MCPInstall

assumption-audit

Use as the mandatory evidence gate before signing off on any strategy, PRD, or business case—audits every key claim against documented sources and assigns calibrated probabilities.

Installs
43
Last 24h
—
Trending rank
—
Security
Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/joellewis/skill-library --skill assumption-audit
  1. 01

    Install

    Run the command in your project. The CLI asks which agents to install for.

  2. 02

    Describe the task

    Ask your agent for something this skill covers. It loads assumption-audit automatically when relevant.

  3. 03

    Review the result

    The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

Overview

Assumption-audit is the "evidence gate" that prevents Resulting (evaluating decisions by outcomes) and Hindsight Bias (feeling something was predictable after it happened). It forces an honest accounting of what is known versus what is guessed.

Iron Law

NO SIGN-OFF WITHOUT VALIDATION EVIDENCE FOR EVERY KEY CLAIM Assertions without evidence are vulnerabilities. Unaudited assumptions create fragile strategies that collapse under the first sign of volatility.

State Machine

digraph assumption_audit_flow {
    "Start" [shape=doublecircle];
    "Step 1: Inventory Key Assumptions" [shape=box];
    "Step 2: Evidence Mapping (Knowledge Tracker)" [shape=box];
    "Step 3: Stress-Test (Pre-mortem)" [shape=box];
    "Step 4: Probability Calibration" [shape=box];
    "Gate: Claim-Evidence Match" [shape=diamond];
    "Step 5: Fragility Audit (Via Negativa)" [shape=box];
    "Done: Audit Passed" [shape=doublecircle];

    "Start" -> "Step 1: Inventory Key Assumptions";
    "Step 1: Inventory Key Assumptions" -> "Step 2: Evidence Mapping (Knowledge Tracker)";
    "Step 2: Evidence Mapping (Knowledge Tracker)" -> "Step 3: Stress-Test (Pre-mortem)";
    "Step 3: Stress-Test (Pre-mortem)" -> "Step 4: Probability Calibration";
    "Step 4: Probability Calibration" -> "Gate: Claim-Evidence Match";
    "Gate: Claim-Evidence Match" -> "Step 5: Fragility Audit (Via Negativa)" [label="matched"];
    "Gate: Claim-Evidence Match" -> "Step 1: Inventory Key Assumptions" [label="mismatch"];
    "Step 5: Fragility Audit (Via Negativa)" -> "Done: Audit Passed";
}

When to Use This Skill

  • Before finalizing a PRD, strategy memo, or business case.
  • When a recommendation relies on future forecasts or market "certainties."
  • When you find yourself saying "I just have a feeling" or "It's obvious that..."
  • Before any high-stakes decision where the downside of being wrong is significant.

When NOT to Use This Skill

  • For low-stakes, reversible decisions (Type 2 decisions) where the cost of auditing exceeds the cost of failure.
  • For purely creative tasks (e.g., brainstorming) where audit-culture might stifle ideation (use after ideation, before selection).

Core Process

Step 1: Inventory Key Assumptions

  • Identify Every Major Claim: List the foundations upon which the proposal stands.
  • Check for Misjudgments: Run the checklist of 28 reasons for misjudgment (e.g., Anchoring, Social Proof, Incentive bias). (Source: Bevelin, Seeking Wisdom)
  • Distinguish Facts from Beliefs: Explicitly label what is a verified fact versus what is an educated guess. (Source: Duke, How to Decide)

Step 2: Evidence Mapping (Knowledge Tracker)

  • Apply the Knowledge Tracker: Record exactly what was known and when it was known. This prevents "Hindsight Bias" from making you think you knew more than you did. (Source: Duke, How to Decide)
  • Darwin’s Golden Rule: Actively seek out and record disconfirming evidence—the facts that oppose your desired conclusion. (Source: Bevelin/Darwin, Seeking Wisdom)
  • Audit Incentives: Ask: "What incentives make this belief useful for me or my team right now?" (Source: Sivers, Useful Not True)

Step 3: Stress-Test (Pre-mortem & Backcasting)

  • Conduct a Pre-mortem: Imagine it is one year from now and this project has failed catastrophically. Work backward to identify the most likely causes of that failure. (Source: Duke, Thinking in Bets)
  • Execute Backcasting: Imagine the project is a massive success. What must have happened for this success to be true? Does our current plan cover those necessities? (Source: Duke, Thinking in Bets)

Step 4: Probability Calibration

  • Eliminate Vague Terms: Replace words like "likely," "probably," or "maybe" with exact confidence percentages (e.g., "70% confident"). (Source: Duke, How to Decide)
  • Calculate the Expected Value: If possible, multiply the probability of success by the potential payoff to see if the bet is worth the risk. (Source: Duke, Thinking in Bets)

