New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Audit Contract Drift

by ben-manes in ben-manes/caffeine

Find places where documented API contracts and the implementation diverge

Apache-2.0Auto-check passedBackend & APIs

Install Audit Contract Drift

skills CLI
$ npx skills add ben-manes/caffeine --skill audit-contract-drift -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install ben-manes/caffeine audit-contract-drift --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/ben-manes/caffeine.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.claude/skills/audit-contract-drift .claude/skills/audit-contract-drift && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
audit-contract-drift
GitHub stars
18k
Token cost
~1.1k tokens
SKILL.md length
531 words
Files
1
Skills in repo
33
Repo updated
First seen
Licence
Apache-2.0

At a glance

Find places where documented API contracts and the implementation diverge

  • Tasks that involve API design
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Audit Contract Drift is an agent skill from ben-manes/caffeine. Find places where documented API contracts and the implementation diverge

Its SKILL.md is about 1.1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Backend & APIs, covering API design. It works with Java. The repository describes itself as: A high performance caching library for Java. The licence is Apache-2.0.

When your agent uses it

  • Tasks that involve API design

Example prompts

  • “/audit-contract-drift”

What it can do on your machine

Read from SKILL.md and the folder at commit e972fb0. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Audit Contract Drift loads about 1.1k tokens when it runs. Until then it costs about 24 tokens; SKILL.md has 531 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~24
When it runs · the whole SKILL.md, loaded when a task matches
~1.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from ben-manes/caffeine at commit e972fb0, republished under its Apache-2.0 licence (© ben-manes). 531 words, ~1,149 tokens.

Download SKILL.mdSave it as .claude/skills/audit-contract-drift/SKILL.md (or your agent's skills folder).
name
audit-contract-drift
description
Find places where documented API contracts and the implementation diverge
context
fork
agent
auditor
disable-model-invocation
true

Most audits read code; this one reads documentation first and then traces each promise to every implementation path that should honor it. The bugs caught here are not concurrency or arithmetic defects — they are quiet contradictions between what the javadoc promises and what the code does.

Build a list of behavioral promises from public API docs, then trace each one to every code path that should honor it.

Sources of contracts to enumerate:

  • Caffeine.java — every <b>Note:</b> and <b>Warning:</b> block in a builder method's javadoc. Pay particular attention to:
    • weakKeys, weakValues, softValues — equality semantics flip to identity (==) for the configured strength
    • expireAfter*, refreshAfterWrite — duration constraints, what "expired" means at boundaries
    • maximumSize, maximumWeight — eviction triggering and amortization
    • removalListener, evictionListener — when and how notifications fire
  • Cache.java, LoadingCache.java, AsyncCache.java, AsyncLoadingCache.java — javadoc of every method, especially "must", "will", "guarantees", "for any reason" language.
  • Policy.java — every method's documented behavior.
  • Weigher.java, Expiry.java, RemovalListener.java, RemovalCause.java — user-facing contracts referenced by the cache.
  • Internal obligations — "callers must" contracts stated in .claude/rules/*.md and in internal-class javadoc across all modules (e.g. jcache's EventDispatcher requires every publishing thread to drain via awaitSynchronous/ignoreSynchronous; async operations must register with the in-flight set). Enumerate each obligation, then verify every call site honors it — including executor-thread and refresh paths that don't flow through the obvious entry points.

For each contract, record the exact wording, the configurations that activate it, and the set of operations affected.

Then trace each promise through every code path that should honor it:

  • Direct API calls on Cache / LoadingCache / AsyncCache
  • asMap() view methods (size, isEmpty, containsKey, containsValue, get, put, remove(k), remove(k,v), replace, compute*, merge, equals, hashCode)
  • asMap().keySet() / values() / entrySet() — contains, remove, removeAll, retainAll, removeIf, iterator, spliterator
  • Bulk operations (putAll, getAll, getAllPresent, invalidateAll)
  • AsyncCache.synchronous() round-trip — does the sync view honor the same contract as the async cache?
  • Serialization round-trip — does the deserialized cache honor the same promises about expiration durations, loader presence, etc.?

