Skip to content
skillsafebeta
← Report library
Purpose / Development

Doubt Driven Development Skill Security Audit

What the author says it does (original text)

Subjects every non-trivial decision to a fresh-context adversarial review before it stands. Use when correctness matters more than speed, when working in unfamiliar code, when stakes are high (production, security-sensitive logic, irreversible operations), or any time a confident output would be cheaper to verify now than to debug later.

Independent security check

Security risks found

Files checked
1
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Cross-model review sends code or decision material to an external model service

Source references: 3
What we found

After the user selects Gemini or Codex CLI, the Skill explicitly sends ARTIFACT and CONTRACT to that tool. A read-only sandbox limits workspace writes; it does not stop the CLI from transmitting input to its model provider.

Why this matters

Proprietary code, customer information, internal architecture, unreleased decisions, or credentials embedded in the material could enter another provider's systems and become subject to its logging, retention, and account policies.

Only when the user selects and authorizes Gemini/Codex CLI for that invocation does the Skill pass ARTIFACT and CONTRACT to it. If the CLI connects to a hosted model, that material may leave the machine; a read-only workspace sandbox does not establish that network transmission is blocked. Users can require disclosure of each CLI's data destination and retention policy, submit only redacted material, or prohibit external CLIs.

SKILL.md:130In the instructionsOpen original file
2. Test it works (`gemini --version` or equivalent) before passing the full prompt — a stale or broken binary may pass `which` but fail on real input.3. Confirm the exact invocation with the user, including required flags, auth, and env vars (e.g., API keys). Implementations vary; never assume.4. Pass ARTIFACT + CONTRACT + the adversarial prompt **only**. No session context, no CLAIM.5. Mind shell escaping. If the artifact contains quotes, `$(...)`, or backticks, prefer stdin (`echo … | gemini`) or a heredoc over inline `-p "…"`. When in doubt, ask the user to confirm the invocation before running it.6. Take the output into Step 4 (RECONCILE).
Show 2 other places
SKILL.md:143In the instructionsOpen original file
# Codex (read-only sandbox keeps the CLI from writing to your workspace):codex exec --sandbox read-only -C <repo-path> - < /tmp/doubt-prompt.md# Gemini ('--approval-mode plan' is read-only; '-p ""' triggers non-interactive# mode and the prompt is read from stdin):gemini --approval-mode plan -p "" < /tmp/doubt-prompt.md```
SKILL.md:163In the instructionsOpen original file
- Cross-model is **skipped**, and the skip must be **announced** in the output: *"Cross-model skipped: non-interactive context."*- **Never invoke an external CLI without explicit user authorization** — this is a load-bearing safety property.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

Review material is written to a temporary file without required private permissions or cleanup

Source references: 3
What we found

The Skill requires writing the full prompt, ARTIFACT, and CONTRACT to a file and demonstrates the fixed path `/tmp/doubt-prompt.md`. That material can contain source code or internal decisions, but the instructions do not require a unique private file or deletion after invocation.

Why this matters

Other local users or processes may be able to read leftover material. Copying the fixed path may also overwrite an existing temporary file; a predictable path is especially risky where an attacker can place a symbolic link.

The active instructions require writing the full prompt to a file, and the example uses the fixed path `/tmp/doubt-prompt.md`, without visible requirements for a unique name, owner-only permissions, or cleanup afterward. Private code or decisions could therefore remain in temporary storage; a fixed path may also create overwrite or local-reading risks depending on system permissions. Users can require a uniquely created owner-only temporary file, avoid placing sensitive material on disk, and confirm automatic cleanup.

