jaisonerick/probe-contract
plugins/spec-plugin/skills/probe-contract/SKILL.md
Find out how code ACTUALLY behaves by executing the real classes in a REPL — the real request/response shape, the real return value — without relying on a live staging environment. Beats writing a test for 'how does this behave?'.
development
Updated Jun 8, 2026
$ install --global
skillsauthnpx skillsauth add jaisonerick/spec-plugin probe-contractInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 8, 2026, 6:10 AM7.7s1 file scanned
SKILL.md
- name:
- probe-contract
- description:
- Find out how code ACTUALLY behaves by executing the real classes in a REPL — the real request/response shape, the real return value — without relying on a live staging environment. Beats writing a test for 'how does this behave?'.
- argument-hint:
- [class/method + the behavior/shape to probe, e.g. 'TokenService#issue → real response shape']
- allowed-tools:
- Read, Glob, Grep, Bash
- context:
- fork
- agent:
- Explore
- effort:
- low
Run this to answer "what does this actually do / what's the real shape?" by running the real code — not by reading it and guessing, and not by assuming a live staging environment exists (it usually doesn't). Past runs shipped contract bugs that 100+ green unit tests hid (a missing _live_ env infix, expires_in vs expires_at, an illegal cookie write) — caught only by exercising the real thing. Exercise the real thing.
This skill runs in an isolated forked Explore child and returns only its tight conclusion — so the caller's context stays clean.
Procedure
- Detect the project language and load only that language's toolkit card:
Read the matching card (find ~/.claude/plugins -type f -path '*spec-plugin/references/<lang>.md' 2>/dev/null | head -1ruby.md/typescript.md/python.md) — it has the exact REPL / tmux / debugger commands. - Default order: one-shot REPL eval → interactive REPL in tmux (when you need persistent state) → debugger (when you need the exact stack/locals at a point). Use the card's "Execute" and "Debug" sections.
- Instantiate the real class, call the real method, observe the output. Stub only the outermost boundary (HTTP, clock, env); everything beneath runs for real. The card shows the stub-the-boundary pattern.
- Compare against the contract — hold the observed shape/value against what the spec/types/OpenAPI claimed, and flag any divergence (that's the kind of thing unit tests miss).
Tool versions resolve via asdf automatically — call bin/rails/node/python directly; interactive sessions go through tmux per the card.
Output
QUESTION: <what behavior/shape was probed>
OBSERVED: <the real value/shape — paste the actual output: the JSON, the return, the stack>
HOW: <one-shot REPL | tmux console | debugger> — <the command used>
CONTRACT NOTES: <any divergence from what the spec/types claimed — or "matches">
Observe and report; don't fix. If the app won't boot or a real dependency is missing, report exactly what's blocking.
Related Skills
jaisonerick/assess-effectiveness
tools
VerifiedTrustedCommunity
Assess how the LATEST spec-plugin version is performing across every previous session that invoked it — aggregate run efficiency (thinking%, compactions, exploration-vs-skills, preload firing, fresh-per-story), process adherence, and recurring spec-quality issues — then propose concrete, evidence-backed improvements for the NEXT version (plugin skills/agents/hooks, and spec/process patterns). Read-only: proposes, never self-modifies. Not tied to a single run.
SKILL.mdUpdated Jun 9, 2026
jaisonerick/verify-symbol
development
VerifiedTrustedCommunity
Confirm whether a code symbol (method/class/field/endpoint/flag) actually exists and return its REAL signature + definition location — or the nearest match. Uses LSP/introspection, never grep-spelunking. Cheap and fast.
SKILL.mdUpdated Jun 7, 2026
jaisonerick/trace-flow
development
VerifiedTrustedCommunity
Walk one value or action end-to-end across every layer/hop — go-to-definition by go-to-definition, or with a debugger breakpoint — and report the real state transitions and where the contract/shape diverges. The workhorse for architecture sketches and cross-layer debugging.
SKILL.mdUpdated Jun 7, 2026
jaisonerick/setup-env
testing
VerifiedTrustedCommunity
Bring a fresh worktree/checkout to a runnable state — verify base HEAD, copy gitignored files (.env), allocate per-agent DB/test env, install deps, run the smoke gate. Deterministic, mechanical. Reports a single ready/blocked verdict.
SKILL.mdUpdated Jun 7, 2026