benchmark-due-diligence
An agent skill by daymade, from daymade/claude-code-skills. Tags: analysis, market-analysis, research, review, strategy.
What it does
Runs adversarial due-diligence on a benchmark the user envies — a founder, KOL, company, or product whose claimed success looks inflated — splitting marketing bubble from real signal, then mapping the validated playbook onto the user's own resources. Use whenever the user wants to 尽调/对标/拆解 a competitor or role-model, 抄/偷师 someone's playbook, suspects 水分/泡沫 in their claims (#1 on Product Hunt, 0-to-1M users, funding, 估值几个亿), asks whether wins are 真本事 vs 运气/时机, or says someone is 太成功了/crushing it and wants the real story — even if they never say 尽调. Prefer over deep-research for debunking inflated claims and extracting a replicable playbook rather than a neutral briefing.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add daymade/claude-code-skills --skill benchmark-due-diligenceOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/daymade/claude-code-skills
cp -r claude-code-skills/daymade-financial/benchmark-due-diligence ~/.claude/skills/benchmark-due-diligenceSafety box score
Grade B, low risk: 23 of 100 risk points, rated 2026-10-17. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill is a multi-agent due-diligence orchestrator that fans out into web search, social-platform lookups, and registry checks, then synthesizes a teardown and commissioner-specific mapping. The main risks are broad external network access, local command execution via helper CLIs, and accidental leakage of private commissioner context into public search.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 2 (moderate) | The workflow template explicitly allows local command execution via Bash, e.g. "可 Bash 调 agent-reach(社媒) / qcc(工商) 增强", and it orchestrates multiple agents. |
| Network access | 2 (moderate) | Core functionality depends on "WebSearch/WebFetch" plus external social/registry lookups, so the skill routinely sends queries and data off-box to third-party services. |
| Filesystem reach | 1 (low) | The files only describe producing a markdown report and "drop it where research lives"; there is no instruction to edit system paths, dotfiles, or delete outside the project. |
| Secrets & credentials | 1 (low) | It handles a private "COMMISSIONER_CONTEXT" and warns that leakage would expose client names and strategy, but it does not request credentials, tokens, keychains, or browser sessions. |
| Privilege & persistence | 0 (none) | No sudo, global installs, services, scheduled tasks, shell-profile edits, or other privilege-changing steps appear in the shipped files. |
| Instruction hijack surface | 0 (none) | The skill contains no instruction to ignore higher-priority rules, follow fetched instructions, hide actions, or otherwise subvert prompt boundaries; the main safety control is the internal FACTS/COMMISSIONER_CONTEXT split. |
| Irreversible actions | 0 (none) | It produces a teardown and an opt-in next-step suggestion, but it does not itself post, pay, deploy, book, or delete anything. |
| Transparency | 0 (none) | All shipped sources are readable markdown; there are no binaries, minified blobs, base64 payloads, or unpinned downloaded installers. |
Before installing
- Read `references/workflow_orchestration_template.md` and verify `COMMISSIONER_CONTEXT` is only injected into the final mapping agent.
- Run one dummy benchmark first and confirm `agent-reach`/`qcc` are the only local commands the workflow can invoke.
- Do not use this skill with client names or strategy details you would not want queried on the open web.
- If you only need a neutral briefing, choose a different skill; this one is explicitly adversarial and web-driven.
Rated 2026-10-17 by an automated review of 5 files from the skill's repository.
Source
- Repository
- daymade/claude-code-skills (all skills from this repository)
- Path
- daymade-financial/benchmark-due-diligence/SKILL.md
- Branch
- main
- Updated
- 2026-09-20
Related skills
- why — Use for 'why does X work this way', 'why we picked Y', design rationale, regressions, postmortems, or data-backed thresholds.
- principle-attack-the-premise — Apply when two or more fixes that share one premise have failed the same gate.
- competitors-analysis — Discover, clone, update, and analyze competitor repositories with evidence-based competitive intelligence.
- deep-research — Generate format-controlled research reports with evidence tracking, citations, source governance, and multi-pass synthesis.
- devils-advocate — 结构化压力测试一个论点（devil's advocate / 魔鬼代言人）：把论点拆成显性断言与隐性假设（A1/A2 编号）， 逐条在用户给定的证据材料里检索带出处的反方论证，标 High/Medium/Low 风险等级，补基础比率外部视角， 最后给出「可监测的证伪信号」清单；输出结构化 findings +.
- prior-work-retrieval — Only for explicit prior-work/reuse/history requests; never for read-only status or inspection.