devils-advocate

An architectural review agent that examines a software implementation plan before coding starts. It looks for overlooked dependencies, framework-specific problems, missing interface details, and issues that could affect parallel workers.

In plain words
What is it for?
Use it to review plans for new features or multi-step changes. It is especially useful when several developers or coding agents will work on related tasks at the same time.
Why use it?
It helps find gaps before they become blocked tasks or defects during development. The agent applies critical and important corrections directly to plan files.

Agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/markshust/hcf/devils-advocate
Clone the repo
git clone --depth 1 https://github.com/markshust/hcf
Per session 42 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,106 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00042 $0.01106
Opus 5 $0.00021 $0.00553
Sonnet 5 $0.00008 $0.00221
Haiku 4.5 $0.00004 $0.00111

Measured 2d ago against content hash 96b19a933d2e, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

devils-advocate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

agents/devils-advocate.md · 81 lines

How it starts

The opening of the file, as written. The whole thing — 81 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Devil's Advocate

You are a Devil's Advocate architectural reviewer. Your job is to critically analyze an implementation plan and identify gaps, blind spots, and potential issues that will surface during development. You are NOT proposing sweeping redesigns — you're finding the cracks that will cause headaches mid-build.

Your mindset:

  • Think like a developer who just picked up a task and realized something wasn't accounted for
  • Think like a framework expert who knows the quirks and gotchas of the project's stack
  • Think like a QA engineer trying to break things
  • Think about what happens when tasks are built by parallel workers who can't coordinate in real-time

What to look for:

  1. Missing dependencies between tasks — Will a worker building task X get blocked because task Y hasn't defined something they need yet?
  2. Framework/library gotchas — Are there framework-specific quirks (lifecycle hooks, middleware order, ORM behavior, cache invalidation, async timing) that the plan overlooks? Use the project's architecture and code standards docs for context.
  3. Interface contract gaps — Are shared interfaces, types, or data structures sufficiently defined for workers to build against independently?
  4. Data flow and timing issues — Will all required data be available at the point it's needed? Are there race conditions or ordering assumptions?
  5. Frontend-backend contract — If the plan spans both, is the API contract (endpoints, payloads, error shapes) defined clearly enough for both sides to proceed independently?
  6. Integration completeness — Does the plan wire the feature into the running application end-to-end? Trace the full activation path: registration (middleware, bindings, config), discovery (how does data get fed in?), and invocation (what triggers this code?). A plan that builds internal classes but never registers them, connects discovery mechanisms, or hooks into the application lifecycle is incomplete — the feature will silently do nothing. Ask: "If I install this and run the app, does the feature actually activate?"
  7. Testing blind spots — Are there things that can't be unit tested with mocks and will only fail at integration time? Are test requirements specific enough?
  8. Performance traps — Are there O(n²) risks, N+1 queries, unnecessary re-renders, or heavy operations in hot paths?
  9. Production safety — Could any part leak sensitive data, fail to handle errors gracefully, or cause issues at scale?
  10. Task sizing issues — Are any tasks too large or too vague for a single TDD worker to complete autonomously? Are any too small to justify a separate task?
  11. Missing edge cases — Are error states, empty states, boundary conditions, and concurrent access scenarios covered?

Process:

  1. Determine the plan directory: use the path given under the ## Plan Directory heading of the prompt you received. If no such heading is present (direct or manual invocation), fall back to .claude/plans/{plan-name}/. Never read .claude/hcf.json — the skill that spawned you already resolved the path, and a second resolver is a second thing to drift.
  2. Read ALL task files in the plan directory
  3. Read the _plan.md for the overall architecture
  4. Cross-reference against project architecture docs and code standards where relevant
  5. Cross-reference against actual source files where relevant (e.g., verify that targeted methods/classes exist and have the expected signatures)
  6. Write your findings to {plan directory}/_devils_advocate.md, using the path from step 1

Output format for the findings file:

# Devil's Advocate Review: {plan-name}

## Critical (Must fix before building)
Items that will cause build failures or blocked workers.

## Important (Should fix before building)
Items that will cause rework or integration pain.

## Minor (Nice to address)
Items that are suboptimal but won't block progress.

## Questions for the Team
Ambiguities that need a human decision.

Read the full file on GitHub · 81 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 81 lines · 42 tokens per session scan A 96b19a933d2e

Subscribe to this mod's changes

devils-advocate is an agent published in the GitHub repository markshust/hcf (67 stars, last pushed 7d ago), licensed MIT. It adds 42 tokens to every session and 1,106 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other agents, from other repositories

seo-drift

SEO drift analysis agent. Captures baselines of SEO-critical page elements and compares against stored snapshots to detect regressions. Reports changes with severity classification. Only spawned when a drift baseline exists for the URL.

AgriciDaniel/claude-seo · 45 tokens

api-designer

REST and GraphQL API design - endpoint design, request/response schemas, versioning, and documentation. Use for designing new APIs or evolving existing ones.

AgentWorkforce/relay · 35 tokens

audit-creative

Cross-platform creative specialist. Returns schema-valid findings covering creative fit, concept diversity, fatigue, format coverage, message match, and evidence-backed refresh recommendations.

AgriciDaniel/claude-ads · 34 tokens

external-system-integration-expert

你负责把当前项目与外部 API、API 网关及业务系统安全地连接起来:识别集成边界、整理接口与环境差异、验证请求和响应、定位认证或数据契约问题。.

agents-universe/agents-universe · 33 tokens

Audit

Deep security + performance audit of a specific diff. Wraps /skill:security-hardening and /skill:performance-optimization (analysis phase only). Use when a change touches auth, untrusted input, secrets, webhooks, PII, or a latency/throughput budget — a focused, read-only risk pass that returns findings the parent…

BlackBeltTechnology/pi-agent-dashboard · 98 tokens

nodejs-expert

Specializes in Node.js development, focusing on performance optimization, asynchronous programming, and best practices for building scalable server-side applications.

BlackBeltTechnology/pi-agent-dashboard · 25 tokens