  • Quality gates enforce completion criteria
  • Constitution reference ensures project-wide consistency

Constitution Reference (SDD 2025 Standard)

Constitution defines the project DNA that all SPECs must respect. Before creating any SPEC, verify alignment with project constitution defined in .moai/project/tech.md.

Constitution Components:

  • Technology Stack: Required versions and frameworks
  • Naming Conventions: Variable, function, and file naming standards
  • Forbidden Libraries: Libraries explicitly prohibited with alternatives
  • Architectural Patterns: Layering rules and dependency directions
  • Security Standards: Authentication patterns and encryption requirements
  • Logging Standards: Log format and structured logging requirements

Constitution Verification:

  • All SPEC technology choices must align with Constitution stack versions
  • No SPEC may introduce forbidden libraries or patterns
  • SPEC must follow naming conventions defined in Constitution
  • SPEC must respect architectural boundaries and layering

WHY: Constitution prevents architectural drift and ensures maintainability IMPACT: SPECs aligned with Constitution reduce integration conflicts significantly

SPEC Workflow Stages

Stage 1 - User Input Analysis: Parse natural language feature description Stage 2 - Requirement Clarification: Four-step systematic process Stage 3 - EARS Pattern Application: Structure requirements using five patterns Stage 4 - Success Criteria Definition: Establish completion metrics Stage 5 - Test Scenario Generation: Create verification test cases Stage 6 - SPEC Document Generation: Produce standardized markdown output

EARS Format Deep Dive

Ubiquitous Requirements - Always Active:

  • Use case: System-wide quality attributes
  • Examples: Logging, input validation, error handling
  • Test strategy: Include in all feature test suites as common verification

Event-Driven Requirements - Trigger-Response:

  • Use case: User interactions and inter-system communication
  • Examples: Button clicks, file uploads, payment completions
  • Test strategy: Event simulation with expected response verification

State-Driven Requirements - Conditional Behavior:

  • Use case: Access control, state machines, conditional business logic
  • Examples: Account status checks, inventory verification, permission checks
  • Test strategy: State setup with conditional behavior verification

Unwanted Requirements - Prohibited Actions:

  • Use case: Security vulnerabilities, data integrity protection
  • Examples: No plaintext passwords, no unauthorized access, no PII in logs
  • Test strategy: Negative test cases with prohibited behavior verification

Optional Requirements - Enhancement Features:

  • Use case: MVP scope definition, feature prioritization
  • Examples: OAuth login, dark mode, offline mode
  • Test strategy: Conditional test execution based on implementation status

Requirement Clarification Process

Step 0 - Assumption Analysis (Philosopher Framework):

Before defining scope, surface and validate underlying assumptions using AskUserQuestion.

Assumption Categories:

  • Technical Assumptions: Technology capabilities, API availability, performance characteristics
  • Business Assumptions: User behavior, market requirements, timeline feasibility
  • Team Assumptions: Skill availability, resource allocation, knowledge gaps
  • Integration Assumptions: Third-party service reliability, compatibility expectations

Assumption Documentation:

  • Assumption Statement: Clear description of what is assumed
  • Confidence Level: High, Medium, or Low based on evidence
  • Evidence Basis: What supports this assumption
  • Risk if Wrong: Consequence if assumption proves false
  • Validation Method: How to verify before committing significant effort

Step 0.5 - Root Cause Analysis:

For feature requests or problem-driven SPECs, apply Five Whys:

  • Surface Problem: What is the user observing or requesting?
  • First Why: What immediate need drives this request?
  • Second Why: What underlying problem creates that need?
  • Third Why: What systemic factor contributes?
  • Root Cause: What fundamental issue must the solution adddess?

