Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when personal data or privacy compliance (GDPR, CCPA) is involved.
doubt-driven-development
doubt-driven-development is an open-source security skill for Claude Code and compatible agents, published by addyosmani. Its author describes it as: “Subjects every non-trivial decision to a fresh-context adversarial review before it stands. Use when correctness matters more than speed, when working in unfamiliar code, when stakes are high (production, security-sen…”. The project has 88k stars on GitHub and is available under the MIT license. Add it to your setup with `/plugin marketplace add addyosmani/agent-skills`.
What doubt-driven-development does
A confident answer is not a correct one. Long sessions accumulate context that quietly turns assumptions into "facts" without anyone noticing. Doubt-driven development is the discipline of materializing a fresh-context reviewer — biased to **disprove**, not approve — before any non-trivial output stands.
Installation
Add doubt-driven-development to your agent with:
/plugin marketplace add addyosmani/agent-skills Always review a skill's source before installing it. This command comes from the skill's public repository; the linked repo is the source of truth for exact setup steps.
What's inside
The SKILL.md for doubt-driven-development is organised into these sections:
- Overview
- When to Use
- Loading Constraints
- The Process
- Step 1: CLAIM — Surface what stands
- Step 2: EXTRACT — Smallest reviewable unit
- Step 3: DOUBT — Invoke the fresh-context reviewer
- Step 4: RECONCILE — Fold findings back
- Step 5: STOP — Bounded loop, not recursion
- Common Rationalizations
- Red Flags
- Interaction with Other Skills
When to use it
Reach for doubt-driven-development when you want security help from your agent without writing the same instructions every session. Load the skill and the agent picks it up automatically for relevant tasks.
Strengths
- Clear MIT license — safe to read and adapt
- Ships in addyosmani/agent-skills, an established project with 88,280 GitHub stars
- Actively maintained (recent commits)
Topics
Frequently asked questions
- What does doubt-driven-development do?
- Subjects every non-trivial decision to a fresh-context adversarial review before it stands. Use when correctness matters more than speed, when working in unfamiliar code, when stakes are high (production, security-sensitive logic, irreversible operations), or any time a confident output would be cheaper to verify now than to debug later.
- How do I install doubt-driven-development?
- Run /plugin marketplace add addyosmani/agent-skills in your agent, then reload your skills. Review the source at https://github.com/addyosmani/agent-skills before installing.
- Is doubt-driven-development free to use?
- Yes. doubt-driven-development is free and open source under the MIT license, so you can read, run, and adapt it within that license's terms.
- Where does doubt-driven-development come from?
- doubt-driven-development ships inside addyosmani/agent-skills, a repository that contains 25 catalogued skills in total. The repository's 88,280 GitHub stars apply to that whole collection, not to this skill on its own.
Related skills
More Security →Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.
Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.
You are an accessibility expert specializing in WCAG compliance, inclusive design, and assistive technology compatibility. Conduct audits, identify barriers, and provide remediation guidance.
Find and fix WCAG 2.2 accessibility issues. Two modes — report (sweep a codebase or page, produce a prioritized written report, no edits) and fix (audit→edit→verify loop on a target). Prefers direct-CDP live-DOM auditing; falls back to a browser-MCP composition or HTML-string audits.