Fuck My Shit Mountain: an evidence-based AI code audit skill for Codex, Claude Code, Copilot and Gemini

The problem: a project that runs but hides things

Most code review tooling assumes you already know what to look for. Linters check syntax and style. Static analysers check a fixed rule set. Neither tells you that the authentication path has no regression test, or that the retry logic swallows errors, because neither knows what your project is supposed to do.

Fuck My Shit Mountain targets the moment the README describes as "the project runs, but I keep feeling something is buried in the mountain". The skill's job is to make an AI coding agent walk the repository first, then report findings by the dimensions you care about, each with severity, confidence, evidence, impact and a suggested fix plus a regression test. It is aimed at developers who already use Codex, Claude Code, Copilot or Gemini CLI and want the agent's output to look like an audit rather than a chat reply.

The README is direct about the ceiling: an AI audit does not replace manual review, testing or real runtime data. The framing it uses is a colleague who is not afraid to dig through the rubbish heap and queue the risks up for you.

How the skill shapes an agent's audit

The repository ships a standard directory of SKILL.md plus prompts, rubrics and templates. That structure is the mechanism: the agent reads the skill, profiles the project (language, framework, entry points, tests, dependencies, CI, configuration, release files), and only then produces findings.

Two design choices stand out. First, when the user has not named a mode, the skill lists the available modes and recommends directions in the user's current language, so the prompt does not have to hardcode internal mode names. Second, every dimension gets a coverage confidence label of High, Medium, Low or Not assessed, together with a note on which evidence was examined. That label is the most useful part of the output. It separates "I looked and found nothing" from "I did not look", which is exactly where unstructured AI reviews tend to mislead.

The skill also splits confirmed problems from unconfirmed risks, and the README states this is to avoid inflating an absence of findings into a clean bill of health. Output can be Markdown or HTML, and the HTML variant carries a sidebar, score bars, a findings table, a coverage matrix and a remediation plan.

Choosing an audit direction in plain language

There are 25 audit dimensions behind the full mode, and the README's position is that you should not memorise them. You describe the goal and the skill maps it. A pre-release pass pulls in release, stability, observability and configuration. Worries about permissions, secrets and dependencies pull in security, privacy and supply-chain. An LLM application pulls in ai-safety, privacy, cost and observability. A test suite that looks suspiciously green pulls in testing and testing-authenticity.

If you prefer precision, you can name modes directly, for example security, stability, type-safety. The full mode covers all 25. Some dimensions are narrower than the name suggests: fallback looks for silent degradation, empty catch blocks, defensive guessing and swallowed errors, while testing-authenticity looks for over-mocking, tests that only assert implementation details, fake green results and missing real paths. Those two are the ones most likely to surface something a normal review misses, because they target the gap between a passing suite and a working system.

Installing the skill and running a first audit

The README's lazy path is to hand the repository URL to your AI IDE and ask it to install the skill. The manual path is four commands, run from the directory where you want the clone. The third line removes any previous copy, so re-running the sequence is safe and gives you a clean upgrade.

git clone https://github.com/XiNian-dada/Fuck_My_Shit_Mountain.git
mkdir -p ~/.codex/skills
rm -rf ~/.codex/skills/fuck-my-shit-mountain
cp -R Fuck_My_Shit_Mountain/fuck-my-shit-mountain ~/.codex/skills/

After the copy, restart Codex or open a new conversation. The README states that the skill is loaded at that point, not before.

For other agents, the same folder goes to a different location. The README lists ~/.claude/skills/fuck-my-shit-mountain/ or .claude/skills/fuck-my-shit-mountain/ for Claude Code, ~/.copilot/skills/fuck-my-shit-mountain/, ~/.agents/skills/fuck-my-shit-mountain/ or .github/skills/fuck-my-shit-mountain/ for GitHub Copilot, and ~/.gemini/skills/fuck-my-shit-mountain/, ~/.agents/skills/fuck-my-shit-mountain/ or .gemini/skills/fuck-my-shit-mountain/ for Gemini CLI.

A first run is a prompt in the agent's chat, not a command. The README gives this example:

请使用 fuck-my-shit-mountain skill 审计当前项目
我想先做全量审计
报告语言：中文
输出格式：html

That asks for a full audit of the current project, with the report in Chinese and HTML output. The expected result is a profile of the project followed by findings grouped by dimension, each carrying severity, confidence, evidence, impact, a fix suggestion and a regression test, plus the coverage matrix. If you want the report in English, change the language line; the skill follows the language you write in.