SKILL.md:135In the instructionsOpen original file
**Never interpolate the artifact into a shell-quoted argument.** Code, markdown, and review prompts routinely contain backticks, `$(...)`, and quote characters that will either truncate the prompt or execute embedded shell. Write the full prompt to a file and pipe it through stdin.
Show 2 other places
SKILL.md:140In the instructionsOpen original file
```bash# Write the adversarial prompt + ARTIFACT + CONTRACT to a temp file first.# Then pipe via stdin so shell metacharacters in the artifact stay inert.# Codex (read-only sandbox keeps the CLI from writing to your workspace):codex exec --sandbox read-only -C <repo-path> - < /tmp/doubt-prompt.md
SKILL.md:146In the instructionsOpen original file
# Gemini ('--approval-mode plan' is read-only; '-p ""' triggers non-interactive# mode and the prompt is read from stdin):gemini --approval-mode plan -p "" < /tmp/doubt-prompt.md```
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Low risk

Optional external review can consume paid model-account quota each cycle

Source references: 5
What we found

The Skill requires offering cross-model review in every interactive doubt cycle and expressly acknowledges added cost and latency. If the user authorizes a CLI, the call uses the configured model account's quota.

Why this matters

Repeated cross-model reviews may incur API or subscription usage charges and delay delivery. The three-cycle local review bound does not itself cap the external provider's per-call price or consumed quota.

The Skill requires offering cross-model options in every interactive cycle and acknowledges added cost, but merely offering the choice incurs no model charge. Usage or fees may arise only after the user selects a CLI, confirms the exact invocation, and explicitly authorizes that call; authorization must be renewed each time. Users can choose “skip” and ask to see the model, command, and expected cost before authorizing.

SKILL.md:116In the instructionsOpen original file
**Interactive sessions: always offer. Never silently skip.****Step 1: Ask the user**After the single-model review in Step 3 above, but before RECONCILE, pause and ask:> *"Single-model review complete. Want a cross-model second opinion? Options: Gemini CLI, Codex CLI, manual external review (you paste it elsewhere), or skip."*This question is mandatory in every interactive doubt cycle — even on artifacts that feel low-stakes. The user — not the agent — decides whether the cost is worth it. The agent's job is to surface the choice.
Show 4 other places
SKILL.md:166In the instructionsOpen original file
Cross-model adds cost, latency, and tool fragility. The agent surfaces the choice every cycle; the user decides whether this artifact warrants it.
SKILL.md:205In the instructionsOpen original file
| "Cross-model is always better" | Cross-model catches blind spots a single model shares with itself, but it adds cost and tool fragility. Offer it every interactive doubt cycle — the user decides whether the artifact warrants it. The agent's job is to surface the choice, not to gate it. || "User said yes once, so I can keep invoking the CLI" | Each invocation is its own authorization. The artifact, the prompt, and the flags change between calls — re-confirm the exact command with the user before every run. |
SKILL.md:126In the instructionsOpen original file
**Step 2: If the user picks a CLI — verify, then invoke**1. Check the tool is in PATH (`which gemini`, `which codex`).2. Test it works (`gemini --version` or equivalent) before passing the full prompt — a stale or broken binary may pass `which` but fail on real input.3. Confirm the exact invocation with the user, including required flags, auth, and env vars (e.g., API keys). Implementations vary; never assume.4. Pass ARTIFACT + CONTRACT + the adversarial prompt **only**. No session context, no CLAIM.5. Mind shell escaping. If the artifact contains quotes, `$(...)`, or backticks, prefer stdin (`echo … | gemini`) or a heredoc over inline `-p "…"`. When in doubt, ask the user to confirm the invocation before running it.
SKILL.md:163In the instructionsOpen original file
- Cross-model is **skipped**, and the skip must be **announced** in the output: *"Cross-model skipped: non-interactive context."*- **Never invoke an external CLI without explicit user authorization** — this is a load-bearing safety property.Cross-model adds cost, latency, and tool fragility. The agent surfaces the choice every cycle; the user decides whether this artifact warrants it.

Inside this skill

8 instruction sections

The Skill directs the main session to reduce a non-trivial decision to the smallest artifact and contract, then give them to a fresh-context reviewer whose goal is to find faults; the author's claim is withheld.

View source
SKILL.md:77In the instructionsOpen original file
