Borrowing it
Nothing to install: this file belongs to sumx21t-3310/FloatSoda. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/sumx21t-3310/FloatSoda/main/.agents/skills/phase2-adversarial-review/SKILL.mdgit clone --depth 1 https://github.com/sumx21t-3310/FloatSodaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sumx21t-3310/floatsoda/phase2-adversarial-review)<a href="https://agentmods.dev/skills/sumx21t-3310/floatsoda/phase2-adversarial-review"><img src="https://agentmods.dev/badge/skills/sumx21t-3310/floatsoda/phase2-adversarial-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sumx21t-3310/floatsoda/phase2-adversarial-review"><img src="https://agentmods.dev/badge/skills/sumx21t-3310/floatsoda/phase2-adversarial-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00191 | $0.03583 |
| Opus 5 | $0.00096 | $0.01792 |
| Sonnet 5 | $0.00038 | $0.00717 |
| Haiku 4.5 | $0.00019 | $0.00358 |
Grade A, and why
phase2-adversarial-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 175 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Phase 2 敵対的監査 — Codex /goal プロンプト生成
Phase 2 の各 PR は入口レビュー(CodeRabbit + PR 単位のレビュー)を通過済み。このスキルはフェーズ末に 1 回、 PR をまたぐ問題を Codex に監査させるための /goal プロンプトを攻撃軸ごとに生成する。
敵対性はプロンプトの口調ではなく受理条件で定義する:
finding は、契約違反を再現する失敗テスト(red test)を添えたものだけ受理する。
これは REVIEW.md 2章の concrete failure mode 基準の機械化であり、「敵対的に」とだけ指示された LLM が hypothetical な指摘を量産する問題への対策でもある。書いてみたら通ってしまったテスト(反証)にも 価値があるので、白判定として報告に残させる。
レビュー層の中での位置づけ
層の分担の正典は REVIEW.md 9章。この監査が報告してはいけないもの:
- 重要度 7〜8(style / maintainability / 具体的影響のない performance)— 入口レビュー(CodeRabbit)の領分
- SteamVR 実行時にしか観測できない挙動 —
floatsoda-device-testの領分 - docs の分かりにくさ・API の発見性 —
floatsoda-junior-coder-testの領分 .agents/skills/floatsoda-device-test/references/known-divergences.mdでLabel: deliberateとされ、 かつ差異を固定するTestが設定済みのエントリ(それ以外 — unlabelled / port mistake、およびTest: — (not set)のままの deliberate — は、除外どころか parity 軸の検証候補になる)
手順
1. 前提確認
FloatSoda リポジトリで以下を確認する(独立なコマンドは並列で実行してよい):
cd "$USERPROFILE/projects/libs/FloatSoda"
git fetch --all --quiet
git rev-parse --short origin/main
gh issue view 178 --json body -q .body # Phase 2 チェックリスト → 監査対象インベントリ
gh pr list --state open # マージ漏れの Draft PR が残っていないか
- 監査対象インベントリは #178 のチェックリストのマージ済み項目から作る。未マージの Draft PR が残っている場合は、 その旨をオーナーに報告し、監査を今始めるか PR のマージを待つかを確認する。
- (任意)入口レビューの残渣回収: #178 の各 Issue に紐づくマージ済み PR を辿り、
gh api "repos/{owner}/{repo}/pulls/<番号>/comments"からcoderabbitai[bot]の未対応指摘を抽出する。 「疑われたが検証されていない仮説」の在庫として、該当する軸のプロンプトの「検証候補」に添付する。 やるかどうかはオーナーに確認する。
2. 攻撃軸の分割
軸ごとに独立した Codex セッションを走らせる(コンテキストを集中させ、後半の監査が雑になるのを防ぐ)。 確認項目をこのスキルに複製しない — REVIEW.md が正典で、Codex に直接読ませる。
| 軸 | slug | 確認項目の正典 |
|---|---|---|
| Flutter parity | parity |
REVIEW.md 6章 + docs/APIDesign.md「判断原則」 |
| ツリーライフサイクル | lifecycle |
REVIEW.md 4章「ツリーの所有権とライフサイクル」 |
| 差分更新 | incremental |
REVIEW.md 4章「差分更新」 |
| Layer / スレッド | layer |
REVIEW.md 4章「Layer」 |
ブランチは軸ごとに test/phase2-adversarial-<slug>。新規テストファイルのみ追加させるため、
軸を並行で走らせてもファイル競合しない。並行本数はオーナー判断。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 175 lines · 191 tokens per session scan A 0454a60b4e52
phase2-adversarial-review is a skill published in the GitHub repository sumx21t-3310/FloatSoda (11 stars, last pushed 2d ago), licensed MIT. It adds 191 tokens to every session and 3,583 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dotnet-best-practices
Ensure .NET/C# code follows maintainable, modern best practices. Use when reviewing or improving C# code, solution structure, async patterns, dependency injection, or testability.
maintain-discatsharp
Review, modify, test, document, or release the DisCatSharp repository. Use for DisCatSharp source changes, API additions and migrations, Discord payload models, serialization, command synchronization, Gateway dispatch, REST behavior, analyzer work, multi-target testing, DocFX generation, release notes, and repository…
author-test
Generate a test given sample. Parameters: C# SDK repository root; Package name: one of Azure.AI.Projects, Azure.AI.Projects.Agents or Azure.AI.Extensions.OpenAI; the sample to use as a starting point for the test.
migrate-mstest-v3-to-v4
Use this skill before answering, planning, or editing any MSTest 3.x-to-4.x upgrade or post-upgrade failure. Triggers include "MSTest v4 breaking changes"; CS0507/CS0103/CS1061/CS1615; ExecuteAsync, CallerInfo, DisplayName, or custom TestMethodAttribute; ClassCleanupBehavior; ContainsKey; ThrowsExactly or…
migrate-xunit-to-mstest
Convert .NET tests from xUnit.net v2/v3 to MSTest v4 while preserving VSTest or MTP. Use for replacing xunit packages, Fact/Theory/InlineData/MemberData, assertions, IClassFixture/ICollectionFixture, ITestOutputHelper, TestContext cancellation, traits/Owner, skips, timeouts, and xUnit parallelization. Also use when a…
migrate-xunit-to-xunit-v3
Migrate .NET test projects from xUnit.net v2 to xunit.v3 and fix v3 breaks. Use for package/CPM conversion, OutputType=Exe, preserving the VSTest or MTP runner (including projects currently using YTest.MTP.XUnit2), incompatible TFMs, async void tests, string-to-Type attributes, custom Fact/Theory/BeforeAfterTest…