Step 1 - Scope Definition:

  • Identify supported authentication methods
  • Define validation rules and constraints
  • Determine failure handling strategy
  • Establish session management approach

Step 2 - Constraint Extraction:

  • Performance Requirements: Response time targets
  • Security Requirements: OWASP compliance, encryption standards
  • Compatibility Requirements: Supported browsers and devices
  • Scalability Requirements: Concurrent user targets

Step 3 - Success Criteria Definition:

  • Test Coverage: Minimum percentage target
  • Response Time: Percentile targets (P50, P95, P99)
  • Functional Completion: All normal scenarios pass verification
  • Quality Gates: Zero linter warnings, zero security vulnerabilities

Step 4 - Test Scenario Creation:

  • Normal Cases: Valid inputs with expected outputs
  • Error Cases: Invalid inputs with error handling
  • Edge Cases: Boundary conditions and corner cases
  • Security Cases: Injection attacks, privilege escalation attempts

Plan-Run-Sync Workflow Integration

PLAN Phase (/moai:1-plan):

  • manager-spec agent analyzes user input
  • EARS format requirements generation
  • Requirement clarification with user interaction
  • SPEC document creation in.moai/specs/ directory
  • Git branch creation (optional --branch flag)
  • Git Worktree setup (optional --worktree flag)

RUN Phase (/moai:2-run):

  • manager-ddd agent loads SPEC document
  • ANALYZE-PRESERVE-IMPROVE DDD cycle execution
  • moai-workflow-testing skill reference for test patterns
  • Domain Expert agent delegation (expert-backend, expert-frontend, etc.)
  • Quality validation through manager-quality agent

SYNC Phase (/moai:3-sync):

  • manager-docs agent synchronizes documentation
  • API documentation generation from SPEC
  • README and architecture document updates
  • CHANGELOG entry creation
  • Version control commit with SPEC reference

Parallel Development with Git Worktree

Worktree Concept:

  • Independent working directories for multiple branches
  • Each SPEC gets isolated development environment
  • No branch switching needed for parallel work
  • Reduced merge conflicts through feature isolation

Worktree Creation:

  • Command /moai:1-plan "login feature" "signup feature" --worktree creates multiple SPECs
  • Result creates project-worktrees directory with SPEC-specific subdirectories

Worktree Benefits:

  • Parallel Development: Multiple features developed simultaneously
  • Team Collaboration: Clear ownership boundaries per SPEC
  • Dependency Isolation: Different library versions per feature
  • Risk Reduction: Unstable code does not affect other features

Advanced Implementation (10+ minutes)

For advanced patterns including SPEC templates, validation automation, and workflow optimization, see:

Resources

SPEC File Organization

Directory Structure (Standard 3-File Format):

  • .moai/specs/SPEC-{ID}/: SPEC document directory containing 3 required files

- spec.md: EARS format specification (Environment, Assumptions, Requirements, Specifications) - plan.md: Implementation plan, milestones, technical approach - acceptance.md: Detailed acceptance criteria, test scenarios (Given-When-Then format)

  • .moai/state/: Session state files (last-session-state.json)
  • .moai/docs/: Generated documentation (api-documentation.md)

[HARD] Required File Set: Every SPEC directory MUST contain all 3 files (spec.md, plan.md, acceptance.md) WHY: Complete SPEC structure ensures traceability, implementation guidance, and quality validation IMPACT: Missing files create incomplete requirements and prevent proper workflow execution

SPEC Metadata Schema

Required Fields:

  • SPEC ID: Sequential number (SPEC-001, SPEC-002, etc.)
  • Title: Feature name in English
  • Created: ISO 8601 timestamp
  • Status: Planned, In Progress, Completed, Blocked
  • Priority: High, Medium, Low
  • Assigned: Agent responsible for implementation

Optional Fields:

  • Related SPECs: Dependencies and related features
  • Epic: Parent feature group
  • Estimated Effort: Time estimate in hours or story points
  • Labels: Tags for categorization

SPEC Lifecycle Management (SDD 2025 Standard)

Lifecycle Level Field:

Level 1 - spec-first:

