{"id":"f7538cc0-59e7-4172-8d57-664f27e00c90","shortId":"cxvQKA","kind":"skill","title":"devils-advocate","tagline":"Use when reviewing PRs, evaluating design proposals, assessing technical plans, stress-testing assumptions, looking for overlooked failure modes, or adding pushback before a decision.","description":"# Devil's Advocate\n\nA reviewer persona that applies the critic stance from `perspectives` to PRs, designs, and technical decisions. Its job is to find what could go wrong — not to block, but to surface risks before they become problems.\n\n## Dispatch\n\nCan be dispatched as a subagent by code-review or brainstorming workflows when an adversarial perspective is needed alongside other analysis.\n\n## Direct Invocation\n\n- \"Play devil's advocate on this PR\"\n- \"What could go wrong with this design?\"\n- \"Challenge the assumptions in this proposal\"\n- \"What are we not thinking about here?\"\n\n<workflow>\n\n## Workflow\n\n### Step 1: Apply Persona\n\nRole: rigorous technical reviewer finding weaknesses, not blocking progress. Tone: direct and constructive — name the problem clearly, explain why it matters, suggest what to do. Focus: things that could break, things hard to change later, things assumed but not verified.\n\n### Step 2: Review Checklist\n\nWork through each question for the code, design, or proposal under review:\n\n1. Does this change make assumptions that aren't verified? If the assumption is wrong, what breaks?\n2. What happens when this fails? Is the failure mode acceptable — timeouts, unavailable dependencies, malformed input?\n3. Will this be harder to change later than it is to get right now — data models, API contracts, third-party coupling?\n4. Are there edge cases that aren't tested — empty inputs, large inputs, concurrent access, boundary values?\n5. Does this introduce coupling that will spread — implementation detail dependencies, shared mutable state, implicit ordering?\n6. Is there a simpler approach that was not considered? Complexity should earn its keep.\n7. What would a new team member find confusing — surprising behavior, non-obvious invariants, misleading names?\n8. Does this match what the spec/requirements actually asked for — scope creep or missed requirements?\n\n### Step 3: Report Findings\n\nFor each finding: severity (will cause a bug / worth thinking about), what goes wrong, what to do about it. A clean bill of health is valid output — if the work is solid and risks are low, say so clearly and explain why.\n\n</workflow>\n\n<guardrails>\n\n## Guardrails\n\n- Must acknowledge genuine strengths — if something is well-designed, say so\n- Must not oppose clearly good ideas just to be contrarian — if the approach is right, focus concerns on implementation details\n- Severity matters — distinguish \"this will definitely cause a bug\" from \"this is worth thinking about\"\n\n</guardrails>\n\n<validation>\n\n### Validation Checkpoint\n\nBefore delivering findings, verify:\n\n- [ ] Each finding cites specific code/design, not generic concerns\n- [ ] At least one finding challenges a core assumption (not just nitpicks)\n- [ ] Severity is calibrated — \"will cause a bug\" vs \"worth thinking about\"\n- [ ] If zero findings, explicitly confirm the design was stress-tested\n\n</validation>\n\n<example>\n\n## Example\n\n**Context:** PR review of a payment processing endpoint.\n\n**Finding 1 — Severity: High (will cause a bug)**\nAssumes upstream payment provider always returns within 5s — no timeout configured. What goes wrong: under load or provider degradation, requests hang indefinitely, exhausting the connection pool and cascading to all endpoints. Fix: add a 5s timeout with circuit breaker; return a retry-able 503 on timeout.\n\n**Finding 2 — Severity: Medium (worth thinking about)**\nError response leaks internal stack trace to the client. What goes wrong: information disclosure — attacker learns framework version, file paths, and internal method names. Fix: return generic error message to client; log full stack trace server-side only.