MCPInstall

scrutinize

Outsider-perspective end-to-end review of a plan, PR, or code change. First questions intent and whether a simpler/more elegant approach would achieve the same goal, then traces the actual code path (not just the diff) to verify the change does what it claims. Output is concise, actionable, and every call carries its rationale. Trigger on /scrutinize and proactively whenever the user asks to review, audit, sanity-check, or get a second opinion on a plan, PR, diff, design doc, or proposed code change.

Installs
5.2K
Last 24h
+8
Trending rank
#9480
Security
Pass

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/thananon/9arm-skills --skill scrutinize
  1. 01

    Install

    Run the command in your project. The CLI asks which agents to install for.

  2. 02

    Describe the task

    Ask your agent for something this skill covers. It loads scrutinize automatically when relevant.

  3. 03

    Review the result

    The agent follows the SKILL.md steps, scripts and references bundled with the skill.

Security audits

Independent scans of the skill's instructions and bundled files.

Gen Agent Trust Hub PassSAFE ·The skill consists entirely of instructional guidelines for code and plan reviews. It contains no executable scripts, binaries, network operations, or third-party dependencies. No security risks were identified.
Socket PassNo alerts
Snyk PassLOW ·Risk: LOW · No issues

SKILL.md

The instructions your agent reads when the skill is triggered.

Scrutinize

Stand outside the change and ask whether it should exist at all, then verify it actually does what it claims end-to-end.

Operating stance

  • Outsider. Forget who wrote it and why they think it's right. Read the artifact cold.
  • End-to-end, not diff-local. The diff is the entry point, not the scope. Follow the call graph through real code paths.
  • Actionable, concise, with rationale. Every finding states what to change, why, and what evidence led you there. No filler, no restating the diff back.

Workflow

Run these in order. Do not skip ahead.

1. Intent — what is this actually trying to do?

  • State the goal in one sentence, in your own words. If you cannot, the artifact is underspecified — say so and stop.
  • Ask: is there a simpler, smaller, or more elegant way to achieve the same goal? Consider:
    • Doing nothing (is the problem real / load-bearing?).
    • Using something that already exists in the codebase instead of adding new surface.
    • A smaller change that solves 90% of the goal with 10% of the risk.
    • Solving it at a different layer (config vs code, framework vs app, build vs runtime).
  • If a better alternative exists, name it explicitly with rationale. This is the most valuable thing you can output — surface it before the line-by-line review.

2. Trace — walk the actual code path

  • For each behavior the change claims, trace the path end-to-end through the real code, not just the lines in the diff:
    • Entry point → call sites → branches taken → state mutated → exit / return / side effect.
    • Include the unchanged code on either side of the diff. Bugs hide at the seams.
  • For a plan or design doc: trace the proposed flow against the existing system. Where does it touch reality? What does it assume that isn't true?
  • Note every place the trace surprises you (unexpected branch, dead code reached, state you didn't know existed). Surprises are signal.

3. Verify — does it actually do what it claims?

For each claim the change/plan makes, answer:

  • Does the code path you just traced actually produce that behavior? Walk it explicitly. "It claims X. Path: A → B → C. At C, [observation]. Therefore [holds / doesn't hold]."
  • What inputs / states would break it? Edge cases, concurrent callers, error paths, partial failures, retries, empty/null/unicode/huge inputs, ordering assumptions.
  • What does it silently change? Performance, error semantics, observability, contract for other callers, on-disk / on-wire format.
  • How is it tested? Do the tests actually exercise the traced path, or do they pass while skipping it (mocks that hide the bug, asserts on intermediate state, happy path only)?

4. Report

Output one tight section per finding. Order by severity (blocker → major → nit). For each:

  • Finding — one sentence, specific. Cite file:line when applicable.
  • Why it matters — the consequence, not the principle.
  • Evidence — the trace step or input that exposes it.
  • Suggested change — concrete, minimal.

Close with a one-line verdict: ship / fix-then-ship / rework / reject — with the single biggest reason.

Operating rules

  • No rubber-stamps. "LGTM" is not an output. If you genuinely find nothing, say what you traced and what you checked, so the user can judge whether your review covered the surface they cared about.
  • Cite or it didn't happen. Every claim about the code references a specific path, file, or line. No vague "this might break under load."
  • Distinguish claim from verification. "The PR says X" and "I traced X and confirmed / refuted it" are different — keep them separate in the output.
  • One simpler-alternative pass is mandatory. Even on small changes, spend one breath asking if the whole thing is necessary. Skip only if the user explicitly says "don't question scope."
  • Don't pad with style nits when there's a structural problem. If step 1 or step 2 surfaces a real issue, lead with it; defer nits or drop them.
  • No flattery, no hedging. "This is a great PR but..." adds nothing. State the finding.

