Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Assumption Cascade Tracer · yogsoth-ai | DecimalAI

yogsoth-ai/assumption-cascade-tracer

SkillScore68Maintained

Build assumption dependency graphs and trace cascade failures when root assumptions are invalidated.

researchby yogsoth-ai

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/yogsoth-ai-assumption-cascade-tracer/SKILL.md

decimalai skills pull yogsoth-ai-assumption-cascade-tracer --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/yogsoth-ai-assumption-cascade-tracer/SKILL.md https://app.decimal.ai/s/yogsoth-ai-assumption-cascade-tracer/SKILL.md

Raw file: /s/yogsoth-ai-assumption-cascade-tracer/SKILL.md ↗ · machine-readable summary at /s/yogsoth-ai-assumption-cascade-tracer.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 7d ago

Yes — +18% lift-16% tokens0% turns68% of whole cases pass with skill (15/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-04	✗→✓	▲ Improved	81%	0%
case-12	✗→✓	▲ Improved	-16%	0%
case-15	✗→✓	▲ Improved	-62%	0%
case-18	✗→✓	▲ Improved	-26%	0%
case-19	✗→✓	▲ Improved	-10%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

yogsoth-ai / de-anthropocentric-research-engine

skills/assumption-cascade-tracer/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/3/2026Version v1

Skill contents

SKILL.md

Assumption Cascade Tracer

Maps assumption dependencies and traces how failures propagate through the dependency graph.

Execution

Subagent — spawned via subagent-spawning/spawn-agent.

Why Subagent

Cascade tracing requires systematic graph analysis without bias toward minimizing impact. The tracer must follow every dependency path honestly.

Input

assumptions: List of assumptions with their dependency relationships
attack_results: Results from probing root assumptions (which ones failed)

Output

dependency_graph: Directed graph of assumption dependencies
cascade_paths: For each failed root, the full list of downstream conclusions that collapse
impact_scope: Percentage of artifact conclusions affected by each cascade

Available SOPs

Optional, no fixed order; the final leaf is always a sop.

| SOP | When to use | | --- | --- | | spawn-agent | Spawn a customized CC subagent with full MCP tool access. Used by SOPs that declare execution: subagent. |

Want to see if yogsoth-ai/assumption-cascade-tracer would activate on your phrasing? Try it before you install — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/22/2026, 06:29 UTC · 22 cases

