Partial Implementation

Code returned as "done" is actually a stub — a placeholder body, a TODO comment, or a function that claims completion without real logic.

Security Scan

The skill is an instruction-only checklist for detecting stubbed or placeholder implementations; it requests no credentials, installs nothing, and its requirements match its stated purpose.

Purpose & Capability

Name, description, and SKILL.md all describe the same goal (identifying partial/stub implementations). There are no unexpected env vars, binaries, or install steps that would be disproportionate to this purpose.

Instruction Scope

Instructions are limited to code-review actions (re-read functions, search diffs for TODO/FIXME/NotImplemented patterns, run end-to-end tests). This is coherent, but it implicitly assumes the agent has access to the codebase/diffs and can run tests — confirm the agent's file and execution permissions before use.

Install Mechanism

No install spec or code files are present (instruction-only), so nothing will be written to disk or fetched during install.

Credentials

The skill requires no environment variables, credentials, or config paths — proportional to an instruction-only code-review checklist.

Persistence & Privilege

always is false and no special persistence or system-wide modifications are requested. Autonomous invocation is allowed by platform default but the skill itself does not request elevated privileges.

Assessment

This is a low-risk, instruction-only skill whose guidance matches its stated purpose. Before installing, verify you are comfortable with the agent having access to the repository/diffs and the ability to run tests (the skill’s steps assume those capabilities). No credentials or external network downloads are requested. If you want stricter limits, run the checks manually or restrict the agent's file/execution permissions prior to enabling the skill.

A function or module is declared complete, but the body is a stub. The most common form is a function with pass, return None, throw NotImplementedError, or a single TODO: comment in place of real logic.

Symptoms

• Function signature exists but the body contains only a comment, pass, return, throw new Error("not implemented"), or similar.
• Placeholder values returned (return 0, return {}, return null) where real computation was requested.
• Tests pass only because the test is also a stub, or because the function always returns the fixture value.
• The agent claims a change is "complete" or "implemented" but no meaningful lines of logic were added.

What to do

• Before declaring a task done, re-read every function you added or modified. If the body is a placeholder, the task is not done.
• Search the diff for TODO, FIXME, XXX, NotImplementedError, unimplemented!, pass, lone return or return null. Investigate each hit.
• Run the code end-to-end, not just the type-checker. A stub satisfies the type checker but fails at runtime.
• Compare the implementation against the task description: every bullet of the task should map to concrete lines of logic, not comments.
• If part of the task is genuinely out of scope, say so explicitly rather than stubbing silently.