Home / addyosmani / agent-skills
AI Slop Code RIsk Monitor

addyosmani/agent-skills

Production-grade engineering skills for AI coding agents.

14.1 Moderate pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for addyosmani/agent-skills, a JavaScript project with 104,501 GitHub stars. SynthScan examined 22,443 lines of code across 158 source files, recording 134 pattern matches distributed across 6 syntactic categories. The legacy adjusted pattern signal is 14.1 (Moderate pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

14.1
Adjusted Signal
14.1
Raw Pattern Score
100%
Time Factor
2026-10-10
Last Push
104.5K
Stars
JavaScript
Language
22.4K
Lines of Code
158
Files
134
Pattern Hits
2026-10-12
Scan Date
0.00
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 20.8/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 68 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.2/100 · LOW

Are imports declared and package/API names verified? 1 finding(s).

Agent Over-Engineering Ratio 37.6/100 · MEDIUM

Are wrappers, guards, and repeated structures necessary? 65 finding(s).

PR Review Velocity Impact 45.2/100 · MEDIUM

Which changes need focused human review? 134 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 68LOW 66

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 134 distinct pattern matches across 6 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Decorative Section Separators65 hits · 212 pts
SeverityFileLineSnippetContext
MEDIUMhooks/sdd-cache-test.sh26# ── curl stub ─────────────────────────────────────────────────────────────COMMENT
MEDIUM⚡hooks/sdd-cache-test.sh102# ── Test 1: pre — no url in input lets WebFetch proceed ───────────────────COMMENT
MEDIUM⚡hooks/sdd-cache-test.sh108# ── Test 2: pre — malformed JSON input is not fatal ───────────────────────COMMENT
MEDIUM⚡hooks/sdd-cache-test.sh114# ── Test 3: pre — no cache entry lets WebFetch proceed ────────────────────COMMENT
MEDIUM⚡hooks/sdd-cache-test.sh120# ── Test 4: pre — entry without validators is never served ────────────────COMMENT
MEDIUM⚡hooks/sdd-cache-test.sh127# ── Test 5: pre — non-304 status lets WebFetch proceed ────────────────────COMMENT
MEDIUM⚡hooks/sdd-cache-test.sh134# ── Test 6: pre — network failure lets WebFetch proceed ───────────────────COMMENT
MEDIUM⚡hooks/sdd-cache-test.sh141# ── Test 7: pre — 304 serves cached content byte-exactly ──────────────────COMMENT
MEDIUM⚡hooks/sdd-cache-test.sh158# ── Test 8: pre — empty content field bypasses even on 304 ────────────────COMMENT
MEDIUM⚡hooks/sdd-cache-test.sh165# ── Test 9: post — no url in input writes nothing ─────────────────────────COMMENT
MEDIUM⚡hooks/sdd-cache-test.sh172# ── Test 10: post — unknown tool_response shape writes nothing ────────────COMMENT
MEDIUM⚡hooks/sdd-cache-test.sh180# ── Test 11: post — caches when the origin provides an ETag ───────────────COMMENT
MEDIUMhooks/sdd-cache-test.sh196# ── Test 12: post — string-shaped tool_response is accepted ───────────────COMMENT
MEDIUMhooks/sdd-cache-test.sh206# ── Test 13: post — origin without validators removes stale entry ─────────COMMENT
MEDIUMhooks/sdd-cache-test.sh217# ── Test 14: post — validators taken from final response block ────────────COMMENT
MEDIUMhooks/sdd-cache-test.sh230# ── Test 15: round-trip — post writes, pre serves the same bytes ──────────COMMENT
MEDIUMhooks/sdd-cache-test.sh243# ── Summary ──────────────────────────────────────────────────────────────COMMENT
MEDIUMhooks/simplify-ignore.sh256# ── Stop: expand each cached file in place, backup only as fallback ──────────COMMENT
MEDIUMhooks/simplify-ignore.sh311# ── PreToolUse Read: filter in-place ──────────────────────────────────────────COMMENT
MEDIUMhooks/simplify-ignore.sh353# ── PostToolUse Edit|Write: expand, then re-filter ────────────────────────────COMMENT