\n\n**Strengths noted:** Input validation on payment amounts is thorough — rejects negative values, enforces decimal precision, and validates currency codes against an allowlist.\n\n</example>\n\n## References Index\n\n- **[Persona](references/persona.md)** — Role, stance, tone, focus, and guardrails\n- **[Review Checklist](references/checklist.md)** — Eight questions for adversarial review\n- **[Critic Stance](../perspectives/references/stances.md)** — Underlying stance prompt with ethical guardrails (from perspectives skill)","tags":["devils","advocate","flow","cofin","agent-skills","ai-agents","beads","claude-code","codex","cursor","developer-tools","gemini-cli"],"capabilities":["skill","source-cofin","skill-devils-advocate","topic-agent-skills","topic-ai-agents","topic-beads","topic-claude-code","topic-codex","topic-cursor","topic-developer-tools","topic-gemini-cli","topic-opencode","topic-plugin","topic-slash-commands","topic-spec-driven-development"],"categories":["flow"],"synonyms":[],"warnings":[],"endpointUrl":"https://skills.sh/cofin/flow/devils-advocate","protocol":"skill","transport":"skills-sh","auth":{"type":"none","details":{"cli":"npx skills add cofin/flow","source_repo":"https://github.com/cofin/flow","install_from":"skills.sh"}},"qualityScore":"0.455","qualityRationale":"deterministic score 0.46 from registry signals: · indexed on github topic:agent-skills · 11 github stars · SKILL.md body (4,174 chars)","verified":false,"liveness":"unknown","lastLivenessCheck":null,"agentReviews":{"count":0,"score_avg":null,"cost_usd_avg":null,"success_rate":null,"latency_p50_ms":null,"narrative_summary":null,"summary_updated_at":null},"enrichmentModel":"deterministic:skill-github:v1","enrichmentVersion":1,"enrichedAt":"2026-05-18T19:07:36.171Z","embedding":null,"createdAt":"2026-04-23T13:03:58.743Z","updatedAt":"2026-05-18T19:07:36.171Z","lastSeenAt":"2026-05-18T19:07:36.171Z","tsv":"'/perspectives/references/stances.md':610 '1':122,181,468 '2':166,198,523 '3':214,318 '4':237 '5':254 '503':519 '5s':482,509 '6':270 '7':285 '8':302 'abl':518 'accept':208 'access':251 'acknowledg':365 'actual':309 'ad':24 'add':507 'adversari':84,606 'advoc':3,31,96 'allowlist':589 'alongsid':88 'alway':479 'amount':574 'analysi':90 'api':231 'appli':36,123 'approach':275,388 'aren':188,243 'ask':310 'assess':11 'assum':161,475 'assumpt':17,109,186,193,432 'attack':543 'becom':66 'behavior':295 'bill':342 'block':59,132 'boundari':252 'brainstorm':80 'break':154,197 'breaker':513 'bug':328,404,442,474 'calibr':438 'cascad':502 'case':241 'caus':326,402,440,472 'challeng':107,429 'chang':158,184,220 'checklist':168,601 'checkpoint':412 'circuit':512 'cite':419 'clean':341 'clear':141,359,379 'client':537,559 'code':77,175,586 'code-review':76 'code/design':421 'complex':280 'concern':392,424 'concurr':250 'configur':485 'confirm':451 'confus':293 'connect':499 'consid':279 'construct':137 'context':459 'contract':232 'contrarian':385 'core':431 'could':54,101,153 'coupl':236,258 'creep':313 'critic':38,608 'currenc':585 'data':229 'decim':581 'decis':28,47 'definit':401 'degrad':493 'deliv':414 'depend':211,264 'design':9,44,106,176,373,453 'detail':263,395 'devil':2,29,94 'devils-advoc':1 'direct':91,135 'disclosur':542 'dispatch':68,71 'distinguish':398 'earn':282 'edg':240 'eight':603 'empti':246 'endpoint':466,505 'enforc':580 'error':529,556 'ethic':615 'evalu':8 'exampl':458 'exhaust':497 'explain':142,361 'explicit':450 'fail':203 'failur':21,206 'file':547 'find':52,129,292,320,323,415,418,428,449,467,522 'fix':506,553 'focus':150,391,597 'framework':545 'full':561 'generic':423,555 'genuin':366 'get':226 'go':55,102 'goe':333,487,539 'good':380 'guardrail':363,599,616 'hang':495 'happen':200 'hard':156 'harder':218 'health':344 'high':470 'idea':381 'implement':262,394 'implicit':268 'indefinit':496 'index':591 'inform':541 'input':213,247,249,570 'intern':532,550 'introduc':257 'invari':299 'invoc':92 'job':49 'keep':284 'larg':248 'later':159,221 'leak':531 'learn':544 'least':426 'load':490 'log':560 'look':18 'low':356 'make':185 'malform':212 'match':305 