A path that uses a different equivalence, ordering, or visibility from what the contract promises is a contract drift finding. So is a path that silently downgrades a configuration on round-trip.

Show full SKILL.md (191 more words)Show less

Common drift patterns to check explicitly:

  • Identity vs. equals on weak/soft caches: weakKeys/weakValues/ softValues promise identity, but view collections that use o.equals(value) or Collection.contains(value) may apply the user's equality semantics instead.
  • Cardinality vs. presence asymmetry: methods documented as treating in-flight async values as absent must align with size, isEmpty, equals, hashCode, and iterators on the same view.
  • Notification "for any reason": removalListener documented to fire for any cause, but async paths may drop notifications for null or exceptional completions.
  • Cross-version serialization: serialized fields renamed or defaulted differently across versions can silently lose configuration or throw on round-trip.
  • Same-instance return semantics: e.g., compute(k, (k,v) -> v) is documented one way but updates timestamps/weight regardless.
  • size() documented as estimate: this is an explicit out — verify it is actually documented as an estimate everywhere it diverges from logical presence.
  • Synchronous vs. asynchronous view divergence: the synchronous() view's asMap() may treat in-flight entries inconsistently across query, mutation, and cardinality methods.

Each finding should anchor both sides of the drift — the source of the contract (file + javadoc snippet) and the divergent implementation (file + method) — and include a minimal user-observable scenario where the docs and the code disagree.

© ben-manes, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .claude/skills/audit-contract-drift of ben-manes/caffeine.

Open the folder on GitHubat commit e972fb0

Compare with similar skills

Audit Contract Drift next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Audit Contract Drift compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Audit Contract Drift this skillben-manes/caffeine18k—~1.1kAutomated safety check: PassApache-2.0
Webkit API Developmentandroidx/androidx6.1k—~3.7kAutomated safety check: PassApache-2.0
Azsdk Common Generate SDK LocallyAzure/azure-sdk-for-android121—~1.5kAutomated safety check: PassMIT
REST API Contract Reviewdecebals/claude-code-java751—~2.8kAutomated safety check: PassMIT
Quarkus Patternsaffaan-m/ECC276k1 repos~5.4kAutomated safety check: PassMIT
Quarkus Patternsaffaan-m/ECC276k—~6.1kAutomated safety check: PassMIT

Similar skills

  • Webkit API Development

    androidx/androidx

    Step-by-step guide for implementing AndroidX WebKit APIs in frameworks/support/webkit/ after boundary interface roll.

    6.1k GitHub stars~3.7k tokensUpdated today
    Backend & APIsAuto-check passed

  • Azsdk Common Generate SDK Locally

    Azure/azure-sdk-for-android

    Official

    Generate, build, and test Azure SDKs locally from TypeSpec with automatic customization.

    121 GitHub stars~1.5k tokensUpdated 4 mo ago
    Backend & APIsAuto-check passed

  • REST API Contract Review

    decebals/claude-code-java

    Reviews REST API design for correct HTTP verbs, versioning, DTO use, consistent responses and backward compatibility before an API change ships.

    751 GitHub stars~2.8k tokensUpdated 1 mo ago
    Backend & APIsAuto-check passed

  • Quarkus Patterns

    affaan-m/ECC

    Quarkus 3.x LTS architecture patterns with Camel for messaging, RESTful API design, CDI services, data access with Panache, and async processing.

    276k GitHub starsUsed in 1 repo~5.4k tokens
    Backend & APIsAuto-check passed

  • Quarkus Patterns

    affaan-m/ECC

    Quarkus 3.x LTS architecture patterns with Camel for messaging, RESTful API design, CDI services, data access with Panache, and async processing.

