doubt-driven-development

An agent skill by addyosmani, from addyosmani/agent-skills. Tags: debugging, developer-tools, documents.

What it does

Subjects every non-trivial decision to a fresh-context adversarial review before it stands. Use when you want every assumption cross-examined before proceeding, when stress-testing a plan for hidden failure modes, when correctness matters more than speed, when working in unfamiliar code, when stakes are high (production auth, security-sensitive logic, a high-stakes migration, irreversible operations), or any time a confident output would be cheaper to verify now than to debug later.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add addyosmani/agent-skills --skill doubt-driven-development

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/addyosmani/agent-skills
cp -r agent-skills/skills/doubt-driven-development ~/.claude/skills/doubt-driven-development

Safety box score

Grade B, low risk: 19 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This is a process-only skill for adversarially reviewing decisions, not a deploy or automation tool. Its main blast-radius risk is that the optional cross-model path sends the artifact and contract to external CLI/model providers, and the examples also shell out locally to check and run those tools.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	The skill does not ship code, but it explicitly tells the agent to run shell probes and external commands such as `which gemini`, `gemini --version`, and `codex exec`.
Network access	2 (moderate)	If the user accepts cross-model review, the artifact and contract are sent off-machine to third-party tools; the file says to pass `ARTIFACT + CONTRACT + the adversarial prompt only` to Gemini/Codex.
Filesystem reach	1 (low)	The documented CLI workflow writes the review prompt to a temp file (`/tmp/doubt-prompt.md`) before piping it, which stores the artifact locally outside the repo.
Secrets & credentials	1 (low)	Because the exported artifact may contain proprietary code, incident details, or other sensitive text, the external review path can expose secrets if the user opts in.
Privilege & persistence	0 (none)	No sudo, global installs, service registration, shell profile edits, or other privilege-changing operations are requested.
Instruction hijack surface	0 (none)	The file contains adversarial review instructions, but it does not tell the agent to ignore higher-priority rules or fetch and obey remote instructions.
Irreversible actions	0 (none)	It does not deploy, publish, delete, or otherwise act on external systems; it only reviews and asks the user before any cross-model step.
Transparency	0 (none)	The source is plain markdown with no binaries, generated blobs, or hidden runtime-decoded content.

Before installing

Decide whether you want the optional cross-model path; it can send the artifact off-machine.
If you plan to use Gemini/Codex, verify the exact CLI and auth state first (`which ...`, `--version`).
Keep secrets out of the artifact, or skip cross-model review for sensitive material.
Be comfortable with a temporary prompt file under `/tmp` if you follow the documented CLI flow.

Rated 2026-10-20 by an automated review of 1 file from the skill's repository.

Source

Repository: addyosmani/agent-skills (all skills from this repository)
Path: skills/doubt-driven-development/SKILL.md
Branch: main
Updated: 2026-09-19

code-review-and-quality — Conducts multi-axis code review. Use before merging any change. Use when reviewing code written by yourself, another agent, or a human.
constraint-driven-development — Establishes a project's quality bar as a written contract and stops agents quietly lowering it.
deprecation-and-migration — Manages deprecation and migration. Use when removing old systems, APIs, or features. Use when migrating users from one implementation to another.
archify-review — Review Archify issues, PRs, or code through value, cost, and impact to support evidence-based maintenance decisions.
intended-vs-implemented — The method for finding the gap between what a system is supposed to do and what the code actually does — the class of bug generic scanners miss because they.
obsidian-cli — Interact with Obsidian vaults using the Obsidian CLI to read, create, search, and manage notes, tasks, properties, and more.