  • Description: SPEC written before implementation, discarded after completion
  • Use Case: One-time features, prototypes, experiments
  • Maintenance Policy: No maintenance required after implementation

Level 2 - spec-anchored:

  • Description: SPEC maintained alongside implementation for evolution
  • Use Case: Core features, API contracts, integration points
  • Maintenance Policy: Quarterly review, update when implementation changes

Level 3 - spec-as-source:

  • Description: SPEC is the single source of truth; only SPEC is edited by humans
  • Use Case: Critical systems, regulated environments, code generation workflows
  • Maintenance Policy: SPEC changes trigger implementation regeneration

Lifecycle Transition Rules:

  • spec-first to spec-anchored: When feature becomes production-critical
  • spec-anchored to spec-as-source: When compliance or regeneration workflow required
  • Downgrade allowed but requires explicit justification in SPEC history

Quality Metrics

SPEC Quality Indicators:

  • Requirement Clarity: All EARS patterns used appropriately
  • Test Coverage: All requirements have corresponding test scenarios
  • Constraint Completeness: Technical and business constraints defined
  • Success Criteria Measurability: Quantifiable completion metrics

Validation Checklist:

  • All EARS requirements testable
  • No ambiguous language (should, might, usually)
  • All error cases documented
  • Performance targets quantified
  • Security requirements OWASP-compliant

Works Well With

  • moai-foundation-core: SPEC-First DDD methodology and TRUST 5 framework
  • moai-workflow-testing: DDD implementation and test automation
  • moai-workflow-project: Project initialization and configuration
  • moai-workflow-worktree: Git Worktree management for parallel development
  • manager-spec: SPEC creation and requirement analysis agent
  • manager-ddd: DDD implementation based on SPEC requirements
  • manager-quality: TRUST 5 quality validation and gate enforcement

Integration Examples

Sequential Workflow:

  • Step 1 PLAN: /moai:1-plan "user authentication system"
  • Step 2 RUN: /moai:2-run SPEC-001
  • Step 3 SYNC: /moai:3-sync SPEC-001

Parallel Workflow:

  • Create multiple SPECs: /moai:1-plan "backend API" "frontend UI" "database schema" --worktree
  • Session 1: /moai:2-run SPEC-001 (backend API)
  • Session 2: /moai:2-run SPEC-002 (frontend UI)
  • Session 3: /moai:2-run SPEC-003 (database schema)

Token Management

Session Strategy:

  • PLAN phase uses approximately 30% of session tokens
  • RUN phase uses approximately 60% of session tokens
  • SYNC phase uses approximately 10% of session tokens

Context Optimization:

  • SPEC document persists in.moai/specs/ directory
  • Session state in.moai/state/ for cross-session context
  • Minimal context transfer through SPEC ID reference
  • Agent delegation reduces token overhead

SPEC Scope and Classification (NEW)

What Belongs in.moai/specs/

The .moai/specs/ directory is EXCLUSIVELY for SPEC documents that define features to be implemented.

Valid SPEC Content:

  • Feature requirements in EARS format
  • Implementation plans with milestones
  • Acceptance criteria with Given/When/Then scenarios
  • Technical specifications for new functionality
  • User stories with clear deliverables

SPEC Characteristics:

  • Forward-looking: Describes what WILL be built
  • Actionable: Contains implementation guidance
  • Testable: Includes acceptance criteria
  • Structured: Uses EARS format patterns

What Does NOT Belong in.moai/specs/

Document TypeWhy Not SPECCorrect Location
Security AuditAnalyzes existing code.moai/reports/security-audit-{DATE}/
Performance ReportDocuments current metrics.moai/reports/performance-{DATE}/
Dependency AnalysisReviews existing dependencies.moai/reports/dependency-review-{DATE}/
Architecture OverviewDocuments current state.moai/docs/architecture.md
API ReferenceDocuments existing APIs.moai/docs/api-reference.md
Meeting NotesRecords decisions made.moai/reports/meeting-{DATE}/
RetrospectiveAnalyzes past work.moai/reports/retro-{DATE}/

Exclusion Rules

[HARD] Report vs SPEC Distinction:

Reports analyze what EXISTS → .moai/reports/ SPECs define what will be BUILT → .moai/specs/

[HARD] Documentation vs SPEC Distinction:

Documentation explains HOW TO USE → .moai/docs/ SPECs define WHAT TO BUILD → .moai/specs/


Migration Guide for Legacy Files

For migration scenarios and validation scripts, see reference/migration-guide.md.