MEDIUMhooks/simplify-ignore-test.sh49# ── Test 1: Single-line block produces exactly one placeholder ────────────COMMENT
MEDIUMhooks/simplify-ignore-test.sh77# ── Test 2: Multi-line block ─────────────────────────────────────────────COMMENT
MEDIUMhooks/simplify-ignore-test.sh101# ── Test 3: Multiple blocks in one file ──────────────────────────────────COMMENT
MEDIUMhooks/simplify-ignore-test.sh128# ── Test 4: Reason string preserved ──────────────────────────────────────COMMENT
MEDIUMhooks/simplify-ignore-test.sh149# ── Test 5: Trailing newline preservation ────────────────────────────────COMMENT
MEDIUMhooks/simplify-ignore-test.sh165# ── Test 6: No blocks → return 1 ────────────────────────────────────────COMMENT
MEDIUMhooks/simplify-ignore-test.sh181# ── Test 7: Unclosed block emits warning and flushes ─────────────────────COMMENT
MEDIUMhooks/simplify-ignore-test.sh198# ── Test 8: Single-line block with reason ────────────────────────────────COMMENT
MEDIUMhooks/simplify-ignore-test.sh217# ── Test 9: HTML comment syntax ──────────────────────────────────────────COMMENT
MEDIUMhooks/simplify-ignore-test.sh238# ── Test 10: JSON parsing error warning ──────────────────────────────────COMMENT
MEDIUMhooks/simplify-ignore-test.sh250# ── Test 11: Stop keeps a change made outside Edit|Write ─────────────────COMMENT
MEDIUMhooks/simplify-ignore-test.sh294# ── Test 12: Stop fallback keeps the rewrite in the cache ───────────────COMMENT
MEDIUMhooks/simplify-ignore-test.sh334# ── Test 13: Read → direct write with no event → Stop ───────────────────COMMENT
MEDIUMhooks/simplify-ignore-test.sh370# ── Tests 14-16: full-lifecycle round-trip fidelity ──────────────────────COMMENT
MEDIUMhooks/simplify-ignore-test.sh390# ── Test 14: Read → Stop restores the file byte-identically ──────────────COMMENT
MEDIUMhooks/simplify-ignore-test.sh418# ── Test 15: Round-trip preserves missing trailing newline ────────────────COMMENT
MEDIUMhooks/simplify-ignore-test.sh434# ── Test 16: Read → model edit → Edit event → Stop keeps the edit ────────COMMENT
MEDIUMhooks/simplify-ignore-test.sh523# ── Summary ──────────────────────────────────────────────────────────────COMMENT
MEDIUMscripts/validate-skills.js25// ─── Main ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMscripts/validate-skills.js58 // ── Personas ─────────────────────────────────────────────────────────────COMMENT
MEDIUMscripts/validate-commands.js35// ─── Config ───────────────────────────────────────────────────────────────────COMMENT
MEDIUMscripts/validate-commands.js54// ─── Parsers ──────────────────────────────────────────────────────────────────COMMENT
MEDIUMscripts/validate-commands.js78// ─── Loader ───────────────────────────────────────────────────────────────────COMMENT
MEDIUMscripts/validate-commands.js99// ─── Main ─────────────────────────────────────────────────────────────────────COMMENT
MEDIUMscripts/validate-commands.js122 // ── Parity check ────────────────────────────────────────────────────────────COMMENT
MEDIUMscripts/validate-commands.js148 // ── Claude frontmatter validity ─────────────────────────────────────────────COMMENT
MEDIUMscripts/validate-commands.js174 // ── Description sync check ──────────────────────────────────────────────────COMMENT
MEDIUMscripts/validate-artifact-paths-test.js118// ─── Every command surface is guarded, not only the Claude Code copy ────────COMMENT
MEDIUMscripts/lib/skill-lint.js29// ─── Config ──────────────────────────────────────────────────────────────────COMMENT
MEDIUMscripts/lib/skill-lint.js108// ─── Helpers ─────────────────────────────────────────────────────────────────COMMENT
MEDIUMscripts/lib/skill-lint.js343// ─── Linter ──────────────────────────────────────────────────────────────────COMMENT
