Skills when-detecting-fake-code-use-theater-detection

📦

when-detecting-fake-code-use-theater-detection

Name: when-detecting-fake-code-use-theater-detection
Author: DNYoussef

Content revision r1 High Risk ⚡ Contains scripts⚙️ External commands📁 Filesystem access

Detect Theater Code Before Release

Code can look complete while missing real behavior. This skill helps Claude, Codex, and Claude Code test implementations against actual execution evidence.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "when-detecting-fake-code-use-theater-detection" from https://skillstore.io/skills/dnyoussef-when-detecting-fake-code-use-theater-detection.md and its manifest at https://skillstore.io/api/skills/dnyoussef-when-detecting-fake-code-use-theater-detection/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/dnyoussef-when-detecting-fake-code-use-theater-detection.md Signed manifest GET /api/skills/dnyoussef-when-detecting-fake-code-use-theater-detection/manifest Signed lockfile GET /api/skills/dnyoussef-when-detecting-fake-code-use-theater-detection/lockfile

Test it

Using "when-detecting-fake-code-use-theater-detection". Scan a new payment module before merge.

Expected outcome:

A reviewer-ready report listing suspicious functions, confidence scores, execution evidence, and required fixes.

Using "when-detecting-fake-code-use-theater-detection". Check tests that appear too simple.

Expected outcome:

A finding that explains which tests never exercise product code and how to replace them with behavior checks.

Using "when-detecting-fake-code-use-theater-detection". Validate a flagged repository in CI.

Expected outcome:

A release gate summary with confirmed issues, false positives, and whether deployment should continue.

Security Audit

High Risk

v8 • 7/5/2026 Open versioned report

Most static hits are false positives from Markdown fences, JavaScript template literals, regular expressions, Object.keys calls, and local report-generation snippets. Confirmed risk remains because the workflow can dynamically load and execute audited repository code, and the fix phase can rewrite many files. No prompt injection evidence was found in the reviewed files.

Files scanned

2,056

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:414-445 SKILL.md:451-455 PROCESS.md:326 PROCESS.md:358-363

Untrusted Project Code Execution During Validation

The validation workflow loads files from the audited repository and calls exported functions with sample inputs. This can trigger side effects in untrusted code.

The files show direct dynamic require calls and then execute exported functions with several inputs. That is clear execution of target repository code.

High

SKILL.md:769-771 PROCESS.md:491-494

Automated Repository-Wide Source Modification

The fix phase runs repository-wide in-place replacements across JavaScript files. This can change many files without per-file human approval.

Both documented fix scripts use find with sed -i over broad file sets. The commands are explicit and can modify the working tree.

Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

PROCESS.md:326

Dynamic require with variable

module = require(fileData.file);

The workflow dynamically requires files selected from analysis results. Loading audited project files can execute untrusted top-level code and side effects during validation.

High

SKILL.md:414

Dynamic require with variable

const module = require(`./${fileData.file}`);

The workflow dynamically requires files selected from analysis results. Loading audited project files can execute untrusted top-level code and side effects during validation.

High

SKILL.md:424

Dynamic require with variable

const module = require(`./${fileData.file}`);

The workflow dynamically requires files selected from analysis results. Loading audited project files can execute untrusted top-level code and side effects during validation.

High

SKILL.md:445

Dynamic require with variable

const module = require(`./${fileData.file}`);

The workflow dynamically requires files selected from analysis results. Loading audited project files can execute untrusted top-level code and side effects during validation.

Risk Factors

⚡ Contains scripts (4)

PROCESS.md:326 SKILL.md:414 SKILL.md:424 SKILL.md:445

⚙️ External commands (156)

