Audited 2026-10-20 · Sources: GitHub repo metadata + README, npm listing, published benchmark docs, file tree. Tabletop audit — nothing installed or executed.
The card
| Repo | DietrichGebert/ponytail |
| Stars | 169.8k (GitHub, audit date) — 363 commits, v5.3, published npm package @dietrichgebert/ponytail |
| License | MIT |
| Provenance | Solo author, real domain (ponytail.dev), Trendshift-badged growth, waitlist funnel on the site — commercial intent behind a free skill |
| What it is | A "lazy senior dev" personality for coding agents: a reuse-first prompt (the best code is the code you never wrote) plus /ponytail-review and /ponytail-audit commands and a Claude Code telemetry band — shipped as plugins/rules for ~20 agent harnesses |
| Install surface | One repo → rules/plugin manifests written into every agent dir it supports: .claude-plugin, .codex-plugin, .devin-plugin, Cursor, Windsurf, Grok, Kimi, OpenCode, Qoder, Kiro, OpenClaw and more. The Claude Code "band" is executable — it hooks the statusline. |
What problem it solves
Coding agents over-build: install a library, scaffold a framework, write 335 lines for a date picker the browser already ships. Ponytail laces the agent with a senior-dev discipline — a seven-rung ladder that prefers existing components, standard library, platform features, and one-line fixes over new code — while explicitly protecting validation, security, and accessibility from the cuts.
Our gate findings
| Gate | Finding |
|---|---|
| Upstream identity | Verified — consistent author identity, real site, npm package, multi-language READMEs, steady release cadence (v5.3 current) |
| License | MIT — clean. |
| Claims discipline | Unusually honest for a prompt pack. Headline numbers (-53% code, -41% time, -26% cost, -45% tokens; 98% of risky logic ships with a test vs 68% without) come with a published methodology: 39 tasks including a real FastAPI+React repo, Opus 5.5, 5 runs each, per-task tables in benchmarks/results/. Self-run benchmarks are still self-run — but the receipts exist to check. |
| Executable surface | Mostly instructions. The exception is the band: a Claude Code statusline component tracking cost/tokens/reuse — real code running inside your harness config, plus a local board page under ~/.config/ponytail/band/. Small, but it is code you run on their word. |
| Blast radius | Breadth is the risk. One repo writes configuration into ~20 agent harnesses. Each install is one line — the aggregate is a single author's prompt governing judgment across every agent you own. Install it into the harnesses you actually use, not all twenty. |
| Behavioral risk | "Write less" is a bias, not a law. On tasks where correctness needs explicit handling — money, auth, concurrency — an agent tuned to minimalism can under-build. The skill says it never cuts safety paths; your agent's interpretation of that line is the real control. |
| Data boundary | Clean — rules and a local telemetry store. The band's board stays in ~/.config/ponytail/band/; nothing phones home in the parts we could read. |
Verdict: CAUTION (GO for personal rigs). This is the rare prompt pack with engineering behind it — MIT, maintained, benchmarked. The caution is scope, not safety: it wants to live in every agent you run. Adopt it in one harness, watch a week of diffs, then decide if it earns the rest.
Best for
Developers and operators burning tokens on agent over-engineering — verbose scaffolds, unneeded dependencies, greenfield code where a platform feature exists — who want a maintained, measured counterweight.