    276k GitHub stars~6.1k tokensUpdated today
    Backend & APIsAuto-check passed

  • API Design Safety

    doccker/cc-use-exp

    当设计或修改 REST API 响应结构、处理 API 返回值时触发。防止 API 设计缺陷导致的字段错位、类型歧义等问题。

    1.1k GitHub stars~962 tokensUpdated 1 mo ago
    Backend & APIsAuto-check passed

More from ben-manes/caffeine

All 33 skills in this repo

  • Caffeine Cache Optimization Experiments

    ben-manes/caffeine

    Runs controlled JMH experiments on the Caffeine cache to find shared contention and hot-path waste, then reviews correctness and returns a reviewable patch.

    18k GitHub stars~2.6k tokensUpdated yesterday
    Auto-check: notes

  • Git History Bug Audit

    ben-manes/caffeine

    Audits a module by walking its git history commit by commit, tracking unresolved issues forward, and reporting the ones that survive to HEAD as findings.

    18k GitHub stars~3.3k tokensUpdated yesterday
    Auto-check passed

  • Adversarial Codebase Audit

    ben-manes/caffeine

    Runs a hostile review of the Caffeine Java caching library with parallel subagents that get no design docs, then challenges and consolidates their findings.

    18k GitHub stars~1.9k tokensUpdated yesterday
    Auto-check: notes

  • Caffeine Performance Audit

    ben-manes/caffeine

    Audits the Caffeine cache source for hot-path costs such as allocations, contention and memory layout, reporting only findings tied to specific lines.

    18k GitHub stars~559 tokensUpdated yesterday
    Auto-check passed

  • Audit Sibling Divergence

    ben-manes/caffeine

    Compares code paths that should behave the same, such as sync and async cache methods, and requires a concrete scenario where the two observably disagree.

    18k GitHub stars~4.3k tokensUpdated yesterday
    Auto-check: notes

  • Climber Step Minimization

    ben-manes/caffeine

    Prices each step of the window climber algorithm by disabling it in turn, to find steps that no longer earn their keep and branches that no longer fire.

    18k GitHub stars~3k tokensUpdated yesterday
    Auto-check: notes

Works with

Categories

Questions about Audit Contract Drift

What does Audit Contract Drift do?

Find places where documented API contracts and the implementation diverge. Audit Contract Drift is an agent skill from ben-manes/caffeine.

When should I use Audit Contract Drift?

Audit Contract Drift fits situations like: tasks that involve API design.

How do I install Audit Contract Drift in Claude Code?

Run `npx skills add ben-manes/caffeine --skill audit-contract-drift -a claude-code`. Or copy the skill folder (.claude/skills/audit-contract-drift in ben-manes/caffeine) into .claude/skills/audit-contract-drift in your project. Claude Code loads it when a task matches its description.

How do I install Audit Contract Drift in Codex?

Run `npx skills add ben-manes/caffeine --skill audit-contract-drift -a codex`. Or copy the skill folder (.claude/skills/audit-contract-drift in ben-manes/caffeine) into .agents/skills/audit-contract-drift in your project. Codex loads it when a task matches its description.

Can I use Audit Contract Drift in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add ben-manes/caffeine --skill audit-contract-drift -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/audit-contract-drift, .gemini/skills/audit-contract-drift, .github/skills/audit-contract-drift and .opencode/skills/audit-contract-drift in your project.

What does Audit Contract Drift need to run?

SKILL.md names no scripts, command-line tools or credentials: Audit Contract Drift is instructions for the agent only.

Does Audit Contract Drift access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Audit Contract Drift safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Audit Contract Drift use?

Audit Contract Drift is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Audit Contract Drift use?

About 1.1k tokens (SKILL.md is roughly 4.6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Audit Contract Drift?

Skills that share tags, products or a category with Audit Contract Drift: Webkit API Development (androidx/androidx, 6.1k stars), Azsdk Common Generate SDK Locally (Azure/azure-sdk-for-android, 121 stars), REST API Contract Review (decebals/claude-code-java, 751 stars) and Quarkus Patterns (affaan-m/ECC, 276k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Audit Contract Drift?

ben-manes (a GitHub user) maintains it in ben-manes/caffeine, which has 17,882 GitHub stars. The repository holds 33 skills in this directory. The repository was last updated on October 9, 2026.

Source: ben-manes/caffeine on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.