PROCESS.md:223-248 PROCESS.md:248-274 PROCESS.md:321-376 PROCESS.md:376-416 PROCESS.md:70 PROCESS.md:79 PROCESS.md:89 PROCESS.md:99 PROCESS.md:103 PROCESS.md:112 PROCESS.md:489 PROCESS.md:496 PROCESS.md:527 PROCESS.md:530 PROCESS.md:532 PROCESS.md:534 PROCESS.md:55 PROCESS.md:482 PROCESS.md:574 README.md:147 SKILL.md:58-120 SKILL.md:120-124 SKILL.md:124-189 SKILL.md:189-192 SKILL.md:192-193 SKILL.md:193-194 SKILL.md:194-215 SKILL.md:215-289 SKILL.md:289-316 SKILL.md:316-364 SKILL.md:364-367 SKILL.md:367-368 SKILL.md:368-369 SKILL.md:369-390 SKILL.md:390-411 SKILL.md:411-414 SKILL.md:414-424 SKILL.md:424-439 SKILL.md:439-445 SKILL.md:445-468 SKILL.md:468-475 SKILL.md:475-530 SKILL.md:530-540 SKILL.md:540-543 SKILL.md:543-544 SKILL.md:544-545 SKILL.md:545-566 SKILL.md:566-686 SKILL.md:686-687 SKILL.md:687-688 SKILL.md:688-689 SKILL.md:689-690 SKILL.md:690-720 SKILL.md:720-723 SKILL.md:723-724 SKILL.md:724-725 SKILL.md:725-746 SKILL.md:746-819 SKILL.md:819-822 SKILL.md:822-823 SKILL.md:823-824 SKILL.md:824-843 SKILL.md:843-846 SKILL.md:846-847 SKILL.md:847-848 SKILL.md:848-849 SKILL.md:849-850 SKILL.md:850-854 SKILL.md:854-879 SKILL.md:879-881 SKILL.md:881-887 SKILL.md:887-907 SKILL.md:907-1006 SKILL.md:1006-1007 SKILL.md:1007-1008 SKILL.md:1008-1009 SKILL.md:1009-1018 SKILL.md:1018-1027 SKILL.md:1027-1053 SKILL.md:1053-1062 SKILL.md:1062-1086 SKILL.md:1086-1101 SKILL.md:1101-1105 SKILL.md:1105-1133 SKILL.md:1133-1137 SKILL.md:1137-1175 SKILL.md:159 SKILL.md:160 SKILL.md:161 SKILL.md:162 SKILL.md:163 SKILL.md:164 SKILL.md:172 SKILL.md:185 SKILL.md:221 SKILL.md:359 SKILL.md:360 SKILL.md:396 SKILL.md:536 SKILL.md:572 SKILL.md:573 SKILL.md:574 SKILL.md:575 SKILL.md:582 SKILL.md:588 SKILL.md:589 SKILL.md:590 SKILL.md:591 SKILL.md:594 SKILL.md:601 SKILL.md:602 SKILL.md:603 SKILL.md:604 SKILL.md:605 SKILL.md:614 SKILL.md:617 SKILL.md:620 SKILL.md:627 SKILL.md:628 SKILL.md:629 SKILL.md:630 SKILL.md:633 SKILL.md:696 SKILL.md:702 SKILL.md:703 SKILL.md:704 SKILL.md:705 SKILL.md:706 SKILL.md:707 SKILL.md:708 SKILL.md:709 SKILL.md:710 SKILL.md:715 SKILL.md:716 SKILL.md:752 SKILL.md:753 SKILL.md:763 SKILL.md:802 SKILL.md:805 SKILL.md:807 SKILL.md:809 SKILL.md:814 SKILL.md:891 SKILL.md:1022 SKILL.md:1055 SKILL.md:124-189 SKILL.md:215-289 SKILL.md:316-364 SKILL.md:390-411 SKILL.md:530-540 SKILL.md:566-686 SKILL.md:690-720 SKILL.md:746-819 SKILL.md:887-907 SKILL.md:1018-1027 SKILL.md:1053-1062

📁 Filesystem access (53)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/dnyoussef-when-detecting-fake-code-use-theater-detection/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/dnyoussef-when-detecting-fake-code-use-theater-detection/security.svg)](https://skillstore.io/skills/dnyoussef-when-detecting-fake-code-use-theater-detection?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/dnyoussef-when-detecting-fake-code-use-theater-detection?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dnyoussef-when-detecting-fake-code-use-theater-detection/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/dnyoussef-when-detecting-fake-code-use-theater-detection.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

DNYoussef. (2026). when-detecting-fake-code-use-theater-detection security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/dnyoussef-when-detecting-fake-code-use-theater-detection/audits/8

BibTeX citation

@techreport{dnyoussef-dnyoussef-when-detecting-fake-code-use-theater-detection-2026,
  author = {DNYoussef},
  title = {when-detecting-fake-code-use-theater-detection security audit report (audit version 8)},
  institution = {Skillstore},
  year = {2026},
  number = {8},
  url = {https://skillstore.io/skills/dnyoussef-when-detecting-fake-code-use-theater-detection/audits/8},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "when-detecting-fake-code-use-theater-detection security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
  - name: "DNYoussef"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/dnyoussef-when-detecting-fake-code-use-theater-detection/audits/8"
identifiers:
  - type: other
    value: "skillstore:dnyoussef-when-detecting-fake-code-use-theater-detection:audit:8"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Review AI-Generated Pull Requests

Check whether new code performs real work before it reaches the main branch.

Audit Critical Security Logic

Find fake validation, empty error handling, and tests that create false confidence.

Add Release Quality Gates

Run theater detection before deployment and produce a report for release approval.

Try These Prompts

Beginner Scan

Use theater detection on this repository. Identify obvious no-op functions, empty catches, and always-passing tests.

Focused Directory Review

Scan the src/auth directory for theater code. Explain each finding with evidence and confidence.

Execution Validation Pass

Validate the flagged implementations by running behavior checks in a sandbox. Separate confirmed theater code from false positives.

Release Gate Report

Run a full theater detection workflow. Produce prioritized findings, residual risks, and required fixes before release.

Best Practices

Run execution validation inside a disposable container or isolated workspace.
Review generated findings before applying any automated fixes.
Pair heuristic results with domain knowledge from the owning team.

Avoid

Do not run dynamic validation against untrusted repositories on a developer workstation.
Do not treat pattern matches as confirmed issues without execution or semantic review.
Do not apply repository-wide fixes without checking the diff first.