FloatSoda: Skill for Claude Code

.agents/skills/phase2-adversarial-review/SKILL.md

phase2-adversarial-review is a skill for Claude Code, Codex from sumx21t-3310/FloatSoda. It costs 191 tokens per session (3,583 once invoked), scanned A, original, MIT.

A final cross-change audit for FloatSoda Phase 2, the stage that ports basic widgets into its Flutter-like system. It checks issues that can span multiple pull requests and requires each accepted finding to include a failing test.

In plain words
What is it for?
Use it after Phase 2 work is complete to inspect merged changes, check the phase checklist and open pull requests, and test cross-cutting failure cases.
Why use it?
Reviewing each pull request separately can miss lifecycle, update, compatibility, or layer-copy problems that appear only when changes interact. Requiring a reproducible red test separates demonstrated defects from speculation.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: installed under .agents/ (shared by several agents); mentions AGENTS.md; mentions Codex.

This is sumx21t-3310/FloatSoda's own configuration. It tells Claude Code and Codex how to work on FloatSoda itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything FloatSoda configures →

Reuse

Borrowing it

Nothing to install: this file belongs to sumx21t-3310/FloatSoda. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/sumx21t-3310/FloatSoda/main/.agents/skills/phase2-adversarial-review/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/sumx21t-3310/FloatSoda

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for phase2-adversarial-review

README.md
[![agentmods](https://agentmods.dev/badge/skills/sumx21t-3310/floatsoda/phase2-adversarial-review/github.svg)](https://agentmods.dev/skills/sumx21t-3310/floatsoda/phase2-adversarial-review)
Your own site
<a href="https://agentmods.dev/skills/sumx21t-3310/floatsoda/phase2-adversarial-review"><img src="https://agentmods.dev/badge/skills/sumx21t-3310/floatsoda/phase2-adversarial-review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for phase2-adversarial-review

Your own site · 80×15
<a href="https://agentmods.dev/skills/sumx21t-3310/floatsoda/phase2-adversarial-review"><img src="https://agentmods.dev/badge/skills/sumx21t-3310/floatsoda/phase2-adversarial-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 191 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 3,583 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00191 $0.03583
Opus 5 $0.00096 $0.01792
Sonnet 5 $0.00038 $0.00717
Haiku 4.5 $0.00019 $0.00358

Measured 12d ago against content hash 0454a60b4e52, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

phase2-adversarial-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/phase2-adversarial-review/SKILL.md · 175 lines

How it starts

The opening of the file, as written. The whole thing — 175 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Phase 2 敵対的監査 — Codex /goal プロンプト生成

Phase 2 の各 PR は入口レビュー(CodeRabbit + PR 単位のレビュー)を通過済み。このスキルはフェーズ末に 1 回、 PR をまたぐ問題を Codex に監査させるための /goal プロンプトを攻撃軸ごとに生成する。

敵対性はプロンプトの口調ではなく受理条件で定義する:

finding は、契約違反を再現する失敗テスト(red test)を添えたものだけ受理する。

これは REVIEW.md 2章の concrete failure mode 基準の機械化であり、「敵対的に」とだけ指示された LLM が hypothetical な指摘を量産する問題への対策でもある。書いてみたら通ってしまったテスト(反証)にも 価値があるので、白判定として報告に残させる。

レビュー層の中での位置づけ

層の分担の正典は REVIEW.md 9章。この監査が報告してはいけないもの:

  • 重要度 7〜8(style / maintainability / 具体的影響のない performance)— 入口レビュー(CodeRabbit)の領分
  • SteamVR 実行時にしか観測できない挙動 — floatsoda-device-test の領分
  • docs の分かりにくさ・API の発見性 — floatsoda-junior-coder-test の領分
  • .agents/skills/floatsoda-device-test/references/known-divergences.mdLabel: deliberate とされ、 かつ差異を固定する Test が設定済みのエントリ(それ以外 — unlabelled / port mistake、および Test: — (not set) のままの deliberate — は、除外どころか parity 軸の検証候補になる)

