adversarial-review

Attacks system assumptions using personas and canonical operations to generate testable audit hypotheses.

Updated Aug 29, 2026
One-click install
npx skills add https://github.com/1arley/volibear --skill adversarial-review-1arley
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: adversarial-review
Source: https://github.com/1arley/volibear/tree/main/.opencode/skills/adversarial-review
Command: npx skills add https://github.com/1arley/volibear --skill adversarial-review-1arley

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Code reviews often follow the happy path the author intended, producing false negatives, or hunt bugs randomly, producing noise. This Skill provides a systematic method to attack the assumptions behind a system before launch or refactor, turning adversarial thinking into testable hypotheses with evidence. ## Core Features & Use Cases - Persona-Based Attack Model: Six user personas (curious, malicious, power user, careless, concurrent, stale-state) each targeting a different class of system assumption. - Canonical Operations: Seven operations (repeat, reverse, reorder, skip, replay, concurrent, manipulate) that transform normal execution into pressure cases. - Evidence-Graded Findings: Confidence levels from CONFIRMED to SPECULATIVE, with false-positive screening for rate limiting, idempotency, and server-side authorization. - Use Case: Before shipping a rewards flow, apply the reverse operation to check whether undoing an action removes the granted reward, catching infinite farming bugs before production. ## Quick Start Ask the agent to run an adversarial review on a specific flow, such as "attack the assumptions behind the checkout and reward-granting flow and report confirmed findings."

Frequently Asked Questions about adversarial-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform an adversarial code review on a user flow?▼

Map the nominal flow steps, list the assumptions each step makes about input, state, and users, then apply each persona-operation pair to generate hypotheses. Confirm surviving hypotheses with code evidence or reproduction before reporting them as findings.

What attack patterns should I test before launching a feature?▼

Test seven canonical operations: repeat, reverse, reorder, skip, replay, concurrent, and manipulate. Each targets a different assumption, such as idempotency for replay, double-spend for concurrent, and missing server-side validation for manipulate.

How do I avoid false positives in security audits?▼

Verify that rate limiting, idempotency keys, unique constraints, and server-side authorization checks are actually absent before reporting a defect. Also check whether the behavior is intentional product design, and downgrade unconfirmed hypotheses to POSSIBLE or SPECULATIVE.

When should I use adversarial review versus a standard code review?▼

Use adversarial review before launching or refactoring non-trivial flows involving state, permissions, rewards, money, or counters. Standard review checks what the code does; adversarial review tests whether its assumptions survive users who do not cooperate.

What evidence is required for a confirmed audit finding?▼

A CONFIRMED finding requires reproduction via a request sequence or test. HIGH CONFIDENCE requires an identified mechanism in code without execution, while POSSIBLE and SPECULATIVE cover plausible but unverified hypotheses reported separately as risks.