agentleFS
opentensoropentensor/subtensor/.agents/skills/skeptic/SKILL.md

skeptic

Skill401 starsChanged 3 months agoApache-2.0View on GitHub

Run the security-focused Skeptic persona on the local working tree's diff against a base branch. Static analysis only — does not build, test, or execute anything from the diff. Outputs a verdict comment and a suggested-changes patch file. Use when the user wants to security-review a branch before pushing.

We split this skill into the rules it gives an agent

5 rules. 0 are common, 2 are distinctive, and 3 are very specific to this project.

  • 0

    Common

    Most of the 4 edited versions we read keep these.

  • 2

    Distinctive

    This author's own choices. Worth a look.

  • 3

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Very specific:

    If gh pr view --json baseRefName succeeds in the current branch's PR, use that.

    line 13
  2. Distinctive:

    If the diff is empty, report "No changes vs $BASE" and exit.

    line 24
  3. Very specific:

    Do NOT: run cargo, npm, make, docker, or any build/test command.

    line 33
  4. Very specific:

    If you have suggested changes (suggestion-block content from the persona output), additionally write them to .skeptic-suggestions.patch in …

    line 57
  5. Distinctive:

    Do NOT post anything to GitHub.

    line 59

“Common” is measured: kept by at least 6 in 10 of the 4 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Skeptic — local mode

You are running the Skeptic persona locally against the user's working tree. There is no PR yet (or the PR exists but the user wants a fast iteration before pushing). Your output goes to the terminal, not GitHub.

Step 1 — Determine the diff

Detect the base branch in this order:

  1. If gh pr view --json baseRefName succeeds in the current branch's PR, use that.
  2. Else, default to devnet (the policy base for new PRs).
  3. Allow override: if the user invoked the skill with an argument like /skeptic main, use that.

Compute the diff:

git fetch origin "$BASE" --quiet
git diff --merge-base "origin/$BASE"...HEAD

If the diff is empty, report "No changes vs $BASE" and exit.

Step 2 — Run the persona

Load and follow the instructions in:

  • .github/ai-review/common.md
  • .github/ai-review/skeptic.md

Constraints inherited from the persona file:

  • Do NOT run cargo, npm, make, docker, or any build/test command. Read-only analysis only.
  • You may use gh, git log, git show, git diff, grep, rg, and read files.

For the contributor signal step, if gh pr view reveals an existing PR, query the author's history. Otherwise (no PR yet), use the local commit author identity from git log --format='%an <%ae>' and skip the GitHub-API queries — note in the output that the contributor-signal check was limited because no PR exists yet.

Step 3 — Output

Print to stdout in the same format the persona file specifies, but adapted for terminal:

============================================================
  SKEPTIC VERDICT: [SAFE | VULNERABLE | MALICIOUS]
============================================================

Contributor scrutiny: <tier>
Branch: <head> -> <base>

Findings:
  [SEVERITY] Title
    file:line — description

Conclusion: <one sentence>

If you have suggested changes (suggestion-block content from the persona output), additionally write them to .skeptic-suggestions.patch in unified diff format that the user can apply with git apply .skeptic-suggestions.patch. Print the patch path at the end of your output. If no suggestions, do not create the file.

Do NOT post anything to GitHub. Do NOT modify any files in the working tree (other than writing the suggestions patch).

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.