Fähigkeiten doubt-driven-development
📦

doubt-driven-development

Inhaltsrevision r1 Hohes Risiko ⚙️ Externe Befehle📁 Dateisystemzugriff

Challenge Engineering Decisions Before They Stand

Long sessions can turn assumptions into accepted facts and hide costly failure modes. This skill applies bounded, fresh-context adversarial review before non-trivial decisions stand.

Unterstützt: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠️ 38 Schlecht

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage
Review the Skillstore skill "doubt-driven-development" from https://skillstore.io/skills/addyosmani-doubt-driven-development.md and its manifest at https://skillstore.io/api/skills/addyosmani-doubt-driven-development/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/addyosmani-doubt-driven-development.md Signiertes manifest GET /api/skills/addyosmani-doubt-driven-development/manifest Signiertes lockfile GET /api/skills/addyosmani-doubt-driven-development/lockfile

Testen

„doubt-driven-development“ wird verwendet. Review a proposal to add shared in-memory caching to a concurrent service.

Erwartetes Ergebnis:

  • Claim: The cache remains correct under concurrent reads and writes.
  • Actionable issue: The proposal does not define synchronization during eviction.
  • Next step: Specify the concurrency contract and rerun the review.

„doubt-driven-development“ wird verwendet. Challenge a database migration plan that removes a legacy column.

Erwartetes Ergebnis:

  • Contract misread: The rollback window was not included in the supplied contract.
  • Actionable issue: Older application instances still read the legacy column.
  • Stop status: Revise the deployment order before another review cycle.

„doubt-driven-development“ wird verwendet. Reconcile feedback about a public API pagination change.

Erwartetes Ergebnis:

Accepted trade-off: Existing clients keep the old default for one release. Document the compatibility period and add a removal checkpoint.

Sicherheitsaudit

Hohes Risiko
v1 • 19.9.2026 Versionsbericht öffnen

Most static alerts are false positives caused by Markdown backticks, code fences, ordinary prose, or documentation links. The fixed files in /tmp create local confidentiality and integrity risk, while cross-model review can expose sensitive artifacts or let untrusted artifact instructions influence a CLI reviewer.

1
Gescannte Dateien
244
Analysierte Zeilen
2
Prüfelemente
0
Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (2)

Hoch
SKILL.md:135-151
Incomplete Isolation for Prompt-Injected Artifacts
The skill recognizes that artifacts may contain prompt injection but treats a read-only sandbox as sufficient containment. A reviewer launched inside the repository may still read sensitive files or use network capabilities, depending on the CLI.
The examples launch model CLIs with the repository as context, and the text explicitly anticipates prompt injection. Read-only access protects writes but does not universally prevent reads or outbound disclosure.
Mittel
SKILL.md:120-132
Sensitive Artifact Disclosure to External Models
The workflow offers to send artifacts and contracts to external model CLIs without requiring a secrets, ownership, or data-retention check. User authorization for execution does not establish that the content may leave its trust boundary.
The text explicitly offers Gemini or Codex review and specifies which artifact content to submit. It discusses authorization and credentials but not content sensitivity or provider policy.
Elemente der Fähigkeitsprüfung (2)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Mittel
SKILL.md:144
Temp directory access
codex exec --sandbox read-only -C <repo-path> - < /tmp/doubt-prompt.md
The example reads a predictable shared /tmp filename that may contain proprietary code or secrets. Another local process could replace or read that file unless creation, permissions, and cleanup are secured.
Mittel
SKILL.md:148
Temp directory access
gemini --approval-mode plan -p "" < /tmp/doubt-prompt.md
The Gemini example also consumes the fixed /tmp/doubt-prompt.md path. Predictable shared temporary files create local tampering and disclosure risk.