Step 5: Fragility Audit (Via Negativa)

  • Apply Via Negativa: Identify what can be removed or simplified to reduce the number of ways the plan can fail. (Source: Taleb, Antifragile)
  • Check for Skin in the Game: Are the people making the assumptions the ones who will bear the cost if they are wrong? (Source: Taleb, Antifragile)
  • Build a Barbell: Ensure the core of the plan is robust/safe, while allowing for small, high-upside "options" to capture volatility. (Source: Taleb, Antifragile)

Cross-Skill Invocations

REQUIRED SUB-SKILL: using-skills — To maintain audit discipline. RECOMMENDED SUB-SKILL: devils-advocate — To provide adversarial pressure on the assumptions. RECOMMENDED SUB-SKILL: decision-frameworks — To structure the final sign-off.

Rationalization Table

ThoughtReality
"We've done our research, we know this will work."This is "definite optimism" and ignores the role of luck and hidden volatility.
"I don't need a knowledge tracker; I remember why I chose this."Memory is a "hindsight bias" machine that rewrites history to make you look right.
"A pre-mortem is too negative; it will demoralize the team."Unchecked fragility is what actually demoralizes teams when they inevitably fail.
"The upside is so high it doesn't matter if we're slightly wrong."Fragile systems have a "concave" downside—being "slightly wrong" can lead to total ruin.

Red Flags

These thoughts mean STOP — you are about to shortcut:

  • "Trust me, I have a gut feeling about this." → Gut feelings are often just un-audited biases.
  • "Everyone else is doing it this way." → Social Proof bias is masking a lack of evidence.
  • "We'll cross that bridge when we come to it." → You are avoiding a necessary pre-mortem.

Diagnostic Checklist

  • Is every "likely" outcome assigned an explicit probability percentage?
  • Has a pre-mortem been conducted to identify failure modes?
  • Is there documented evidence for the top three most critical assumptions?
  • Has the "Via Negativa" check identified at least one thing to remove for safety?
  • Does the "Knowledge Tracker" separate what we knew then from what we know now?

Sources

  • Duke, Thinking in Bets, Ch. 1 (Resulting), Ch. 6 (Future-tenting)
  • Duke, How to Decide, Ch. 3 (Hindsight Bias), Ch. 4 (Probabilities), Ch. 5 (Pre-mortem)
  • Taleb, Antifragile, Ch. 11 (Barbell Strategy), Ch. 20 (Lindy Effect), Ch. 23 (Skin in the Game)
  • Bevelin, Seeking Wisdom, Part 2 (Psychology of Misjudgments), App. 4 (Checklists)
  • Sivers, Useful Not True, (Useful vs True)

FAQ

What does the assumption-audit skill do?

Use as the mandatory evidence gate before signing off on any strategy, PRD, or business case—audits every key claim against documented sources and assigns calibrated probabilities.

How do I install assumption-audit?

Run npx skills add https://github.com/joellewis/skill-library --skill assumption-audit in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/assumption-audit/ (personal) or .claude/skills/assumption-audit/ (project).

Which AI agents can use assumption-audit?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is assumption-audit safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains assumption-audit?

It is published by joellewis in joellewis/skill-library. It has 43 recorded installs.

More from joellewis/skill-library

View all →

fiction-architect

joellewis/skill-library

Open the skill to read its SKILL.md instructions.

55 installs

dialogue-craft

joellewis/skill-library

Open the skill to read its SKILL.md instructions.

53 installs

world-building-logic

joellewis/skill-library

Open the skill to read its SKILL.md instructions.

53 installs

problem-framing

joellewis/skill-library

Use when beginning analytical or strategic tasks, facing undefined problems, or facing analysis paralysis—requires explicit problem definition before proceeding.

47 installs

character-vulnerability

joellewis/skill-library

Use when a character feels flat, too competent, or unrelatable—identifies the Sacred Flaw (Storr's Theory of Control) and dials the Three Sliders (Sanderson) to create earned vulnerability.

Security47 installs

one-pager

joellewis/skill-library

Use when compressing a complex strategy or analysis into a strictly one-page narrative—enforces Pyramid SCQ structure and Orwell word-budget discipline.

Docs & Writing47 installs

Popular security skills

View category →

azure-compliance

microsoft/azure-skills

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

OfficialSecurity567K installs

minimal-run-and-audit

lllllllama/rigorpilot-skills

Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.

Security477.4K installs

seo-audit

coreyhaines31/marketingskills

When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.

Security238.7K installs

firebase-security-rules-auditor

firebase/agent-skills

Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.

OfficialSecurity139.1K installs

audit

pbakaus/impeccable

Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.

Security81.9K installs

competitors

coreyhaines31/marketingskills

When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.

Security79.3K installs