A fresh-context reviewer needs the **artifact** and the **contract**, not the journey.- Code: the diff or the function — not the whole file- Decision: the proposal in 3–5 sentences plus the constraints it has to satisfy- Assertion: the claim plus the evidence that supposedly supports it (kept distinct from the Step 1 CLAIM block, which is the orchestrator's hypothesis under scrutiny)Strip your reasoning. If you hand over conclusions, you'll get back validation of your conclusions. The unit must be small enough that a reviewer can hold it in mind in one read — if it's a 500-line PR, decompose first.
SKILL.md:99In the instructionsOpen original file
Do NOT validate. Do NOT summarize. Find issues, or stateexplicitly that you cannot find any after thorough examination.ARTIFACT: <paste artifact>CONTRACT: <paste contract>```**Pass ARTIFACT + CONTRACT only. Do NOT pass the CLAIM.** Handing the reviewer your conclusion biases it toward agreement. The reviewer must independently determine whether the artifact satisfies the contract.

In interactive sessions, the Skill requires offering cross-model review. Gemini or Codex CLI should be invoked only after the user chooses it and confirms the exact command, authentication, and environment variables. Unauthorized invocation is expressly forbidden in non-interactive contexts.

View source
SKILL.md:116In the instructionsOpen original file
**Interactive sessions: always offer. Never silently skip.****Step 1: Ask the user**After the single-model review in Step 3 above, but before RECONCILE, pause and ask:> *"Single-model review complete. Want a cross-model second opinion? Options: Gemini CLI, Codex CLI, manual external review (you paste it elsewhere), or skip."*This question is mandatory in every interactive doubt cycle — even on artifacts that feel low-stakes. The user — not the agent — decides whether the cost is worth it. The agent's job is to surface the choice.
SKILL.md:128In the instructionsOpen original file
1. Check the tool is in PATH (`which gemini`, `which codex`).2. Test it works (`gemini --version` or equivalent) before passing the full prompt — a stale or broken binary may pass `which` but fail on real input.3. Confirm the exact invocation with the user, including required flags, auth, and env vars (e.g., API keys). Implementations vary; never assume.4. Pass ARTIFACT + CONTRACT + the adversarial prompt **only**. No session context, no CLAIM.5. Mind shell escaping. If the artifact contains quotes, `$(...)`, or backticks, prefer stdin (`echo … | gemini`) or a heredoc over inline `-p "…"`. When in doubt, ask the user to confirm the invocation before running it.6. Take the output into Step 4 (RECONCILE).
SKILL.md:161In the instructionsOpen original file
**Non-interactive contexts** (CI, `/loop`, autonomous-loop, scheduled runs):- Cross-model is **skipped**, and the skip must be **announced** in the output: *"Cross-model skipped: non-interactive context."*- **Never invoke an external CLI without explicit user authorization** — this is a load-bearing safety property.

The Skill does not treat reviewer output as a final verdict: the main session must check and classify each issue against the artifact, and stop when findings are trivial, three cycles are complete, or the user says to ship.

View source
SKILL.md:170In the instructionsOpen original file
The reviewer's output is data, not verdict. **You are still the orchestrator.** Re-read the artifact text against each finding before classifying — rubber-stamping the reviewer is the same failure mode as ignoring it.For each finding, classify in this **precedence order** (first matching class wins):1. **Contract misread** — reviewer flagged something specifically because the CONTRACT you provided was unclear or incomplete. Fix the contract first, re-classify on the next cycle.2. **Valid + actionable** — real issue requiring a change to the artifact. Change it, re-loop.3. **Valid trade-off** — issue is real but cost of fixing exceeds cost of accepting. Document the trade-off explicitly so the user sees it.4. **Noise** — reviewer flagged something that's actually correct under context the reviewer didn't have. Note it, move on, and ask: would adding that context to the contract have prevented the false flag?
SKILL.md:183In the instructionsOpen original file
Stop when:- Next iteration returns only trivial or already-considered findings, **or**- 3 cycles completed (escalate to user, don't grind a fourth alone), **or**- User explicitly says "ship it"If after 3 cycles the reviewer still surfaces substantive issues, the artifact may not be ready. Surface this to the user — three unresolved cycles is information about the artifact, not a reason to keep looping.
Start here · InstructionsSKILL.md
doubt-driven-development
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:139In the instructionsOpen original file
```bash# Write the adversarial prompt + ARTIFACT + CONTRACT to a temp file first.
Lines read
244
File checksum (to compare versions)
2ade8492d86cbe822b6930efd7e7088b95c548cccb372769474ecdc4e72aac4a