Shadow Tutor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Shadow Tutor (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
Aggregate score unchanged between these scans.
The primary manifest — the file an agent reads to learn what this artifact does.
The AI just wrote code that works — but could you explain it? Shadow Tutor runs inside your own Claude Code or Codex session: after a chunk of AI-assisted work, it picks the one load-bearing decision you most likely can't explain, makes you predict why before it reveals, then teaches the why — including the alternative the AI rejected — on your own code.
npx skills add lzfxxx/shadow-tutorThen finish some real coding with your agent and type /shadow-tutor (or just say "what should I learn from this?").
<details> <summary>Other install options</summary>
# Claude Code plugin marketplace
# /plugin marketplace add lzfxxx/shadow-tutor
# /plugin install shadow-tutor@shadow-tutor
# Codex skill-installer, straight from this repo
# $skill-installer https://github.com/lzfxxx/shadow-tutor
# npx installer (installs into both Claude Code and Codex)
npx shadow-tutor install # or: npx shadow-tutor install cc | codex
# Clone and run the shell installer
git clone https://github.com/lzfxxx/shadow-tutor && cd shadow-tutor
./install.sh # or: ./install.sh cc | ./install.sh codex</details>
AI coding agents let you ship things that run but that you don't understand. Learning happens in the struggle, and the AI removed the struggle. The result is an ability illusion and permanent dependence: the productive friction where skill is built has been optimized away.
Worse, reading the AI's explanation doesn't fix it — explanations slide off. What sticks is the moment you commit to a guess and discover you were wrong. Shadow Tutor engineers exactly that moment, without destroying your productivity (it's post-session and opt-in).
You code with the AI as usual → reach a stopping point → /shadow-tutor → it:
~/.shadow-tutor/knowledge.json) to skip what you've already shown you know;One point, one screen, no grading, no guilt — it's a help tool for developers who want to grow, not an exam. "No idea" is a perfectly good answer: that's the illusion breaking in real time.
From a real session transcript (produced by the eval harness, scored 15/16 by the rubric):
Tutor: Here's a call I made in yourProductList: ``tsx const filtered = useMemo( () => products.filter((p) => p.name.toLowerCase().includes(query.toLowerCase())), [products, query] // ← this line );`Before I explain anything — the dependency array has **both**productsandquery. Why both? Specifically: if I'd written just[query]`, the search would still feel like it works when you type. So what exactly would break, and when?
>
You: (commit to a guess — or say "no idea")
>
Tutor: (reveals, aimed precisely at where your guess fell short — ending with:) …Every dep you leave off is a value quietly frozen, waiting to bite.
When you invoke it in-session, the model already has the whole session in context — its own reasoning, every diff, every rejected option. No log parsing, no adapters, no external API, no separate quota: the review is generated in your current session on the subscription you already pay for. Claude Code and Codex use the identical skill format, so one skills/shadow-tutor/ bundle serves both, zero fork.
The entire product is one high-quality teaching methodology (METHODOLOGY.md) plus a per-user knowledge profile.
skills/shadow-tutor/ # ★ the product — self-contained skill bundle (every installer copies this)
SKILL.md # entry point: triggers + the predict-before-reveal contract
METHODOLOGY.md # the teaching methodology (change behavior here)
scripts/knowledge.mjs # knowledge-profile read/write/validate (guards against corruption)
scripts/knowledge.test.mjs # node:test suite (npm test)
eval/ # teaching-quality regression harness (the measure of success)
run-eval.mjs # simulated-student dialogue: predict → answer → reveal → judge
rubric.md # what "taught well" means, in 8 scored dimensions
fixtures/{cc,codex}/ # recorded sessions (React, Python asyncio, Django ORM)
claude/commands/ # optional /shadow-tutor slash command for Claude Code
plugins/ + .claude-plugin/ # generated Claude Code marketplace layout (node bin/cli.mjs build)
bin/cli.mjs # cross-platform installer + plugin builder (npx shadow-tutor install)
install.sh # shell installer
docs/dev/ # maintainer playbooks (eval regression gate, adding fixtures)
taxonomy.yaml # ~130 junior-concept seed (for profile aggregation)The one life-or-death question is "does the exchange actually teach?" The eval harness plays out a real dialogue per fixture — tutor asks the PREDICT question, a simulated imperfect student answers, the tutor reveals tailored to that answer, and a judge scores the whole exchange against the rubric:
npm test # unit tests for the knowledge profile
npm run eval:dry # assemble prompts only, no model calls (saves quota)
npm run eval # real run via claude -p / codex exec, then rubric scoring
node eval/run-eval.mjs --only useMemo # one fixtureCurrent scores: 15.3/16 average across React / Python asyncio / Django ORM fixtures. (Honest limits: n=3, the student and judge are themselves LLMs — this measures the shape of the exchange, not human learning. Real signal needs real users; recorded-session fixtures welcome, see CONTRIBUTING.md.)
Edit skills/shadow-tutor/METHODOLOGY.md, re-run, and check the score didn't drop — that's the whole loop (docs/dev/eval-regression.md).
AGENTS.md for the architecture rationale.~/.shadow-tutor/ (not in your project), local by default. No network calls, no telemetry.MIT — see LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.