New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Audit Third Party Contracts

by ben-manes in ben-manes/caffeine

Verify every third-party and sharp-edged JDK API usage against the contract the upstream documentation actually states

Apache-2.0Auto-check passed

Install Audit Third Party Contracts

skills CLI
$ npx skills add ben-manes/caffeine --skill audit-third-party-contracts -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install ben-manes/caffeine audit-third-party-contracts --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/ben-manes/caffeine.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.claude/skills/audit-third-party-contracts .claude/skills/audit-third-party-contracts && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
audit-third-party-contracts
GitHub stars
18k
Token cost
~943 tokens
SKILL.md length
447 words
Files
1
Skills in repo
33
Repo updated
First seen
Licence
Apache-2.0

At a glance

Verify every third-party and sharp-edged JDK API usage against the contract the upstream documentation actually states

  • Works in 4 steps: Enumerate touchpoints → Extract the assumed contract → Verify against the upstream contract → …
  • SKILL.md covers Step 1: Enumerate touchpoints, Step 2: Extract the assumed…, Step 3: Verify against the… and Step 4: Construct the…
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Audit Third Party Contracts is an agent skill from ben-manes/caffeine. Verify every third-party and sharp-edged JDK API usage against the contract the upstream documentation actually states

Its SKILL.md is about 940 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It works with Java. The repository describes itself as: A high performance caching library for Java. The licence is Apache-2.0.

Example prompts

  • “/audit-third-party-contracts”

Workflow steps

4 steps, taken from the step headings in SKILL.md.

  1. Enumerate touchpoints
  2. Extract the assumed contract
  3. Verify against the upstream contract
  4. Construct the violating scenario

What it can do on your machine

Read from SKILL.md and the folder at commit e972fb0. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Audit Third Party Contracts loads about 943 tokens when it runs. Until then it costs about 37 tokens; SKILL.md has 447 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~37
When it runs · the whole SKILL.md, loaded when a task matches
~943

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from ben-manes/caffeine at commit e972fb0, republished under its Apache-2.0 licence (© ben-manes). 447 words, ~943 tokens.

Download SKILL.mdSave it as .claude/skills/audit-third-party-contracts/SKILL.md (or your agent's skills folder).
name
audit-third-party-contracts
description
Verify every third-party and sharp-edged JDK API usage against the contract the upstream documentation actually states
context
fork
agent
auditor
disable-model-invocation
true

Audit uses of external libraries and sharp-edged JDK APIs against the contract the upstream documentation actually states — not the contract the call site assumes. This lens is distinct from the cache-correctness lenses: the bugs are in the seam between our code and someone else's semantics (dispose-on-error, merge-less collectors, empty timed buffers, live-view iteration windows).

Scope: examples/*/src/main/java/, simulator/src/main/java/, jcache/src/main/java/, guava/src/main/java/. The core is nearly dependency-free; include it only for JDK sharp edges.

Step 1: Enumerate touchpoints

From gradle/libs.versions.toml and each module's build file, list the third-party libraries in scope. Grep each module for their package imports, plus these JDK sharp edges: Collectors.toMap/groupingBy, CompletableFuture composition and cancellation, live collection views held across a time window, ServiceLoader/TCCL-dependent lookups, Object.wait/notify handshakes.

Step 2: Extract the assumed contract

For each touchpoint, state what the call site implicitly assumes about:

  • Error path: what happens to the pipeline/subscription/future when user code or the library throws? Is the failure surfaced or swallowed?
  • Degenerate input: duplicate keys, empty batch, null element, zero duration, single element
  • Cancellation/disposal: is it terminal? who observes it? can the structure be reused after?
  • Threading: which thread runs the callback; what ThreadLocal, ordering, or reentrancy assumptions ride on that?
  • Resource lifecycle: close/dispose idempotency, unsubscribe/leak behavior

Step 3: Verify against the upstream contract

Quote the authoritative source — library javadoc for the version pinned in libs.versions.toml, the reactive-streams specification rule, or JDK javadoc. WebFetch the docs when unsure; do not rely on recall. A finding must cite the upstream sentence that contradicts the call site.