Version: 1.3.0 (SDD 2025 Standard Integration + SPEC Scope Classification) Last Updated: 2026-01-21 Integration Status: Complete - Full Plan-Run-Sync workflow with SDD 2025 features and Migration Guide

Common Rationalizations

RationalizationReality
"The SPEC is obvious, I can skip EARS format"EARS exists because obvious requirements are the first to be misinterpreted. The format forces disambiguation.
"Acceptance criteria are redundant with the requirements"Requirements describe intent. Acceptance criteria describe observable evidence. Both are needed.
"I will refine the SPEC during implementation"Late refinement means wasted implementation. SPEC is the cheap place to change your mind.
"Research is a nice-to-have, not a blocker"Skipping research produces SPECs that conflict with existing code. research.md prevents rework.
"Annotation cycle is just user friction"Annotation catches misunderstandings before code is written. It is the cheapest feedback loop in the pipeline.
"This SPEC is small, I do not need a separate file"Every SPEC is a persistent contract. In-message SPECs cannot be referenced by /moai run SPEC-XXX.

Red Flags

  • Requirements written in imperative prose instead of EARS (WHEN X, SHALL Y)
  • Acceptance criteria phrased as subjective judgments ("feels fast", "looks clean")
  • SPEC document missing research.md sibling when modifying existing code
  • Annotation cycle skipped or reduced to a single-turn "looks good"
  • Requirements use "should" where they mean "shall" (optional vs mandatory ambiguity)
  • SPEC-ID not registered in .moai/specs/ directory

Verification

  • SPEC file exists at .moai/specs/SPEC-XXX/spec.md with unique ID
  • Every requirement uses EARS keywords (WHEN, WHILE, WHERE, IF, SHALL)
  • Every acceptance criterion is observable (test output, file existence, metric threshold)
  • research.md exists when the SPEC touches existing code
  • Annotation cycle completed with explicit user approval marker
  • SPEC references existing SPEC-IDs it depends on or supersedes
  • Non-goals section present to prevent scope creep

适合场景

01

用户想查找某类 Agent Skill 时

02

需要根据任务场景推荐可安装能力包时

03

需要对比不同来源的安装命令和来源信息时

04

需要参考平台分布和安装热度时

能力概览

能力 1

按任务关键词查找相关 Skills

能力 2

展示可复制的安装命令

能力 3

保留来源站点、仓库和原始说明,方便继续核验

能力 4

补充不同宿主或平台的使用分布数据

能力 5

展示第三方安全扫描或审计结果

安装后应在对应宿主中按原始 README 的触发条件使用;具体调用方式请以来源页面和 README 为准。

平台分布

Claude Code

29.18%
按下载量换算166

OpenCode

23.65%
按下载量换算135

Antigravity

15.01%
按下载量换算86

Codex

11.53%
按下载量换算66

Cursor

7.81%
按下载量换算45

Gemini CLI

3.15%
按下载量换算18

安全审计

Gen Agent Trust Hub

通过

Socket

通过

Snyk

通过

权限和风险

操作浏览器

该 Skill 可能涉及浏览器控制能力,使用时可能读取或操作网页内容,需要在受控环境中确认权限边界。

安装前确认

本站仅展示第三方公开信息,不托管安装包,不提供自动安装或运行环境。安装前应自行审查源码、依赖和命令行为。

来源信息

继续浏览同类 Skills