手順

1. 前提確認

FloatSoda リポジトリで以下を確認する(独立なコマンドは並列で実行してよい):

cd "$USERPROFILE/projects/libs/FloatSoda"
git fetch --all --quiet
git rev-parse --short origin/main
gh issue view 178 --json body -q .body   # Phase 2 チェックリスト → 監査対象インベントリ
gh pr list --state open                  # マージ漏れの Draft PR が残っていないか
  • 監査対象インベントリは #178 のチェックリストのマージ済み項目から作る。未マージの Draft PR が残っている場合は、 その旨をオーナーに報告し、監査を今始めるか PR のマージを待つかを確認する。
  • (任意)入口レビューの残渣回収: #178 の各 Issue に紐づくマージ済み PR を辿り、 gh api "repos/{owner}/{repo}/pulls/<番号>/comments" から coderabbitai[bot] の未対応指摘を抽出する。 「疑われたが検証されていない仮説」の在庫として、該当する軸のプロンプトの「検証候補」に添付する。 やるかどうかはオーナーに確認する。

2. 攻撃軸の分割

軸ごとに独立した Codex セッションを走らせる(コンテキストを集中させ、後半の監査が雑になるのを防ぐ)。 確認項目をこのスキルに複製しない — REVIEW.md が正典で、Codex に直接読ませる。

slug 確認項目の正典
Flutter parity parity REVIEW.md 6章 + docs/APIDesign.md「判断原則」
ツリーライフサイクル lifecycle REVIEW.md 4章「ツリーの所有権とライフサイクル」
差分更新 incremental REVIEW.md 4章「差分更新」
Layer / スレッド layer REVIEW.md 4章「Layer」

ブランチは軸ごとに test/phase2-adversarial-<slug>。新規テストファイルのみ追加させるため、 軸を並行で走らせてもファイル競合しない。並行本数はオーナー判断。

Read the full file on GitHub · 175 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 12d ago First seen · 175 lines · 191 tokens per session scan A 0454a60b4e52

Subscribe to this mod's changes

phase2-adversarial-review is a skill published in the GitHub repository sumx21t-3310/FloatSoda (11 stars, last pushed 2d ago), licensed MIT. It adds 191 tokens to every session and 3,583 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

dotnet-best-practices

Ensure .NET/C# code follows maintainable, modern best practices. Use when reviewing or improving C# code, solution structure, async patterns, dependency injection, or testability.

PracticalSwan/agent-skills · 43 tokens

maintain-discatsharp

Review, modify, test, document, or release the DisCatSharp repository. Use for DisCatSharp source changes, API additions and migrations, Discord payload models, serialization, command synchronization, Gateway dispatch, REST behavior, analyzer work, multi-target testing, DocFX generation, release notes, and repository…

Aiko-IT-Systems/DisCatSharp · 69 tokens

author-test

Generate a test given sample. Parameters: C# SDK repository root; Package name: one of Azure.AI.Projects, Azure.AI.Projects.Agents or Azure.AI.Extensions.OpenAI; the sample to use as a starting point for the test.

Azure/azure-sdk-for-net · 68 tokens

migrate-mstest-v3-to-v4

Use this skill before answering, planning, or editing any MSTest 3.x-to-4.x upgrade or post-upgrade failure. Triggers include "MSTest v4 breaking changes"; CS0507/CS0103/CS1061/CS1615; ExecuteAsync, CallerInfo, DisplayName, or custom TestMethodAttribute; ClassCleanupBehavior; ContainsKey; ThrowsExactly or…

managedcode/dotnet-skills · 179 tokens

migrate-xunit-to-mstest

Convert .NET tests from xUnit.net v2/v3 to MSTest v4 while preserving VSTest or MTP. Use for replacing xunit packages, Fact/Theory/InlineData/MemberData, assertions, IClassFixture/ICollectionFixture, ITestOutputHelper, TestContext cancellation, traits/Owner, skips, timeouts, and xUnit parallelization. Also use when a…

managedcode/dotnet-skills · 141 tokens

migrate-xunit-to-xunit-v3

Migrate .NET test projects from xUnit.net v2 to xunit.v3 and fix v3 breaks. Use for package/CPM conversion, OutputType=Exe, preserving the VSTest or MTP runner (including projects currently using YTest.MTP.XUnit2), incompatible TFMs, async void tests, string-to-Type attributes, custom Fact/Theory/BeforeAfterTest…

managedcode/dotnet-skills · 149 tokens