Enforced QA for Claude Code, Codex and Copilot. Draw the graph: code review, your own reviewers and test agents, any model per node. Slop goes back to repair, and the agent that wrote the code can't skip it.
# Add to your Claude Code skills
git clone https://github.com/the-open-engine/zeroshotLast scanned: 6/16/2026
{
"issues": [
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "depcheck: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "gray-matter: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ip-address: ip-address has XSS in Address6 HTML-emitting methods",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "js-yaml: JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "md-to-pdf: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "mocha: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "npm: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "serialize-javascript: Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()",
"severity": "high"
},
{
"type": "npm-audit",
"message": "tar: node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)",
"severity": "medium"
}
],
"status": "WARNING",
"scannedAt": "2026-06-16T09:26:11.242Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}See how zeroshot compares with popular alternatives.
zeroshot is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by the-open-engine. Enforced QA for Claude Code, Codex and Copilot. Draw the graph: code review, your own reviewers and test agents, any model per node. Slop goes back to repair, and the agent that wrote the code can't skip it. It has 1,955 GitHub stars.
zeroshot returned warnings in SkillsLLM's automated security scan. It has no critical vulnerabilities, but review the flagged issues in the Security Report section before adding it to your workflow.
Clone the repository with "git clone https://github.com/the-open-engine/zeroshot" and add it to your Claude Code skills directory (see the Installation section above).
zeroshot is primarily written in Rust. It is open-source under the-open-engine on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh zeroshot against similar tools.
No comments yet. Be the first to share your thoughts!
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
The agent that writes the code should not be the one that decides it works.
We built zeroshot because we were tired of being gaslit by agents telling us broken code was ready.
zeroshot runs a QA process your coding agent can't skip. You define it as a graph: which agents
review, what must pass, where a rejection loops back. In the built-in software-change workflow,
one agent implements, independent agents review, and failures go back to a bounded repair loop.
Git delivery waits for both reviewers to accept. zeroshot doesn't replace Claude Code, Codex or
Copilot. It runs one of them as the worker and as the reviewers.
Use the built-in graph or draw your own: code review, your own reviewers and test agents, any model per node. Save the setup as a profile for the next task.
A skill is advice: the agent still decides whether to follow its reviewer's feedback and when to stop. A zeroshot graph defines the required reviews and repair loop before execution; the engine follows it mechanically until the reviews accept or the retry limit is reached.
Add custom agent nodes: a security reviewer, a bugfinder that writes tests, or an agent that checks the app in a browser. Choose each node's model and instructions, which nodes run in parallel, and where rejected work goes for repair.
The product site, zeroshot.sh, has the FAQ.
▶ Video: a single agent vs. zeroshot (scripted)
Questions, ideas, or a run worth showing? Join the zeroshot community on Discord.
Prefer Cloud? Cloud setup →
npm install -g @the-open-engine-company/zeroshot
The installer requires Node.js 18 or newer and installs a verified native binary for Linux x64/arm64, macOS x64/arm64, or Windows x64. It also installs one zeroshot skill for Codex, GitHub Copilot, and Claude Code at user scope.
For local execution, install and sign in to Codex, Claude Code, or GitHub Copilot. Local runs can reuse the harness's existing login, including subscription-backed sessions. See the installation guide for harness prerequisites.
This example uses Codex and keeps delivery local. The worker edits the current Git worktree, so start in a clean worktree intended for the task.
Create input.json, replacing the example task with a change appropriate for your repository:
{
"task": "Add JSON output to the status command and cover it with focused tests."
}
Create runtime.json. Replace YOUR_MODEL_ID with a model identifier supported by your installed
Codex CLI:
{
"harness": "codex",
"provider": "openai",
"model": "YOUR_MODEL_ID",
"effort": "high"
}
Start the run. Add --validate-only to check the graph, runtime configuration, and input first:
zeroshot run \
--title "Add JSON status output" \
--template software-change \
--input input.json \
--uniform-runtime-config runtime.json
Open another terminal to inspect the run:
zeroshot ui
Visit http://127.0.0.1:4173/ui/ and open Runs. Stopping the UI server leaves active runs
running. The CLI also provides zeroshot list, zeroshot status RUN_ID, and zeroshot logs RUN_ID.
For other harnesses and providers, see Runtimes and connections.
Connect GitHub and bring your own model API keys. Cloud setup guide →
The graph defines the sequence, parallel steps, retry paths, and exit conditions before execution starts. Runs are bounded, and events are recorded in a durable SQLite ledger. A passing run means its configured checks accepted the work; coverage depends on the requirements, reviewers, tests, and environment you provide.
The built-in auto-research template runs ten iterations by default; set a positive
options.iterations value in the run input to choose another count. Three scouts propose
directions, then a planner chooses an experiment and either the current candidate or a restorable
archived candidate as its starting point. Independent judges check the evidence and method, while
the progress judge decides whether the result should replace the current candidate under the task
charter. A valid result can go into the archive without replacing it. An auditor checks the ledger,
archive, and workspace before the next iteration.
Inspect the graph with zeroshot template show auto-research.
Choose each agent's model and instructions, which steps run in parallel, and when to retry. Example topology, adding stages after the review loop:
Implementation
↓
Code review + acceptance review
↓
Bugfinder: adversarial tests
↓
E2E tests
↓
Delivery
The software-change review loop, auto-research graph, and delivery are built in. You define other stages, their tools, services and credentials, and where failures go for repair.
Inspect the built-in graph as a starting point:
zeroshot template show software-change
See the graph contract for custom graph authoring and Prepare a runtime environment for dependency and service setup.
Each step can use its own model. Pass --runtime-config with one binding per node in place of
`--uniform-