Agent skill · Security

tribunal

The deep, rarely-convened whole-codebase audit lane. Routed to when the user invokes {{CMD:tribunal}}. Seven gated phases — cost/model, map, roster dispatch, triage, report, approval+filing, telemetry. Costs on the order of millions of tokens; proceeds only after the user acknowledges the estimate; never a required gate; nothing filed or sent without explicit authorization.

arbiterForgegithub.com/arbiterForgeGitHub ↗
claude-codecodexAGPL-3.0
Install
npx skills add arbiterForge/codeArbiter --skill tribunal --agent claude-code

Same command for any agent — swap --agent for codex, cursor, copilot.

Facts
Files in the skill folder: 20
SKILL.md size: 14 KB
Bundled scripts: none
Path: core/surface/skills/tribunal/SKILL.md
Open the folder on GitHub →
Where it comes from
Stars: 138 · +1 this week
Language: Python

Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.

From the SKILL.md

# tribunal The deepest, most expensive review codeArbiter offers — convened rarely, on demand, never as a gate. Routed to when the user invokes `{{CMD:tribunal}}`. Eleven specialist lenses judge the codebase; every finding persists to its own file (plus append-only triage/run logs) under a run dir that survives compaction and disconnects, so the run resumes from disk. ## Pre-flight Read these, or STOP and surface the gap — never guess a command or a path: - `{{PROJECT_DIR}}/.codearbiter/tech-stack.md` — stack, async model, concurrency primitives, test/lint/secrets commands, and, when documented, the tracker command. Stop if the test/lint/secrets commands are missing; do not guess. - `{{PROJECT_DIR}}/.codearbiter/CONTEXT.md` — the `stage:` maturity value and domain vocabulary. - `{{PROJECT_DIR}}/.codearbiter/coding-standards.md` — the conventions lenses judge against. - `{{PROJECT_DIR}}/.codearbiter/security-controls.md` — trust boundaries, approved crypto/secret stores; feeds the appsec and secrets lenses. Absent on some repos — proceed without the security lenses' control-file checks if so. - A git repository must be present. - The reference set under `{{PLUGIN_ROOT}}/skills/tribu

What's inside
Steps it walks through
  1. Pre-flight
  2. Phase 0 — Cost, model & resume · gate: STOP
  3. Phase 1 — Map + judgment overlay · gate: BLOCK
  4. Phase 2 — Roster dispatch (dual output: finding files + summary) · gate: BLOCK
  5. Phase 3 — Triage & per-wave planning · gate: BLOCK
  6. Phase 4 — Report · gate: BLOCK
  7. Phase 5 — Approval & issue filing · gate: BLOCK
  8. Phase 6 — Telemetry · gate: STOP
  9. Hard rules
Ships with 19 files
  • references/ai-markers.md
  • references/cost-and-models.md
  • references/finding-record.md
  • references/issue-filing.md
  • references/lenses/appsec.md
  • references/lenses/architecture.md
  • references/lenses/coverage.md
  • references/lenses/infra.md
  • references/lenses/migration.md
  • references/lenses/observability.md
  • references/lenses/performance.md
  • references/lenses/reliability.md
  • references/lenses/secrets-supply.md
  • references/lenses/test-fidelity.md
  • references/lenses/typesafety.md
  • references/report.md
  • references/schemas.md
  • references/telemetry.md
  • references/triage.md
More from codeArbiter
All skills →
About this skill
What does the tribunal skill do?

The deep, rarely-convened whole-codebase audit lane. Routed to when the user invokes {{CMD:tribunal}}. Seven gated phases — cost/model, map, roster dispatch, triage, report, approval+filing, telemetry. Costs on the order of millions of tokens; proceeds only after the user acknowledges the estimate; never a required gate; nothing filed or sent without explicit authorization.

How do I install it?

Run `npx skills add arbiterForge/codeArbiter --skill tribunal --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.

Where does this skill come from?

From arbiterForge/codeArbiter, a repository with 138 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.

Is a popular skill a good skill?

Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.

Keep going