スキル doubt-driven-development
📦

doubt-driven-development

コンテンツリビジョン r1 高リスク ⚙️ 外部コマンド📁 ファイルシステムへのアクセス

Challenge Engineering Decisions Before They Stand

Long sessions can turn assumptions into accepted facts and hide costly failure modes. This skill applies bounded, fresh-context adversarial review before non-trivial decisions stand.

対応: Claude Codex Code(CC)
⚠️ 38 不十分

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト
Review the Skillstore skill "doubt-driven-development" from https://skillstore.io/skills/addyosmani-doubt-driven-development.md and its manifest at https://skillstore.io/api/skills/addyosmani-doubt-driven-development/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

Markdown詳細 GET /skills/addyosmani-doubt-driven-development.md 署名済み manifest GET /api/skills/addyosmani-doubt-driven-development/manifest 署名済み lockfile GET /api/skills/addyosmani-doubt-driven-development/lockfile

テストする

「doubt-driven-development」を使用しています。 Review a proposal to add shared in-memory caching to a concurrent service.

期待される結果:

  • Claim: The cache remains correct under concurrent reads and writes.
  • Actionable issue: The proposal does not define synchronization during eviction.
  • Next step: Specify the concurrency contract and rerun the review.

「doubt-driven-development」を使用しています。 Challenge a database migration plan that removes a legacy column.

期待される結果:

  • Contract misread: The rollback window was not included in the supplied contract.
  • Actionable issue: Older application instances still read the legacy column.
  • Stop status: Revise the deployment order before another review cycle.

「doubt-driven-development」を使用しています。 Reconcile feedback about a public API pagination change.

期待される結果:

Accepted trade-off: Existing clients keep the old default for one release. Document the compatibility period and add a removal checkpoint.

セキュリティ監査

高リスク
v1 • 2026/9/19 バージョン別レポートを開く

Most static alerts are false positives caused by Markdown backticks, code fences, ordinary prose, or documentation links. The fixed files in /tmp create local confidentiality and integrity risk, while cross-model review can expose sensitive artifacts or let untrusted artifact instructions influence a CLI reviewer.

1
スキャンされたファイル
244
解析済み行数
2
レビュー項目
0
誤検知を無視

確認済みのセキュリティ上の懸念 (2)

高
SKILL.md:135-151
Incomplete Isolation for Prompt-Injected Artifacts
The skill recognizes that artifacts may contain prompt injection but treats a read-only sandbox as sufficient containment. A reviewer launched inside the repository may still read sensitive files or use network capabilities, depending on the CLI.
The examples launch model CLIs with the repository as context, and the text explicitly anticipates prompt injection. Read-only access protects writes but does not universally prevent reads or outbound disclosure.
中
SKILL.md:120-132
Sensitive Artifact Disclosure to External Models
The workflow offers to send artifacts and contracts to external model CLIs without requiring a secrets, ownership, or data-retention check. User authorization for execution does not establish that the content may leave its trust boundary.
The text explicitly offers Gemini or Codex review and specifies which artifact content to submit. It discusses authorization and credentials but not content sensitivity or provider policy.
機能レビュー項目 (2)

これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。

中
SKILL.md:144
Temp directory access
codex exec --sandbox read-only -C <repo-path> - < /tmp/doubt-prompt.md
The example reads a predictable shared /tmp filename that may contain proprietary code or secrets. Another local process could replace or read that file unless creation, permissions, and cleanup are secured.
中
SKILL.md:148
Temp directory access
gemini --approval-mode plan -p "" < /tmp/doubt-prompt.md
The Gemini example also consumes the fixed /tmp/doubt-prompt.md path. Predictable shared temporary files create local tampering and disclosure risk.

