Agent skill · Audited from source
domain-modeling
skill · mattpocock/skillsMIT licenceAudited 31 Oct 2026 · source dcb0b8cc0e4d
Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit dcb0b8cc0e4d and found no filesystem, network or shell access and no hard-coded secrets. What it does: Build and sharpen a project's domain model. Use when discussing codebase terminology, writing or editing a GLOSSARY.md, or recording or editing an ADR.
Cite
Cite this page
ModelsAtlas. “domain-modeling (mattpocock/skills)”. Retrieved 31 Oct 2026. https://modelsatlas.com/skills/mattpocock/domain-modeling
2 skills are called “domain-modeling”. You are viewing mattpocock/skills.
- mattpocock/skills★ 308k✓SAFE
- vinvcn/mattpocock-skills-zh-cn★ 5.4k✓SAFE
Trust audit
Audit 0.4.1 · source read 31 Oct 2026
SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 16,667 of 17,602 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 1 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | NA | 0 |
L2 Instructions | Prompt injection, authority framing, hidden directives | PASS | 0 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (1)
LOWInventory / provenanceinv.symlink · AGENTS.md
AGENTS.md
- Why
- link not followed
- Fix
- —
Audit 0.4.1 · source sha dcb0b8cc0e4d · 31 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publishermattpocock GitHub userOwner of the repository this skill is read from
- Source foldermattpocock/skills/skills/engineering/domain-modelingThe exact folder we audited
- LicenceMITAs the repository states it
- Commit pinned for this verdictdcb0b8cc0e4dA new audit runs when the source changes
- Repository statusNot archivedPushed today
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Build and sharpen a project's domain model. Use when discussing codebase terminology, writing or editing a GLOSSARY.md, or recording or editing an ADR.
--- name: domain-modeling description: Build and sharpen a project's domain model. Use when discussing codebase terminology, writing or editing a GLOSSARY.md, or recording or editing an ADR. --- # Domain Modeling Actively build and sharpen the project's domain model as you design. This is the *active* discipline: challenging terms, inventing edge-case scenarios, and writing the glossary and decisions down the moment they crystallise. (Merely *reading* `GLOSSARY.md` for vocabulary is not this skill: that's a one-line habit any skill can do. This skill is for when you're changing the model, not just consuming it.) ## File structure Most repos have a single context: ``` / ├── GLOSSARY.md ├── docs/ │ └── adr/ │ ├── 0001-event-sourced-orders.md │ └── 0002-postgres-for-write-model.md └── src/ ``` If a `GLOSSARY-MAP.md` exists at the root, the repo has multiple contexts. The map points to where each one lives: ``` / ├── GLOSSARY-MAP.md ├── docs/ │ └── adr/ ← system-wide decisions ├── src/ │ ├── ordering/ │ │ ├── GLOSSARY.md │ │ └── docs/adr/ ← context-specific decisions │ └── billing/ │ ├── GLOSSARY.md │ └── docs/adr/ ``` Create files lazily: only when you have something to write. If no `GLOSSARY.md` exists, create one when the first term is resolved. If no `docs/adr/` exists, create it when the first ADR is needed. ## During the session ### Challenge against the glossary When the user uses a term that conflicts with the existing language in `GLOSSARY.md`, call it out immediately. "Your glossary defines 'cancellation' as X, but you seem to mean Y. Which is it?" ### Sharpen fuzzy language When the user uses vague or overloaded terms, propose a precise canonical term. "You're saying 'account': do you mean the Customer or the User? Those are different things." ### Discuss concrete scenarios When domain relationships are being discussed, stress-test them with specific scenarios. Invent scenarios that probe edge cases and force the user to be precise about the boundaries between concepts. ### Cross-reference with code When the user states how something works, check whether the code agrees. If you find a contradiction, surface it: "Your code cancels entire Orders, but you just said partial cancellation is possible. Which is right?" ### Update GLOSSARY.md inline When a term is resolved, update `GLOSSARY.md` right there. Don't batch these up: capture them as they happen. Use the format in [GLOSSARY-FORMAT.md](./GLOSSARY-FORMAT.md). `GLOSSARY.md` should be totally devoid of implementation details. Do not treat `GLOSSARY.md` as a spec, a scratch pad, or a repository for implementation decisions. It is a glossary and nothing else. ### Offer ADRs sparingly Only offer to create an ADR when all three are true: 1. **Hard to reverse**: the cost of changing your mind later is meaningful 2. **Surprising without context**: a future reader will wonder "why did they do it this way?" 3. **The result of a real trade-off**: there were genuine alternatives and you picked one for specific reasons If any of the three is missing, skip the ADR. Use the format in [ADR-FORMAT.md](./ADR-FORMAT.md).
Excerpt, first 3,221 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit dcb0b8c
git clone https://github.com/mattpocock/skills git -C skills checkout dcb0b8cc0e4d
The author documents no install command, so this uses the repository directly. Our verdict covers commit dcb0b8cc0e4d only.
Works in
The author has not said which agents this skill supports, and we have not tested it in any.
Audit history
Every audit, every source change
- ✓SAFE B 89 / 100
first audit · source
dcb0b8cc0e4d
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/mattpocock/domain-modeling/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
obra/superpowers
Use when creating new skills, editing existing skills, or verifying skills work before deployment
mattpocock/skills
A relentless interview to sharpen a plan or design, which also creates docs (ADR's and glossary) as we go.
mattpocock/skills
Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.
Add this badge to your README
[](https://modelsatlas.com/skills/mattpocock/domain-modeling/)
<a href="https://modelsatlas.com/skills/mattpocock/domain-modeling/"><img src="https://modelsatlas.com/skills/mattpocock/domain-modeling/badge.svg" alt="ModelsAtlas: SAFE B"></a>
Questions about domain-modeling
What does the domain-modeling skill do?
Is domain-modeling safe to install?
What can domain-modeling access on my machine?
How current is this page?
Sources
- github.com/mattpocock/skills/tree/main/skills/engineering/domain — the audited source at commit dcb0b8cc0e4d and every finding aboveObserved · 31 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the domain-modeling skill do?
- Is domain-modeling safe to install?
- What can domain-modeling access on my machine?