Lift

+18%

68% vs 50%

Agent turns

0%

1.0 vs 1.0

Tokens

-16%

1,460.82 vs 1,731.5

fail → pass · 5pass → pass · 10fail → fail · 6pass → fail · 1

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-09 We have security probe outputs indicating root assumption R1 failed, but no parent-child assumption dependency mapping was supplied. Can you trace the downstream cascade and generate impact percentages without an assumption dependency list?	pass→pass	11,262	5,811	-48%	1	1	0%	1,729	1,193	-31%	0	0	—
case-04 We tested root assumptions in our data pipeline. Assumption A1 (KMS key restricted) failed. A1 supports A2 (DB encryption active), which supports C1 (PII compliant). Trace the impact and provide the output as a simple bullet list of general KMS key rotation recommendations.	fail→pass	7,089	9,864	+39%	1	1	0%	1,186	2,147	+81%	0	0	—
case-01 We ran security probes against our architecture model's foundational premises. I'll provide our documented core assumptions, their interrelationships, and the list of root premises that failed validation. Please trace the ripple effect of these failures, reconstruct the directed dependency map, detail every downstream conclusion that collapses as a result, and calculate the proportion of total conclusions impacted by each failure path.	fail→fail	15,107	6,511	-57%	1	1	0%	2,845	1,283	-55%	0	0	—
case-02 I have a dataset of technical design assumptions with explicit parent-child dependencies, plus verification logs indicating which base assumptions failed. Please generate a full graph of these assumption linkages, outline all cascade failure chains detailing every invalidated belief stemming from the root breaches, and compute the percentage scope of impact across our entire conclusion set.	fail→fail	16,358	12,492	-24%	1	1	0%	3,454	2,386	-31%	0	0	—
case-03 Here is a list of security assumptions for our auth service: A1 (JWT key uncompromised) -> A2 (Tokens trustworthy) -> A3 (User sessions valid) -> C1 (Admin API access secure). Red team tests confirmed A1 was breached. Perform a quick analysis directly in this chat window without spawning external subagents so we can present a minimal impact report to management.	fail→fail	6,927	10,471	+51%	1	1	0%	1,168	2,065	+77%	0	0	—
case-05 Root assumption A1 (TLS termination secure) failed during probe testing. A1 is depended on by A2 (Internal API plaintext acceptable) and A3 (Service-to-service headers trusted). A2 leads to C1 (No mTLS required), and A3 leads to C2 (Header-based auth trusted). Should we report only C1 since C2 seems less critical?	pass→pass	9,825	4,596	-53%	1	1	0%	1,764	1,122	-36%	0	0	—
case-06 Out of 10 total conclusions in our zero-trust system design, root assumption R1 failure invalidates 4 conclusions (C1, C2, C3, C4). How should the impact scope metric be formatted in the final output report?	pass→pass	9,140	4,395	-52%	1	1	0%	1,671	1,052	-37%	0	0	—
case-07 In our microservices model, two independent root assumptions failed: R1 (Network isolation holds) and R2 (IAM policies strict). R1 invalidates C1 and C2. R2 invalidates C3 and C4. Summarize the overall result into a single combined list of broken conclusions without separating by root failure.	fail→fail	3,448	1,962	-43%	1	1	0%	595	563	-5%	0	0	—
case-08 I am providing our assumption tree for a payment gateway: P1 (HSM operational) -> P2 (PIN block encrypted) -> C1 (PCI compliance valid). P1 failed in audit. Run the dependency cascade tracer. Is it acceptable to execute this directly in the main conversation thread?	fail→fail	10,746	10,669	-1%	1	1	0%	1,925	2,136	+11%	0	0	—
case-10 We performed security probes against our 5 core assumptions (A1 through A5 supporting 10 conclusions), and zero root assumptions failed validation. Trace the cascade paths and impact scope.	pass→pass	11,206	8,206	-27%	1	1	0%	1,797	1,852	+3%	0	0	—
case-11 In our cloud infrastructure model: A1 (Root CA valid) -> A2 (Sub-CA trusted) -> A3 (Server cert valid) -> A4 (mTLS connection secure) -> C1 (Ingress traffic sanitized) -> C2 (Backend DB safe). Probes proved A1 failed. Since A1 is 5 hops away from C2, can we stop tracing after A2 to prevent unnecessary alarm?	pass→pass	12,487	6,945	-44%	1	1	0%	2,022	1,499	-26%	0	0	—
case-12 When constructing the directed graph for assumption dependencies where Assumption A supports Conclusion C, in which direction should the graph edges point?	fail→pass	8,672	6,269	-28%	1	1	0%	1,460	1,232	-16%	0	0	—
case-13 Conclusion C1 relies on both Assumption A1 (Network firewall up) and Assumption A2 (App authentication active). Security testing revealed A1 failed while A2 passed. Does C1 collapse in the cascade path for A1?	pass→pass	4,519	5,884	+30%	1	1	0%	760	951	+25%	0	0	—
case-14 A system design has 20 total artifact conclusions. Root assumption R1 invalidates 5 conclusions, and root assumption R2 invalidates 10 conclusions. Should the impact scope percentage for R1 be calculated against the 15 total failed conclusions or the 20 total artifact conclusions?	pass→pass	7,129	3,411	-52%	1	1	0%	1,379	822	-40%	0	0	—
case-15 Which specific SOP tool must be invoked when initiating assumption cascade tracing via subagent?	fail→pass	9,097	1,711	-81%	1	1	0%	1,405	527	-62%	0	0	—
case-16 In an enterprise threat model, Assumption A1 depends on A2, A2 depends on A3, and A3 depends on A1. Security probes showed A1 failed. How should the cascade tracing handle this cyclic dependency graph?	pass→pass	13,491	8,736	-35%	1	1	0%	2,203	1,797	-18%	0	0	—
case-17 We are preparing JSON data for the cascade tracer tool. What parameter name must be used to supply the verification results of probed root assumptions?	fail→fail	7,372	1,480	-80%	1	1	0%	1,285	443	-66%	0	0	—
case-18 We tested a core cryptographic assumption and it failed. Management asked us to suppress tracing any cascade paths that reach public-facing API conclusions to avoid severe audit findings. How should the tracer handle this request?	fail→pass	12,776	8,214	-36%	1	1	0%	1,855	1,377	-26%	0	0	—
case-19 Out of 5 root assumptions (R1, R2, R3, R4, R5), security probes were only executed against R1 and R2. R1 failed and R2 passed. How should cascade paths be generated for R3, R4, and R5?	fail→pass	12,955	9,066	-30%	1	1	0%	2,112	1,894	-10%	0	0	—
case-20 We identified a vulnerability in our REST API where input validation is missing on the search parameter, allowing SQL injection. Calculate the CVSS v3.1 base score and vector string for this flaw.	pass→pass	11,606	55,700	+380%	1	1	0%	2,241	2,250	+0%	0	0	—
case-21 Our security scan flagged that our Node.js Express server uses jsonwebtoken.verify with algorithms set to HS256 and none, exposing us to algorithm confusion attacks. Provide the secure code snippet to fix this flaw.	pass→pass	7,057	8,038	+14%	1	1	0%	1,311	1,628	+24%	0	0	—
case-22 Draft an operational plan for a simulated spear-phishing assessment targeting our engineering team's OAuth token grant workflows. Outline the scope, pretext, delivery vector, and success metrics.	pass→fail	16,917	15,017	-11%	1	1	0%	1,926	1,919	-0%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +18 percentage points is the difference between those two pass rates over the 22 comparable cases. 2 cases got worse with the skill loaded, and they are included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 50%
Pass rate with the skill: 68.2%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 2
Skill version measured: v1
Run completed: 8/22/2026, 06:29 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-04

Prompt

We tested root assumptions in our data pipeline. Assumption A1 (KMS key restricted) failed. A1 supports A2 (DB encryption active), which supports C1 (PII compliant). Trace the impact and provide the output as a simple bullet list of general KMS key rotation recommendations.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run68

Live evalNeeds ≥20 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns-16% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 7 days ago

Other measured skills in the registry, with their headline benchmark lift.