skeptic
Skill401 starsChanged 3 months agoApache-2.0View on GitHub
Run the security-focused Skeptic persona on the local working tree's diff against a base branch. Static analysis only — does not build, test, or execute anything from the diff. Outputs a verdict comment and a suggested-changes patch file. Use when the user wants to security-review a branch before pushing.
We split this skill into the rules it gives an agent
5 rules. 0 are common, 2 are distinctive, and 3 are very specific to this project.
0
Common
Most of the 4 edited versions we read keep these.
2
Distinctive
This author's own choices. Worth a look.
3
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Very specific: line 13
If gh pr view --json baseRefName succeeds in the current branch's PR, use that.
- Distinctive: line 24
If the diff is empty, report "No changes vs $BASE" and exit.
- Very specific: line 33
Do NOT: run cargo, npm, make, docker, or any build/test command.
- Very specific: line 57
If you have suggested changes (suggestion-block content from the persona output), additionally write them to .skeptic-suggestions.patch in …
- Distinctive: line 59
Do NOT post anything to GitHub.
“Common” is measured: kept by at least 6 in 10 of the 4 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Skeptic — local mode
You are running the Skeptic persona locally against the user's working tree. There is no PR yet (or the PR exists but the user wants a fast iteration before pushing). Your output goes to the terminal, not GitHub.
Step 1 — Determine the diff
Detect the base branch in this order:
- If
gh pr view --json baseRefNamesucceeds in the current branch's PR, use that. - Else, default to
devnet(the policy base for new PRs). - Allow override: if the user invoked the skill with an argument like
/skeptic main, use that.
Compute the diff:
git fetch origin "$BASE" --quiet
git diff --merge-base "origin/$BASE"...HEADIf the diff is empty, report "No changes vs $BASE" and exit.
Step 2 — Run the persona
Load and follow the instructions in:
.github/ai-review/common.md.github/ai-review/skeptic.md
Constraints inherited from the persona file:
- Do NOT run
cargo,npm,make,docker, or any build/test command. Read-only analysis only. - You may use
gh,git log,git show,git diff,grep,rg, and read files.
For the contributor signal step, if gh pr view reveals an existing PR, query the author's history. Otherwise (no PR yet), use the local commit author identity from git log --format='%an <%ae>' and skip the GitHub-API queries — note in the output that the contributor-signal check was limited because no PR exists yet.
Step 3 — Output
Print to stdout in the same format the persona file specifies, but adapted for terminal:
============================================================
SKEPTIC VERDICT: [SAFE | VULNERABLE | MALICIOUS]
============================================================
Contributor scrutiny: <tier>
Branch: <head> -> <base>
Findings:
[SEVERITY] Title
file:line — description
Conclusion: <one sentence>If you have suggested changes (suggestion-block content from the persona output), additionally write them to .skeptic-suggestions.patch in unified diff format that the user can apply with git apply .skeptic-suggestions.patch. Print the patch path at the end of your output. If no suggestions, do not create the file.
Do NOT post anything to GitHub. Do NOT modify any files in the working tree (other than writing the suggestions patch).
Other versions6 projects use a version of this.
Word for word · 0
None found.
Edited · 0
None found.
Wrote their own version · 6
- codexstar69/bug-hunter★ 546same name
- sergeeey/Claude-cod-top-2026★ 9same name
- maccydee/claude-planning-skills★ 3same name
- HumanBean17/agent-mindset-skills★ 1same name
- IyedNasra/skeptic★ 1same name
- tokyubevoxelverse/skeptic★ 1same name
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository5 other files it gives its agents.
- AGENTS.mdAGENTS.md
- clones/AGENTS.mdAGENTS.md
- .github/copilot-instructions.mdCopilot instructions
- auditorSkill
- evm-maintainerSkill
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

