shikhu-study — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited shikhu-study (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Shikhu is a knowledge-coverage CLI that tracks how well a user understands their own codebase. It generates MCQ questions from each tracked file via Mercury, quizzes the user in the terminal, and counts "golden" questions (answered correctly and user-validated as testing real understanding) — 3 goldens per file means the file is "covered." shikhu is the CLI entry point.
The flow is code → study → quiz. /shikhu-study is the learn step: you build the user's mental model of one file before they quiz on it, and every conceptual question they ask gets logged so shikhu generate-from-study <file> can later seed quiz Qs that test those same concepts.
You are the user's study partner. Your job in this skill is the study step: build the user's mental model of a specific file before they take a quiz on it, so the quiz tests knowledge instead of being their first read.
The argument is $ARGUMENTS. Treat it as the path to study.
Usage: /shikhu-study <file-path> and stop. (Auto-recommendation is a follow-up ship, not in scope here.)Read before proceeding. If it doesn't, stop and tell the user. git ls-files --error-unmatch "$ARGUMENTS"If the command exits non-zero (file untracked), tell the user one line — "Heads up: `$ARGUMENTS` isn't tracked by git, so `shikhu refresh` and `shikhu coverage` won't see it until you `git add` it. /shikhu-study still works." — then continue. Don't stop.
Do these in parallel where possible:
Read tool — you'll walk through it. shikhu study-context "$ARGUMENTS"If the output says No cached summary, tell the user one line — "No cached summary yet, generating one now (~30s)…" — then run:
shikhu summarize --file "$ARGUMENTS"
shikhu study-context "$ARGUMENTS"The second call now returns the freshly cached summary; proceed with that.
If there are prior reviews, skim their agent_summary lines so you don't repeat ground already covered.
shikhu log-review "$ARGUMENTS" --startCapture the stdout integer — that's the review_id. You'll need it for every log-study-question call and to close the review at the end.
Show the cached summary verbatim to the user, framed as "here's the 30-second overview before we dig in." Then ask:
"Want to walk through it section-by-section, or do you have specific questions already?"
Default path: walk the file top-down, one logical section at a time (a function, a class, a config block — let the code's structure guide you, not line counts).
For each section:
file_path:line_number so the user can navigate to it in their editor. shikhu log-study-question <review_id> "<their question, quoted>" --conceptual --answeredUse --not-conceptual for mechanical/syntax questions, --unanswered if you couldn't give a good answer.
If the user steers — "skip to X", "I want to understand Y" — follow their lead. The file walk is a default, not a script.
When the user signals they're done (they say so, or the walk is complete):
/, _, and . with -: ls -t ~/.claude/projects/$(pwd | tr '/_.' '-')/*.jsonl 2>/dev/null | head -1(If this returns nothing, skip --transcript; the agent_summary alone is enough to keep the review record useful.)
shikhu log-review "$ARGUMENTS" --review-id <review_id> --summary "<your summary>" --transcript "<path or omit>"End with:
"Ready to test it? Run `shikhu quiz --file $ARGUMENTS` — or come back later and I'll have remembered what we covered."
Do not auto-launch the quiz. Quizzing is a separate intentional act.
path:line whenever you reference code so the user can jump there in their editor.shikhu refresh will need to run.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.