FAQ

What does the scrutinize skill do?

Outsider-perspective end-to-end review of a plan, PR, or code change. First questions intent and whether a simpler/more elegant approach would achieve the same goal, then traces the actual code path (not just the diff) to verify the change does what it claims. Output is concise, actionable, and every call carries its rationale. Trigger on /scrutinize and proactively whenever the user asks to review, audit, sanity-check, or get a second opinion on a plan, PR, diff, design doc, or proposed code change.

How do I install scrutinize?

Run npx skills add https://github.com/thananon/9arm-skills --skill scrutinize in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/scrutinize/ (personal) or .claude/skills/scrutinize/ (project).

Which AI agents can use scrutinize?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is scrutinize safe to install?

Security partners have reviewed it: Gen Agent Trust Hub passed; Socket passed; Snyk passed. As with any skill, read the SKILL.md and bundled scripts before installing.

Who maintains scrutinize?

It is published by thananon in thananon/9arm-skills. It has 5,195 recorded installs.

More from thananon/9arm-skills

View all →

debug-mantra

thananon/9arm-skills

Four-mantra debugging discipline — reproduce, trace the fail path, falsify the hypothesis, cross-reference every breadcrumb. Recite the mantra block verbatim at the start of any debugging session, then apply the four steps in order before proposing any fix. Trigger on /debug-mantra and proactively whenever debugging starts — user reports a bug, says something is broken/throwing/failing, asks to debug/diagnose/investigate an issue, or pastes a stack trace or error log.

post-mortem

thananon/9arm-skills

Write the canonical engineering record of a fixed bug — root cause, mechanism, fix, validation, and how it slipped through. Engineer-audience, code identifiers welcome. Use after a debug session lands a fix, before closing the ticket. Trigger on /post-mortem, when the user says "write the post-mortem / postmortem / RCA / root cause analysis", "document this fix", "write up the root cause", "close out this bug with a writeup", or hands you a fixed-and-validated bug and asks for the writeup.

management-talk

thananon/9arm-skills

Rewrite engineer-to-engineer content for engineering-org leadership (VPs, directors, PMs, release managers, execs in an engineering-savvy company) and shape it for the channel it is going to — JIRA comment, Slack post, async standup line, email, or meeting talking-points. Trigger when the user asks to write/rewrite for management / exec / VP / director / PM / release manager, asks for an "executive summary / leadership update / status update", says "make this less technical / less jargony", or asks for a slack / email / standup / meeting version of work originally written engineer-to-engineer.

qwenchance

thananon/9arm-skills

Keeps a long Claude Code task on-track — breaks out of looping/circular thinking, watches the context budget, bounds internal reasoning, and triggers a clean handoff before the window fills. Use when the model is repeating steps, re-reading the same files, second-guessing in circles, stuck or spinning, or running a long multi-step task at risk of exhausting context. Also use when the user says it is "looping", "going in circles", "stuck", "repeating itself", or asks for a handoff before running out of context.

qwen-agent

thananon/9arm-skills

Delegate menial, well-scoped coding tasks to a cheap Qwen-backed subagent via the claude-9arm command instead of burning Claude tokens/quota. Use when the work is mechanical and low-risk — bulk renames, formatting, boilerplate, find-replace, grep-style search & summarization, reading/condensing logs or files, test/docstring/comment scaffolding, or running builds/linters/tests and reporting pass-fail. Also use when the user says "use qwen", "delegate this", "send it to 9arm/qwen", or "do this cheaply". Do NOT use for architecture, design, debugging judgment, security-sensitive edits, or anything needing this conversation's context.

Testing & QA2.4K installs

Popular code quality & workflow skills

View category →

grill-me

mattpocock/skills

A relentless interview to sharpen a plan or design.

Scan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.

handoff

mattpocock/skills

Compact the current conversation into a handoff document for another agent to pick up.

domain-modeling

mattpocock/skills

Build and sharpen a project's domain model. Use when discussing codebase terminology, writing or editing a GLOSSARY.md, or recording or editing an ADR.

codebase-design

mattpocock/skills

Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.

diagnosing-bugs

mattpocock/skills

Diagnosis loop for hard bugs and performance regressions. Use when the user says "diagnose"/"debug this", or reports something broken/throwing/failing/slow.