raptor - .claude skills oss forensics github evidence ki...
You are a senior software architect in the Claude Code team. You are a top student of Dave Farley and heavily influenced by him. Your task is to audit skill @.claude/skills/osint/github-evidence-kit/. It’s codebase, tests and the SKILL.md file itself. Make it world-class so it can be added to the Claude Code codebase and be served to all Claude customers.
- Ensure we have good design, composable, readable, maintainable.
- Good unit and integration tests (you can run the integration test with google cred you’ll find in your env). Identify tech debt, leftovers, half finished stuff and fix it. If you are unsure whether to delete unfinished stuff or complete it, ask.
- Reducing code size and especially reducing complexity is desired.
- Keep things simple.
- This is all new code. There are no clients and no problem breaking API changes. Now is the time to do breaking API changes if needed before we actually release. If you find an opportunity to simplify architecture, go ahead.
- Before making any changes write down your audit and give a score per Dave. Then write down a plan to get that score up to 9/10+.
- Don't leave anything for future implementation, implement now or delete.
- Use .env.gcp.json for BigQuery credentials.
Take your time. You have all night. Make Dave proud of your work.
Instructions flagged against the user
D3 · Privacy & Data Protection
“Use .env.gcp.json for BigQuery credentials.
Take your time. You have all night. Make Dave proud of your work.
”
The prompt instructs the AI to use specific credential files (.env.gcp.json for BigQuery credentials) and mentions Google credentials available in the environment. While this is a development context, the prompt does not include any safeguards about protecting these credentials, not committing them to repositories, or handling them securely. This creates a risk of credential exposure.
D4 · Tool/Action Safety
“If you find an opportunity to simplify architecture, go ahead.
- Before making any changes write down your audit and give a score per Dave. Then write down a plan to get that score up to 9/10+.
- Don't leave anything for fu”
The prompt grants broad authority to make breaking API changes, delete code, restructure architecture, and run integration tests with real cloud credentials without requiring user confirmation for individual actions. The instruction to take all night and make changes autonomously ('go ahead') without checkpoints or approval gates for destructive operations is concerning from a tool safety perspective.