リスク要因

⚙️ 外部コマンド (27)
SKILL.md:12 SKILL.md:46 SKILL.md:53-60 SKILL.md:60-66 SKILL.md:66-71 SKILL.md:71-89 SKILL.md:89-104 SKILL.md:104-108 SKILL.md:108 SKILL.md:110-128 SKILL.md:128 SKILL.md:129 SKILL.md:132 SKILL.md:135-139 SKILL.md:139-149 SKILL.md:149-161 SKILL.md:161-200 SKILL.md:200 SKILL.md:216-225 SKILL.md:225 SKILL.md:226-227 SKILL.md:227-228 SKILL.md:228-229 SKILL.md:132 SKILL.md:135 SKILL.md:132 SKILL.md:135
📁 ファイルシステムへのアクセス (4)
SKILL.md:46 SKILL.md:229 SKILL.md:144 SKILL.md:148
監査者: codex
このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く
セキュリティ評価

レポートリンクをコピー

https://skillstore.io/skills/addyosmani-doubt-driven-development/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/addyosmani-doubt-driven-development/security.svg)](https://skillstore.io/skills/addyosmani-doubt-driven-development?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/addyosmani-doubt-driven-development?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/addyosmani-doubt-driven-development/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/addyosmani-doubt-driven-development.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学術引用 (APA · BibTeX · CFF)

APA形式の引用

addyosmani. (2026). doubt-driven-development security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/addyosmani-doubt-driven-development/audits/1

BibTeX形式の引用

@techreport{addyosmani-addyosmani-doubt-driven-development-2026, author = {addyosmani}, title = {doubt-driven-development security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/addyosmani-doubt-driven-development/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "doubt-driven-development security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "addyosmani" date-released: "2026-09-19" url: "https://skillstore.io/skills/addyosmani-doubt-driven-development/audits/1" identifiers: - type: other value: "skillstore:addyosmani-doubt-driven-development:audit:1" description: "Skillstore immutable audit report identifier"

Skillstore スコア

このスコアの理由 証拠の信頼度: 中
55
アーキテクチャ
85
保守性
87
コンテンツ
65
コミュニティ
91
仕様準拠

作成できるもの

Validate an Architecture Decision

Challenge service boundaries, shared state, failure modes, and unstated assumptions before implementation begins.

Review Security-Sensitive Logic

Test authentication, authorization, or data-handling changes against an explicit contract before committing.

Prepare a High-Risk Migration

Expose irreversible steps, rollback gaps, and hidden dependencies before approving a production migration.

これらのプロンプトを試す

Review One Decision 
Apply doubt-driven development to this decision. State the claim, extract the artifact and contract, then find assumptions and failure modes.
Challenge a Code Change 
Review this change against its contract. Focus on edge cases, hidden state, broken conventions, and inputs that violate expected behavior.
Reconcile Reviewer Findings 
Classify each finding as contract misread, actionable issue, accepted trade-off, or noise. Cite artifact evidence and recommend the next step.
Run a Bounded Review Cycle 
Run up to three doubt cycles on this high-stakes artifact. Track changed assumptions, unresolved findings, accepted trade-offs, and the final stop condition.

ベストプラクティス

  • Keep each artifact small and provide a precise contract.
  • Use reviewer findings as evidence, then verify each finding against the artifact.
  • Record the stop condition and escalate unresolved issues after three cycles.

回避

  • Do not pass the original claim when independent contract evaluation is required.
  • Do not invoke external model tools without explicit authorization for each call.
  • Do not repeat reviews on an unchanged artifact to manufacture confidence.

よくある質問

How is this different from a final code review?
It challenges non-trivial decisions during development, while a final review evaluates a completed artifact.
What counts as a non-trivial decision?
Examples include branching logic, module boundaries, unverifiable invariants, irreversible changes, and decisions with hidden context.
Does every change need a doubt cycle?
No. Mechanical edits, formatting, simple file moves, and obvious one-line changes usually do not need one.
Must I use another model?
No. Interactive sessions should offer cross-model review, but the user may skip it.
When should the review loop stop?
Stop after trivial findings, three cycles, or an explicit user decision to proceed.
Can reviewer findings be accepted automatically?
No. Recheck every finding against the artifact and classify it before changing the work.

開発者情報

作成者

addyosmani

ライセンス

MIT

Skillstore リビジョン

r1

バージョンに関する注意

作者はバージョンを宣言していません。

リポジトリ

https://github.com/addyosmani/agent-skills/tree/c004a74784a08295d52749b04cda634125b9a581/skills/doubt-driven-development

参照

5d5054f8a23586f9b500fece1cb613a9dffc787b

メンテナンスの新しさ

2026/9/19

利用状況

0 ダウンロード · 0 閲覧

ファイル構成

📄 SKILL.md

addyosmani のその他のスキル

すべて表示

関連スキル

すべて表示