mcpField
D
duck-risk

duck-risk

github.com/sprngrTesting & quality856 installsUpdated 2w ago
Repository

About duck-risk

An adversarial review skill for assessing proposals and changes for high-impact correctness, reliability, and security-adjacent risks. It prioritizes a small number of findings with impact, rollback considerations, and minimal mitigations; approval decisions remain with the user.

Key features

  1. 01Review trust boundaries and failure modes
  2. 02Prioritize correctness, security, and data integrity
  3. 03Report up to three high-impact findings
  4. 04Include impact and rollback for each finding
  5. 05Suggest the smallest safe mitigation

Use cases

  1. 01Reviewing a proposed change before implementation
  2. 02Assessing risks in a runtime path
  3. 03Checking rollback and compatibility gaps

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/sprngr/rubber-duck --skill duck-risk

After installing, type/duck-riskin Claude Code to confirm it loaded.

Bundled filesreferences/GUARDRAILS.md

Details

From the project README

Risk review 🦆. Break it before users do.

Purpose

Identify highest-impact correctness/reliability/security-adjacent risks and smallest safe mitigations.

Philosophy Guardrails (skill-local)

Inherit shared guardrails from references/GUARDRAILS.md.

Skill-specific delta:

  • Risk findings and mitigations only; merge/approval decisions remain with user.

Activation

Use for adversarial review of proposal/change scope.

Method

1. Clarify scope (if missing)
  • ask 1-3 targeted clarifying questions when context is incomplete
  • state assumptions explicitly when evidence is missing

Required:

  • proposal/change scope or runtime path

Optional:

  • threat model
  • rollback constraints
  • compatibility constraints

If threat model/scope is missing, ask one targeted clarifying question.

2. Review for risk
  1. Inspect trust boundaries and failure classes first.
  2. Prioritize: security/correctness -> data integrity -> rollback/compat.
  3. Emit max 3 highest-impact findings.
  4. Include explicit Impact + Rollback in every finding.
  5. Prefer smallest safe mitigation.
  6. If uncertain assumptions, state assumption in one line and downgrade confidence.
3. Output findings

One line per finding:

<prefix> <path[:line|scope]> — <failure mode>. Impact: <user/data/scope>. Rollback: <blast radius + revert path>. Fix: <smallest safe mitigation>.

Prefixes:

  • 🔴 bug: correctness/security/data-loss
  • 🟡 risk: reliability/compat/rollback gap
  • ❓ question: missing context blocks judgment

Final line:

totals: <n> findings, <n> questions. coverage: trust-boundary=<checked|partial|missing>; rollback=<checked|partial|missing>.

Boundaries

  • No style/naming nits.
  • No simplification/duplication ownership (duck-simplify).
  • No final PR-thread formatting ownership (duck-review).

Comments

Markdown supported