Install
$ agentstack add skill-emlembow-skills-ponytail-adversarial-review ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Ponytail Adversarial Review
Use this skill as a completion gate for code changes in a target repo. The main agent may write code normally, but it cannot finish until Ponytail has challenged the diff and the main agent has either fixed or explicitly declined each finding.
Source Skill
Use the vendored Ponytail skills in this plugin:
- Ponytail mode:
../ponytail/SKILL.md - Ponytail review:
../ponytail-review/SKILL.md - Ponytail audit, optional whole-repo audit only, not the normal completion gate:
../ponytail-audit/SKILL.md
If those paths are missing, fall back to the installed @ponytail and @ponytail-review skills if available. If neither is available, perform the same review manually using Ponytail's ladder: YAGNI, stdlib, native platform features, installed dependency, one line, then minimum code.
Workflow
- Before editing, keep Ponytail's ladder in mind: delete, stdlib, native, installed dependency, one line, minimum custom code. Do not simplify away security, trust-boundary validation, data-loss prevention, accessibility, explicitly requested behavior, explicitly requested explanations/reports, hardware calibration knobs, or the smallest runnable check for non-trivial logic.
- After writing code, collect the changed surface:
- Run
git status --short. - Run
git diff --. - For new untracked code files, read enough of the file to review the introduced code.
- Run the adversarial review:
- Apply
ponytail-reviewto the changed code. - Hunt only unnecessary complexity: dead code, speculative abstractions, new dependencies, hand-rolled stdlib/native behavior, over-wide config, repeated boilerplate, or code that can become smaller without losing behavior.
- Do not flag the smallest useful runnable check or a real-world calibration knob as bloat.
- Do not run
ponytail-auditfor ordinary per-diff completion; reserve it for explicit whole-repo audit requests. - Use Ponytail's terse finding format internally:
file:L: : . .
- Main-agent corrective discussion:
- For each Ponytail finding, decide one of:
accept,reject, ordefer. - Accept when the replacement preserves the user's requested behavior and improves simplicity.
- Reject only when the finding would remove explicit requirements, correctness, security, accessibility, error handling that prevents data loss, or necessary framework convention.
- Defer only when the change is real but outside the user's requested scope; name the follow-up plainly.
- Update code before completion:
- Apply every accepted corrective action.
- If corrective changes modify code, repeat the review on the new diff until there are no accepted findings left.
- Do not final while an accepted finding remains unpatched.
- Verify:
- Run the smallest relevant checks for the touched area, such as
npm run lint, unit tests, typecheck, or an Expo health check. - For non-trivial logic, leave or run one check that would fail if the logic broke.
- If a check cannot run, say why and keep the Ponytail review result visible in the final summary.
Final Response
Keep the final concise. Include:
- What changed.
- Verification result.
- A short Ponytail note:
Lean already. Ship.or the accepted/rejected corrective actions.
Do not paste a long review transcript unless the user asks for it.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: Emlembow
- Source: Emlembow/skills
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.