High-yield contract families:

  • Reactive streams (RxJava/Reactor): onError is terminal and disposes; a subscriber without an error handler routes to a global hook and silently unsubscribes; timed buffers emit empty lists on every period; a cancelled sink rejects all future emissions; a subject with no observers drops emissions silently
  • Collectors.toMap throws IllegalStateException on duplicate keys without a merge function
  • CompletableFuture: exceptions in *Async stages surface only via the returned future; cancel() does not interrupt the running task; a throw inside whenComplete replaces/suppresses in non-obvious ways
  • Live vs snapshot views: a live keySet/values passed to another operation observes concurrent mutations; removeAll(null) throws NPE
  • ORM/config libraries (Hibernate, Typesafe Config): session/entity lifecycle and reload semantics the integration assumes
Show full SKILL.md (85 more words)Show less

Step 4: Construct the violating scenario

For each contradiction, produce the concrete input or event sequence and the observable damage (hung future, silent data loss, permanent pipeline death, corrupted secondary structure, useless periodic load). Findings without a constructible scenario are suspicions — label them per the auditor contract.

Classify findings with the external-contract category from .claude/docs/finding-taxonomy.md. Also check the module's tests: if the failing scenario is untestable because tests only exercise happy paths (distinct keys, no failures, non-empty batches), report the test gap alongside the bug.

© ben-manes, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .claude/skills/audit-third-party-contracts of ben-manes/caffeine.

Open the folder on GitHubat commit e972fb0

Compare with similar skills

Audit Third Party Contracts next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Audit Third Party Contracts compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Audit Third Party Contracts this skillben-manes/caffeine18k—~943Automated safety check: PassApache-2.0
Brainstormingxpinjection/test-driven-spring-boot11252 repos~2.6kAutomated safety check: PassMIT
Android API Diffgkd-kit/gkd43k—~796Automated safety check: PassGPL-3.0
Video Cover Imageitwanger/toBeBetterJavaer18k—~3.3kAutomated safety check: PassNone
Lancedb Update Lance Dependencylancedb/lancedb12k—~1.1kAutomated safety check: PassApache-2.0
Java SDK E2E Test with Replay Snapshotgithub/copilot-sdk11k—~1.8kAutomated safety check: PassMIT

Similar skills

  • Brainstorming

    xpinjection/test-driven-spring-boot

    You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior.

    112 GitHub starsUsed in 52 repos~2.6k tokens
    Agent WorkflowsAuto-check passed

  • Android API Diff

    gkd-kit/gkd

    Looks up Android framework Java and AIDL APIs across versions with the android-api-diff CLI: signatures, availability, source files and hidden-API access code.

    43k GitHub stars~796 tokensUpdated today
    MobileAuto-check passed

  • Video Cover Image

    itwanger/toBeBetterJavaer

    Generate matched 3:4, 16:9, and 4:3 short-video cover images from toBeBetterJavaer video scripts or AI/Java technical topics.

    18k GitHub stars~3.3k tokensUpdated today
    Media & CreativeAuto-check passed

  • Lancedb Update Lance Dependency

    lancedb/lancedb

    Update LanceDB to a specific Lance release or tag. An agent skill from lancedb/lancedb.

    12k GitHub stars~1.1k tokensUpdated today
    DatabasesAuto-check passed

  • Java SDK E2E Test with Replay Snapshot

    github/copilot-sdk

    Official

    Creates a Java SDK end-to-end test for the Copilot SDK that runs against a recorded YAML snapshot through a replay proxy, so CI needs no real authentication.

    11k GitHub stars~1.8k tokensUpdated today
    Testing & QAAuto-check passed

  • Fory Release

    apache/fory

    Prepare an Apache Fory release candidate from a clean release branch, including the version bump, RC tag, JVM staging, ASF source artifacts, SVN upload, and vote email.

