scanned 24d ago·osv · gitleaks · opengrep · picklescan + heuristics·full breakdown in the Security tab ↓
Ponytail
Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote. Before writing anything, the agent stops at the first rung that holds:
Does this need to exist? → no: skip it (YAGNI)
Stdlib does it? → use it
Native platform feature? → use it
Installed dependency? → use it
One line? → one line
Only then: the minimum that works
Lazy, not negligent — trust-boundary validation, data-loss handling, security and accessibility are never on the chopping block.
Reported impact vs a no-skill agent: 80–94% less code, 47–77% less cost, 3–6× faster across models.
Install
Portable across Claude Code, Codex, Gemini CLI, OpenCode and more (SKILL-based). With the skills CLI:
npx skills add DietrichGebert/ponytail
Or add it via your agent's plugin/marketplace system. See the repository for exact per-client steps.
✓ Security: Safe · 100100/100 · grade Ascanned 24d ago
✓ no compromise signals12 risk-surface · 6/20 OWASP controls flagged
Compromise signals — malicious or tampered code (leaked secrets, backdoors, a dropped executable) — reduce the score, and known dependency CVEs carry a bounded penalty (they warrant review but never QUARANTINE — update the dependency to clear). Other dangerous-by-capability traits are risk surface, expected for some capabilities. Every finding is mapped to its OWASP control below.
What this capability can do · high confidence (static)
Findings mapped to the OWASP Top 10 for LLM Applications (2025) and the OWASP Machine Learning Security Top 10. Expand any flagged control for the exact findings — compromise reduces the score; expected/risk-surface do not, except a known CVE, which carries a small bounded penalty (high/critical → Review).
OWASP Top 10 for LLM Applications
⚠LLM05Improper Output Handlinghigh
Code that pipes model/user output into shell, eval, SQL or paths unsafely.
•Suspicious code patterns — OS command execution · DietrichGebert-ponytail-14a0d79/benchmarks/agentic/run.py (CWE-78)expected