'matter':145,397 'medium':525 'member':291 'messag':557 'method':551 'mislead':300 'miss':315 'mode':22,207 'model':230 'must':364,376 'mutabl':266 'name':138,301,552 'need':87 'negat':578 'new':289 'nitpick':435 'non':297 'non-obvi':296 'note':569 'obvious':298 'one':427 'oppos':378 'order':269 'output':347 'overlook':20 'parti':235 'path':548 'payment':464,477,573 'persona':34,124,592 'perspect':41,85,618 'plan':13 'play':93 'pool':500 'pr':99,460 'precis':582 'problem':67,140 'process':465 'progress':133 'prompt':613 'propos':10,112,178 'provid':478,492 'prs':7,43 'pushback':25 'question':172,604 'refer':590 'references/checklist.md':602 'references/persona.md':593 'reject':577 'report':319 'request':494 'requir':316 'respons':530 'retri':517 'retry-':516 'return':480,514,554 'review':6,33,78,128,167,180,461,600,607 'right':227,390 'rigor':126 'risk':63,354 'role':125,594 'say':357,374 'scope':312 'server':565 'server-sid':564 'sever':324,396,436,469,524 'share':265 'side':566 'simpler':274 'skill':619 'skill-devils-advocate' 'solid':352 'someth':369 'source-cofin' 'spec/requirements':308 'specif':420 'spread':261 'stack':533,562 'stanc':39,595,609,612 'state':267 'step':121,165,317 'strength':367,568 'stress':15,456 'stress-test':14,455 'subag':74 'suggest':146 'surfac':62 'surpris':294 'team':290 'technic':12,46,127 'test':16,245,457 'thing':151,155,160 'think':117,330,409,445,527 'third':234 'third-parti':233 'thorough':576 'timeout':209,484,510,521 'tone':134,596 'topic-agent-skills' 'topic-ai-agents' 'topic-beads' 'topic-claude-code' 'topic-codex' 'topic-cursor' 'topic-developer-tools' 'topic-gemini-cli' 'topic-opencode' 'topic-plugin' 'topic-slash-commands' 'topic-spec-driven-development' 'trace':534,563 'unavail':210 'under':611 'upstream':476 'use':4 'valid':346,411,571,584 'valu':253,579 'verifi':164,190,416 'version':546 'vs':443 'weak':130 'well':372 'well-design':371 'within':481 'work':169,350 'workflow':81,120 'worth':329,408,444,526 'would':287 'wrong':56,103,195,334,488,540 'zero':448","prices":[{"id":"b504206b-cfaf-4d14-b74c-fe9d47aacd4d","listingId":"f7538cc0-59e7-4172-8d57-664f27e00c90","amountUsd":"0","unit":"free","nativeCurrency":null,"nativeAmount":null,"chain":null,"payTo":null,"paymentMethod":"skill-free","isPrimary":true,"details":{"org":"cofin","category":"flow","install_from":"skills.sh"},"createdAt":"2026-04-23T13:03:58.743Z"}],"sources":[{"listingId":"f7538cc0-59e7-4172-8d57-664f27e00c90","source":"github","sourceId":"cofin/flow/devils-advocate","sourceUrl":"https://github.com/cofin/flow/tree/main/skills/devils-advocate","isPrimary":false,"firstSeenAt":"2026-04-23T13:03:58.743Z","lastSeenAt":"2026-05-18T19:07:36.171Z"}],"details":{"listingId":"f7538cc0-59e7-4172-8d57-664f27e00c90","quickStartSnippet":null,"exampleRequest":null,"exampleResponse":null,"schema":null,"openapiUrl":null,"agentsTxtUrl":null,"citations":[],"useCases":[],"bestFor":[],"notFor":[],"kindDetails":{"org":"cofin","slug":"devils-advocate","github":{"repo":"cofin/flow","stars":11,"topics":["agent-skills","ai-agents","beads","claude-code","codex","context-driven-development","cursor","developer-tools","gemini-cli","opencode","plugin","slash-commands","spec-driven-development","subagents","tdd","workflow"],"license":"apache-2.0","html_url":"https://github.com/cofin/flow","pushed_at":"2026-04-27T19:07:26Z","description":"Context-Driven Development toolkit for AI agents — spec-first planning, TDD workflow, and Beads integration.","skill_md_sha":"3eb7e3f9a2934b89c80645eac1b89a41683259eb","skill_md_path":"skills/devils-advocate/SKILL.md","default_branch":"main","skill_tree_url":"https://github.com/cofin/flow/tree/main/skills/devils-advocate"},"layout":"multi","source":"github","category":"flow","frontmatter":{"name":"devils-advocate","description":"Use when reviewing PRs, evaluating design proposals, assessing technical plans, stress-testing assumptions, looking for overlooked failure modes, or adding pushback before a decision."},"skills_sh_url":"https://skills.sh/cofin/flow/devils-advocate"},"updatedAt":"2026-05-18T19:07:36.171Z"}}