CoderSkillBLOCK
Evidence-first engineering rules for AI coding agents (Claude Code, Codex, Gemini CLI): one reviewed skill set, hooks that enforce the critical rules, signed updates, safe GitHub flow.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
One set of reviewed, evidence-first engineering rules for AI coding agents, with hooks that enforce the critical ones. CoderSkill works with Claude Code, Codex and Gemini CLI.
[](https://github.com/droltr/CoderSkill/actions/workflows/validate.yml) [](https://github.com/droltr/CoderSkill/actions/workflows/codeql.yml) [](LICENSE)
What it does
- Makes agents verify before they claim. Every statement is either backed by a source or a
command output, or labelled unverified. A negative control comes before any positive result.
- Runs a complete, professional workflow. Research, clarify, plan, implement, verify, test,
record, pull request, carried through without "should I continue?" stops.
- Keeps `main` safe. Work happens on issue-linked topic branches with signed commits; the agent
opens the pull request and you merge. Hooks deny merges and pushes to main in any spelling.
- Protects secrets, personal data and hardware. Private records stay in a local
.private/
folder, commits with secrets are blocked, and hardware writes need fresh approval.
- Keeps every agent on the same reviewed rules. Agents install updates only from the signed
main, are told when a new version arrives, and cannot edit their installed copies.
Why
AI agents are fast, but left alone they report unverified results as facts, push or merge their own work, leak private data into public repositories, and behave differently in each tool. CoderSkill turns the lessons from those failures into one maintained policy and puts the critical parts where an agent cannot skip them: in hooks that the tool and git run themselves.
Quick start
git clone https://github.com/droltr/CoderSkill.git cd CoderSkill
b9a197e5ffb1OBSERVED · 2026-10-11Install
Commands as the repository documents them. They are shown, not run.
git clone https://github.com/droltr/CoderSkill.git
git clone https://github.com/droltr/CoderSkill.git
Host compatibility
What the documentation claims. We have not run a compatibility test.
| Host | Status | Notes |
|---|---|---|
| claude-code | mentioned | |
| codex | mentioned | |
| gemini-cli | mentioned |
What it tells the agent
The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.
--- name: code-quality-review description: Perform a focused, read-only professional code-quality review for correctness, clarity, maintainability, architecture fit, tests, and documentation. Use when the user asks whether code is professionally written or requests a code review; do not run full security or GitHub governance workflows unless requested. --- # Code Quality Review Review the requested code or diff without modifying it. A request to check, review, or assess does not authorize fixes, dependency installation, commits, pushes, or remote changes. All first-party code, identifiers, comments, documentation, and publishable review artifacts must use clear, concise, professional English. Communicate with the user in the operating system's language (the locale reported at session start; if none is set, the language the user writes in); everything in the repository is English: source code, identifiers, project and repository names, descriptions, documentation, commits, branches, issues, and pull requests. ## Review criteria - Correctness, edge cases, error handling, resource lifetime, concurrency, and data integrity. - Fit with existing architecture and established project conventions. - Simplicity, naming, cohesion, coupling, duplication, and unnecessary abstraction. - API clarity, compatibility, configuration behavior, observability, and failure diagnostics. - Test value, coverage of meaningful behavior, determinism, isolation, and missing regressions. - Documentation accuracy, project purpose, platform/device constraints, safety, and rollback guidance. - Performance only where evidence or task constraints make it material. Do not turn style preference into a defect. Prioritize concrete behavioral and maintenance impact. Mention security only when a visible defect is relevant; route a systematic security review to `security-audit`. ## Output Lead with actionable findings ordered by impact. Include file/line evidence, consequence, and a focused recommendation. Then provide assumptions, validation gaps, and a short overall assessment. If no finding is present, state what was reviewed and what remains unverified.
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (8)
- When an untrusted-commit warning appears, do not install; tell the user.
- When an untrusted-commit warning appears, do not install; tell the user.
- When an untrusted-commit warning appears, do not install; tell the user.
- When an untrusted-commit warning appears, do not install; tell the user.
- Authentication/access status without credential values.
- Authentication/access status without credential values.
- Authentication/access status without credential values.
- Authentication/access status without credential values.
Gates applied: instruction_override, no_behavioural_pass.
b9a197e5ffb1full audit observations/trust-audit/skill/droltr__coderskill.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | b9a197e5ffb1 | BLOCK | D | 69 | first audit |
Questions
What does the CoderSkill skill do?
Evidence-first engineering rules for AI coding agents (Claude Code, Codex, Gemini CLI): one reviewed skill set, hooks that enforce the critical rules, signed updates, safe GitHub flow.
Is CoderSkill safe to install?
No — not without reading the findings first. The audit graded it D (69/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What can CoderSkill access on my machine?
The audit observed that it reaches the network and reads or writes files. Each of those is consistent with what it says it does. Secrets in the source: none found.
Which assistants does CoderSkill work with?
Its documentation mentions claude-code, codex and gemini-cli. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (b9a197e5ffb1), read on 2026-10-11. The repository is watched, and a new audit runs when it changes — this is the first audit.