MEDIUMscripts/lib/skill-lint.js355 // ── Frontmatter ──────────────────────────────────────────────────────────COMMENT
MEDIUMscripts/lib/skill-lint.js408 // ── Exemption guard ──────────────────────────────────────────────────────COMMENT
MEDIUMscripts/lib/skill-lint.js422 // ── Required sections ────────────────────────────────────────────────────COMMENT
MEDIUMscripts/lib/skill-lint.js466 // ── Context budget ───────────────────────────────────────────────────────COMMENT
MEDIUMscripts/lib/skill-lint.js477 // ── Cross-skill references ───────────────────────────────────────────────COMMENT
MEDIUMscripts/lib/skill-lint-test.js57// ─── Section exemptions ──────────────────────────────────────────────────────COMMENT
MEDIUMscripts/lib/skill-lint-test.js106// ─── Guardrails on the rules this change sits beside ─────────────────────────COMMENT
MEDIUMscripts/lib/skill-lint-test.js178// ─── Fenced-block stripping (#437) ───────────────────────────────────────────COMMENT
MEDIUMscripts/lib/skill-lint-test.js178// ─── Fenced-block stripping (#437) ───────────────────────────────────────────COMMENT
5 more matches not shown…
Structural Annotation Overuse58 hits · 89 pts
SeverityFileLineSnippetContext
LOWscripts/lib/skill-lint-test.js158 '### Step 1: Measure',CODE
LOWskills/debugging-and-error-recovery/SKILL.md40### Step 1: ReproduceCOMMENT
LOWskills/debugging-and-error-recovery/SKILL.md87### Step 2: LocalizeCOMMENT
LOWskills/debugging-and-error-recovery/SKILL.md111### Step 3: ReduceCOMMENT
LOWskills/debugging-and-error-recovery/SKILL.md121### Step 4: Fix the Root CauseCOMMENT
LOWskills/debugging-and-error-recovery/SKILL.md138### Step 5: Guard Against RecurrenceCOMMENT
LOWskills/debugging-and-error-recovery/SKILL.md154### Step 6: Verify End-to-EndCOMMENT
LOWskills/test-driven-development/SKILL.md49### Step 1: RED — Write a Failing TestCOMMENT
LOWskills/test-driven-development/SKILL.md67### Step 2: GREEN — Make It PassCOMMENT
LOWskills/test-driven-development/SKILL.md85### Step 3: REFACTOR — Clean UpCOMMENT
LOW⚡skills/test-driven-development/SKILL.md124// Step 1: Write the reproduction test (it should FAIL)COMMENT
LOW⚡skills/test-driven-development/SKILL.md133// Step 2: Fix the bugCOMMENT
LOW⚡skills/test-driven-development/SKILL.md141// Step 3: Test passes → bug fixed, regression guardedCOMMENT
LOWskills/planning-and-task-breakdown/SKILL.md24### Step 1: Enter Plan ModeCOMMENT
LOWskills/planning-and-task-breakdown/SKILL.md35### Step 2: Identify the Dependency GraphCOMMENT
LOWskills/planning-and-task-breakdown/SKILL.md57### Step 3: Slice VerticallyCOMMENT
LOWskills/planning-and-task-breakdown/SKILL.md79### Step 4: Write TasksCOMMENT
LOWskills/planning-and-task-breakdown/SKILL.md106### Step 5: Order and CheckpointCOMMENT
LOWskills/constraint-driven-development/SKILL.md42### Step 1: Detect before you askCOMMENT
LOWskills/constraint-driven-development/SKILL.md57### Step 2: Four questions, each with a defaultCOMMENT
LOWskills/constraint-driven-development/SKILL.md93### Step 3: Write CONSTRAINTS.mdCOMMENT
LOWskills/constraint-driven-development/SKILL.md142### Step 4: Install what each dimension needsCOMMENT
LOWskills/constraint-driven-development/SKILL.md186### Step 5: Wire it to the lifecycleCOMMENT
LOWskills/constraint-driven-development/SKILL.md202### Step 6: Guard the bar itselfCOMMENT
LOWskills/constraint-driven-development/SKILL.md226### Step 7: Ratchets, when you don't have a numberCOMMENT
LOWskills/code-review-and-quality/SKILL.md142### Step 1: Understand the ContextCOMMENT
LOWskills/code-review-and-quality/SKILL.md152### Step 2: Review the Tests FirstCOMMENT
LOWskills/code-review-and-quality/SKILL.md166### Step 3: Review the ImplementationCOMMENT