    4.6k GitHub stars~2.9k tokensUpdated today
    Auto-check passed

More from ben-manes/caffeine

All 33 skills in this repo

  • Caffeine Cache Optimization Experiments

    ben-manes/caffeine

    Runs controlled JMH experiments on the Caffeine cache to find shared contention and hot-path waste, then reviews correctness and returns a reviewable patch.

    18k GitHub stars~2.6k tokensUpdated yesterday
    Auto-check: notes

  • Git History Bug Audit

    ben-manes/caffeine

    Audits a module by walking its git history commit by commit, tracking unresolved issues forward, and reporting the ones that survive to HEAD as findings.

    18k GitHub stars~3.3k tokensUpdated yesterday
    Auto-check passed

  • Adversarial Codebase Audit

    ben-manes/caffeine

    Runs a hostile review of the Caffeine Java caching library with parallel subagents that get no design docs, then challenges and consolidates their findings.

    18k GitHub stars~1.9k tokensUpdated yesterday
    Auto-check: notes

  • Caffeine Performance Audit

    ben-manes/caffeine

    Audits the Caffeine cache source for hot-path costs such as allocations, contention and memory layout, reporting only findings tied to specific lines.

    18k GitHub stars~559 tokensUpdated yesterday
    Auto-check passed

  • Audit Sibling Divergence

    ben-manes/caffeine

    Compares code paths that should behave the same, such as sync and async cache methods, and requires a concrete scenario where the two observably disagree.

    18k GitHub stars~4.3k tokensUpdated yesterday
    Auto-check: notes

  • Climber Step Minimization

    ben-manes/caffeine

    Prices each step of the window climber algorithm by disabling it in turn, to find steps that no longer earn their keep and branches that no longer fire.

    18k GitHub stars~3k tokensUpdated yesterday
    Auto-check: notes

Works with

Questions about Audit Third Party Contracts

What does Audit Third Party Contracts do?

Verify every third-party and sharp-edged JDK API usage against the contract the upstream documentation actually states. Audit Third Party Contracts is an agent skill from ben-manes/caffeine.

How do I install Audit Third Party Contracts in Claude Code?

Run `npx skills add ben-manes/caffeine --skill audit-third-party-contracts -a claude-code`. Or copy the skill folder (.claude/skills/audit-third-party-contracts in ben-manes/caffeine) into .claude/skills/audit-third-party-contracts in your project. Claude Code loads it when a task matches its description.

How do I install Audit Third Party Contracts in Codex?

Run `npx skills add ben-manes/caffeine --skill audit-third-party-contracts -a codex`. Or copy the skill folder (.claude/skills/audit-third-party-contracts in ben-manes/caffeine) into .agents/skills/audit-third-party-contracts in your project. Codex loads it when a task matches its description.

Can I use Audit Third Party Contracts in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add ben-manes/caffeine --skill audit-third-party-contracts -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/audit-third-party-contracts, .gemini/skills/audit-third-party-contracts, .github/skills/audit-third-party-contracts and .opencode/skills/audit-third-party-contracts in your project.

What does Audit Third Party Contracts need to run?

SKILL.md names no scripts, command-line tools or credentials: Audit Third Party Contracts is instructions for the agent only.

Does Audit Third Party Contracts access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Audit Third Party Contracts safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Audit Third Party Contracts use?

Audit Third Party Contracts is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Audit Third Party Contracts use?

About 943 tokens (SKILL.md is roughly 3.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Audit Third Party Contracts?

Skills that share tags, products or a category with Audit Third Party Contracts: Brainstorming (xpinjection/test-driven-spring-boot, 112 stars), Android API Diff (gkd-kit/gkd, 43k stars), Video Cover Image (itwanger/toBeBetterJavaer, 18k stars) and Lancedb Update Lance Dependency (lancedb/lancedb, 12k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Audit Third Party Contracts?

ben-manes (a GitHub user) maintains it in ben-manes/caffeine, which has 17,882 GitHub stars. The repository holds 33 skills in this directory. The repository was last updated on October 9, 2026.

Source: ben-manes/caffeine on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.