What the report actually contains, and the demo page

The score panel covers 7 core dimensions on a 0.0 to 10.0 scale, where a higher number means cleaner. The README's sample output shows Security at 8.0, Stability at 6.0, Performance at 10.0, Testing at 4.0, Maintainability at 7.0, Design at 5.0, Release at 6.0, with an overall of 6.6.

Security        ████████░░  8.0  A
Stability       ██████░░░░  6.0  B
Performance     ██████████  10.0 S
Testing         ████░░░░░░  4.0  C
Maintainability ███████░░░  7.0  A
Design          █████░░░░░  5.0  B
Release         ██████░░░░  6.0  B
─────────────────────────────────────
Overall         ██████░░░░  6.6  B

Two cautions apply to those numbers. They are an illustration in the README, not a measurement of any project. And the score is generated by a language model reading code, so it is an opinion with citations attached, not a metric. The more trustworthy part of the report is the coverage matrix and the evidence lines, because those can be checked.

A static demo of the HTML report is published on GitHub Pages. The README states plainly that the demo content is a fictional audit and that the page is labelled as such at the top, so it shows layout, not results.

Where this approach breaks down

The skill is a set of instructions for a model, so its output inherits every weakness of that model. It can miss a vulnerability entirely, and the coverage matrix will still render. A Low or Not assessed label is the honest signal here, and the README's split between confirmed problems and unconfirmed risks is the same admission in another form. If you read the score panel and skip the matrix, you are using the tool in the way it warns against.

Coverage breadth is also a constraint. Twenty-five dimensions in one pass means each dimension gets a slice of the agent's attention and context budget. A focused run such as security, stability is likely to produce deeper evidence than full, at the cost of not seeing the rest. The README does not document how findings are ranked when two dimensions disagree, and it does not describe any rollback or re-run semantics, so treat each report as a snapshot of one conversation.

Finally, the repository itself is HTML-heavy and ships no retrieved releases. There is nothing here to pin, no versioned artefact and no changelog. You install by copying a folder, which means the version you have is whatever main looked like when you cloned it, and upgrading means repeating the clone and copy steps.

How it differs from a conventional linter or scanner

The obvious alternative is a rule-based analyser such as Semgrep, or a linter like ESLint, or a hosted code scanning service. The difference in approach is fundamental. A rule-based tool evaluates a fixed set of patterns and reports the same result for the same input every time. It can be wired into CI and will fail a build deterministically.

Fuck My Shit Mountain does the opposite. It has no rule engine. It supplies the model with a project profile step, a mode taxonomy, rubrics and report templates, and asks the model to reason about your specific codebase and cite what it read. That buys you findings a rule set cannot express, such as a suspiciously green test suite or a missing rollback path, and it costs you determinism and reproducibility.

The two are not substitutes. A scanner gives you a gate. This skill gives you a narrative with evidence attached, which is useful before a release or when you inherit a codebase, and useless as a CI check because the same prompt can produce a different report tomorrow.

Licence, maintenance and the cost of staying current

The project is MIT licensed, so you can copy, modify and redistribute it, including commercially, provided the licence and copyright notice are kept. The practical implication for a skill pack is that forking and trimming the 25 dimensions to your own stack is permitted, and the README's installation instructions already assume you copy the folder around. That is a description of the licence terms, not legal advice; read the LICENSE file in the repository for the exact wording.

The last push to the default branch was on 2026-08-21, so the repository is not archived and has been touched recently. There are no retrieved releases, which means there is no version number to track and no upgrade path beyond re-cloning and re-copying the skill folder. The maintenance cost you carry is therefore small but non-zero: every time you want the current prompts and rubrics, you repeat the clone and copy, and you accept whatever changed on main. If you fork it, that cost shifts to you, and you own the divergence from upstream.

Editorial conclusion

Adopt it if you already drive an AI coding agent and want a structured, evidence-carrying audit instead of an unstructured chat summary, especially before a release or when a codebase has grown past one person's mental model. Skip it if you need a deterministic scanner in CI, or if you cannot review the agent's evidence yourself. Before trusting a run, verify two things: that the installed folder really is fuck-my-shit-mountain/ under your agent's skills directory, and that the coverage matrix marks the dimensions you care about as High rather than Not assessed.

Frequently asked questions

Official sources

1. Issues
2. License: MIT
3. Project website
4. README
5. XiNian-dada/Fuck_My_Shit_Mountain on GitHub