Risikofaktoren

⚙️ Externe Befehle (27)
SKILL.md:12 SKILL.md:46 SKILL.md:53-60 SKILL.md:60-66 SKILL.md:66-71 SKILL.md:71-89 SKILL.md:89-104 SKILL.md:104-108 SKILL.md:108 SKILL.md:110-128 SKILL.md:128 SKILL.md:129 SKILL.md:132 SKILL.md:135-139 SKILL.md:139-149 SKILL.md:149-161 SKILL.md:161-200 SKILL.md:200 SKILL.md:216-225 SKILL.md:225 SKILL.md:226-227 SKILL.md:227-228 SKILL.md:228-229 SKILL.md:132 SKILL.md:135 SKILL.md:132 SKILL.md:135
📁 Dateisystemzugriff (4)
SKILL.md:46 SKILL.md:229 SKILL.md:144 SKILL.md:148
Geprüft von: codex
Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen
Sicherheitsbewertung

Berichtslink kopieren

https://skillstore.io/skills/addyosmani-doubt-driven-development/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/addyosmani-doubt-driven-development/security.svg)](https://skillstore.io/skills/addyosmani-doubt-driven-development?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/addyosmani-doubt-driven-development?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/addyosmani-doubt-driven-development/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/addyosmani-doubt-driven-development.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

addyosmani. (2026). doubt-driven-development security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/addyosmani-doubt-driven-development/audits/1

BibTeX-Zitat

@techreport{addyosmani-addyosmani-doubt-driven-development-2026, author = {addyosmani}, title = {doubt-driven-development security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/addyosmani-doubt-driven-development/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "doubt-driven-development security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "addyosmani" date-released: "2026-09-19" url: "https://skillstore.io/skills/addyosmani-doubt-driven-development/audits/1" identifiers: - type: other value: "skillstore:addyosmani-doubt-driven-development:audit:1" description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel
55
Architektur
85
Wartbarkeit
87
Inhalt
65
Gemeinschaft
91
Spezifikationskonformität

Was Sie erstellen können

Validate an Architecture Decision

Challenge service boundaries, shared state, failure modes, and unstated assumptions before implementation begins.

Review Security-Sensitive Logic

Test authentication, authorization, or data-handling changes against an explicit contract before committing.

Prepare a High-Risk Migration

Expose irreversible steps, rollback gaps, and hidden dependencies before approving a production migration.

Diese Prompts ausprobieren

Review One Decision 
Apply doubt-driven development to this decision. State the claim, extract the artifact and contract, then find assumptions and failure modes.
Challenge a Code Change 
Review this change against its contract. Focus on edge cases, hidden state, broken conventions, and inputs that violate expected behavior.
Reconcile Reviewer Findings 
Classify each finding as contract misread, actionable issue, accepted trade-off, or noise. Cite artifact evidence and recommend the next step.
Run a Bounded Review Cycle 
Run up to three doubt cycles on this high-stakes artifact. Track changed assumptions, unresolved findings, accepted trade-offs, and the final stop condition.

Bewährte Praktiken

  • Keep each artifact small and provide a precise contract.
  • Use reviewer findings as evidence, then verify each finding against the artifact.
  • Record the stop condition and escalate unresolved issues after three cycles.

Vermeiden

  • Do not pass the original claim when independent contract evaluation is required.
  • Do not invoke external model tools without explicit authorization for each call.
  • Do not repeat reviews on an unchanged artifact to manufacture confidence.

Häufig gestellte Fragen

How is this different from a final code review?
It challenges non-trivial decisions during development, while a final review evaluates a completed artifact.
What counts as a non-trivial decision?
Examples include branching logic, module boundaries, unverifiable invariants, irreversible changes, and decisions with hidden context.
Does every change need a doubt cycle?
No. Mechanical edits, formatting, simple file moves, and obvious one-line changes usually do not need one.
Must I use another model?
No. Interactive sessions should offer cross-model review, but the user may skip it.
When should the review loop stop?
Stop after trivial findings, three cycles, or an explicit user decision to proceed.
Can reviewer findings be accepted automatically?
No. Recheck every finding against the artifact and classify it before changing the work.

Entwicklerdetails

Lizenz

MIT

Skillstore-Revision

r1

Versionshinweis

Der Autor hat keine Version angegeben.

Repository

https://github.com/addyosmani/agent-skills/tree/c004a74784a08295d52749b04cda634125b9a581/skills/doubt-driven-development

Ref.

5d5054f8a23586f9b500fece1cb613a9dffc787b

Aktualität der Wartung

19.9.2026

Nutzung

0 Downloads · 0 Aufrufe

Dateistruktur

📄 SKILL.md

Mehr von addyosmani

Alle anzeigen

Ähnliche Skills

Alle anzeigen