Goodcode
Portable exhaustive multi-agent audit/review protocol: roles, adversarial verify, loop-until-dry.
Test report
- Verdict
- Tested · Works
- Score
- Tested
- Jul 16, 2026
- Environment
- Claude Code 2.x (agent harness)
- Upstream re-checked
- Aug 10, 2026 · be0bd23
A/B'd on a throwaway 34-line Python file with a planted SQL injection, a missing-authz delete, and an off-by-one bug: unassisted baseline found the bugs but buried the missing-authz issue as a vague aside, while following the skill's role/verify/score protocol surfaced it as a verified, severity-ranked IDOR-shaped finding and raised a genuinely new open question (is_admin field exposure) baseline never touched.
Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works
- Installs cleanly 5/5
- Triggers reliably 5/5
- Output vs. baseline 8/10
- Docs & honesty 4/5
What Goodcode does
A host-agnostic orchestration protocol (Claude Code, Codex, Cursor, OpenCode/OpenHands) for exhaustive audits, deep reviews, multi-source research, or large migrations: recon, a cheap baseline pass, a-priori worker roles cast by routing, adversarial refute-by-default verification, loop until no new findings appear, then dedup/score/synthesize with declared coverage caps. Triggers on '/goodcode', 'be exhaustive', 'orchestrate exhaustively', or any substantial task where completeness matters more than speed; explicitly skips trivial or conversational turns.
How to install Goodcode
git clone https://github.com/SpinaBuilds/goodcode.git
mkdir -p ~/.claude/skills
cp -r goodcode ~/.claude/skills/goodcode
Skills live in ~/.claude/skills/ (global) or .claude/skills/
(per-project). Restart Claude Code after installing.
Commands — how to trigger Goodcode
-
/goodcodePortable exhaustive multi-agent audit/review protocol: roles, adversarial verify, loop-until-dry.
It also activates on plain-language prompts like these:
-
Be exhaustive: find every bug in this file, not just the obvious ones -
Do a deep adversarial review of this migration before I merge it -
Orchestrate a full multi-pass audit of this authentication module
Frequently asked questions
- Is the Goodcode skill free?
- Yes. The skill itself is free from SpinaBuilds/goodcode. SkillProof publishes the install command and an independent test verdict at no cost.
- Does Goodcode work with Claude Code?
- We tested it with Claude Code 2.x (agent harness) on Jul 16, 2026. Verdict: Tested · Works. A/B'd on a throwaway 34-line Python file with a planted SQL injection, a missing-authz delete, and an off-by-one bug: unassisted baseline found the bugs but buried the missing-authz issue as a vague aside, while following the skill's role/verify/score protocol surfaced it as a verified, severity-ranked IDOR-shaped finding and raised a genuinely new open question (is_admin field exposure) baseline never touched.
- What is the Goodcode SkillProof Score?
- 8.8/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 8/10, docs & honesty 4/5.
- How do I install Goodcode?
- Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
- Can I use Goodcode with Cursor, Copilot, Gemini CLI, Codex or other AI tools?
- The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.