LOWskills/code-review-and-quality/SKILL.md179### Step 4: Categorize FindingsCOMMENT
LOWskills/code-review-and-quality/SKILL.md195### Step 5: Verify the VerificationCOMMENT
LOWskills/deprecation-and-migration/SKILL.md69### Step 1: Build the ReplacementCOMMENT
LOWskills/deprecation-and-migration/SKILL.md77### Step 2: Announce and DocumentCOMMENT
LOWskills/deprecation-and-migration/SKILL.md94### Step 3: Migrate IncrementallyCOMMENT
LOWskills/deprecation-and-migration/SKILL.md108### Step 4: Remove the Old SystemCOMMENT
LOWskills/interview-me/SKILL.md40### Step 1: Hypothesize, with a confidence numberCOMMENT
LOWskills/interview-me/SKILL.md53### Step 2: Ask one question at a time, each with a guess attachedCOMMENT
LOWskills/interview-me/SKILL.md79### Step 3: Listen for "want vs. should want"COMMENT
LOWskills/interview-me/SKILL.md94### Step 4: Restate intent in the user's own wordsCOMMENT
LOWskills/interview-me/SKILL.md113### Step 5: Confirm — explicit yes, not "whatever you think"COMMENT
LOWskills/interview-me/SKILL.md124### Step 6: Terminal Turn & Stop Rule (CRITICAL)COMMENT
LOWskills/code-simplification/SKILL.md107### Step 1: Understand Before Touching (Chesterton's Fence)COMMENT
LOWskills/code-simplification/SKILL.md123### Step 2: Identify Simplification OpportunitiesCOMMENT
LOWskills/code-simplification/SKILL.md157### Step 3: Apply Changes IncrementallyCOMMENT
LOWskills/code-simplification/SKILL.md173### Step 4: Verify the ResultCOMMENT
LOWskills/doubt-driven-development/SKILL.md62### Step 1: CLAIM — Surface what standsCOMMENT
LOWskills/doubt-driven-development/SKILL.md75### Step 2: EXTRACT — Smallest reviewable unitCOMMENT
LOWskills/doubt-driven-development/SKILL.md85### Step 3: DOUBT — Invoke the fresh-context reviewerCOMMENT
LOWskills/doubt-driven-development/SKILL.md168### Step 4: RECONCILE — Fold findings backCOMMENT
LOWskills/doubt-driven-development/SKILL.md181### Step 5: STOP — Bounded loop, not recursionCOMMENT
LOWskills/source-driven-development/SKILL.md38### Step 1: Detect Stack and VersionsCOMMENT
LOWskills/source-driven-development/SKILL.md63### Step 2: Fetch Official DocumentationCOMMENT
LOWskills/source-driven-development/SKILL.md116### Step 3: Implement Following Documented PatternsCOMMENT
LOWskills/source-driven-development/SKILL.md141### Step 4: Cite Your SourcesCOMMENT
LOWskills/performance-optimization/SKILL.md40### Step 1: MeasureCOMMENT
LOWskills/performance-optimization/SKILL.md99### Step 2: Identify the BottleneckCOMMENT
LOWskills/performance-optimization/SKILL.md121### Step 3: Fix the BottleneckCOMMENT
LOWskills/performance-optimization/SKILL.md139### Step 4: Verify (Keep or Revert)COMMENT
LOWskills/performance-optimization/SKILL.md174### Step 5: Guard Against RegressionCOMMENT
Modern AI Meta-Vocabulary3 hits · 9 pts
SeverityFileLineSnippetContext
MEDIUMreferences/orchestration-patterns.md11### 1. Direct invocation (no orchestration)COMMENT
MEDIUMdocs/agents.md58## Worked example: valid orchestrationCOMMENT
MEDIUMdocs/agents.md79## Worked example: invalid orchestration (do not build this)COMMENT
Over-Commented Block6 hits · 6 pts
SeverityFileLineSnippetContext
LOWhooks/sdd-cache-test.sh1#!/bin/bashCOMMENT
LOWhooks/simplify-ignore.sh1#!/bin/bashCOMMENT
LOWhooks/sdd-cache-post.sh1#!/bin/bashCOMMENT
LOWhooks/sdd-cache-pre.sh1#!/bin/bashCOMMENT
LOWhooks/session-start.sh1#!/bin/bashCOMMENT
LOWscripts/lib/skill-lint.js261 );COMMENT
Verbosity Indicators1 hit · 1 pts
SeverityFileLineSnippetContext
LOWscripts/lib/skill-lint-test.js158 '### Step 1: Measure',CODE
Fake / Example Data1 hit · 1 pts
SeverityFileLineSnippetContext
LOWskills/frontend-ui-engineering/SKILL.md139| Lorem ipsum-style copy | Placeholder text hides layout problems that real content reveals (length, wrapping, overflow)CODE