
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
questionably-ultrathink
Advanced tools
Claude Code plugin integrating Atom of Thoughts (AoT) and Chain of Verification (CoVe) reasoning frameworks
A Claude Code plugin that integrates Chain of Verification (CoVe) and Atom of Thoughts (AoT) reasoning frameworks for rigorous, verifiable analysis.
UltraThink enhances Claude's reasoning with two research-backed frameworks:
bunx questionably-ultrathink install
Alternative: Claude Code users can also install via marketplace:
/plugin marketplace add snowmead/questionably-ultrathink /plugin install questionably-ultrathink@snowmead-marketplace
/questionably-ultrathink analyze whether this authentication approach is secure
@questionably-ultrathink analyze whether this authentication approach is secure
For contributors working on this plugin:
./setup.sh
This installs dependencies (lefthook, comrak) if missing and sets up git hooks for automatic markdown formatting on commit.
/questionably-ultrathink (Claude Code) / @questionably-ultrathink (OpenCode)Run the full reasoning pipeline on a problem:
/decomposeBreak down a complex problem into atomic sub-questions:
/decompose how does React's reconciliation work and compare to Vue?
/verifyVerify factual claims in the most recent response:
/verify
Or verify specific content:
/verify the performance benchmarks mentioned above
The skill automatically activates when you use trigger phrases:
When running the full pipeline, you can select analysis depth:
| Level | Re-solve Trigger | Confidence Threshold | Use Case |
|---|---|---|---|
| Standard | Never | N/A (single pass) | Most questions |
| Thorough | LOW confidence | score < 0.4 | Important decisions |
| High-Stakes | Below HIGH | score < 0.7 | Security, architecture, production |
Confidence Scoring: Atoms receive numerical scores (0.0-1.0) mapped to categories:
For High-Stakes rigor, an optional Judge agent evaluates answer quality across atoms, checking for coherence, contradictions, and completeness.
The plugin includes optional MCP servers for enhanced web search during verification:
parallel-search - Optimized fact-checking searchesparallel-task - Deep research capabilitiesSetup: Run /mcp in Claude Code and authenticate with Parallel.ai to enable them.
Fallback: The plugin works fully without MCP authentication, using native WebSearch and WebFetch tools.
Traditional decomposition approaches have a critical flaw: the same agent that generates questions also sees all answers, creating bias contamination. UltraThink solves this with true factored execution:
┌───────────────────────────────────────────────────────────────────┐
│ User Commands │
│ /questionably-ultrathink | /decompose | /verify │
└─────────────────────────────────┬─────────────────────────────────┘
│
▼
┌───────────────────────────────────────────────────────────────────┐
│ Skill Orchestrator │
│ (skills/questionably-ultrathink) │
│ │
│ 1. Clarify intent (AskUserQuestion) │
│ 2. Select rigor level │
│ 3. Invoke Graph Generator (DAG only, no solving) │
│ 4. For each level: spawn isolated Atomic Solvers │
│ 5. Graph Maintainer contracts solved answers into questions │
│ 6. Repeat until FINAL solved │
│ 7. Synthesize final response │
└───────────┬───────────────────────┬───────────────────┬───────────┘
│ │ │
▼ ▼ ▼
┌───────────────────┐ ┌───────────────────┐ ┌───────────────────┐
│ aot-graph- │ │ cov-atomic- │ │ aot-graph- │
│ generator │ │ solver │ │ maintainer │
│ │ │ │ │ │
│ Builds DAG of │ │ Answers ONE │ │ Contracts solved │
│ questions only │ │ question per │ │ answers into │
│ (no solving) │ │ spawn (isolated) │ │ dependent Qs │
└───────────────────┘ └───────────────────┘ └───────────────────┘
│
▼ (High-Stakes only)
┌───────────────────┐
│ aot-judge │
│ │
│ Evaluates answer │
│ quality, flags │
│ atoms for re-solve│
└───────────────────┘
Key Innovation: Complete Isolation
Each cov-atomic-solver spawn sees ONLY its contracted question - nothing else. This prevents bias contamination where knowledge of other questions/answers influences responses.
Data Flow:
cov-atomic-solver instancesBased on the paper "Atom of Thoughts for Markov LLM Test-Time Scaling" (HKUST, 2025).
Key features:
Based on the paper "Chain-of-Verification Reduces Hallucination in LLMs" (Meta AI, 2023).
Key features:
## Atom of Thoughts - Question Graph
### Dependency Graph
- [A1] What auth standard fits a stateless API? (level 0)
- [A2] Where should tokens be validated? (level 0)
- [A3] How should tokens be stored client-side? (level 1, deps: [A1])
- [FINAL] Complete auth approach recommendation (level 2, deps: [A2, A3])
---
atom_id: A1
level: 0
dependencies: []
status: solved
solved_at: 2025-01-18T15:30:00Z
solve_attempts: 1
confidence_score: 0.85
---
# Question
What auth standard fits a stateless API?
# Verification Trace
## Initial Answer
JWT tokens are commonly used for stateless APIs.
## Self-Verification
**Claim 1:** "JWT is the standard for stateless APIs"
- Verification Q: What authentication standard is recommended for stateless REST APIs?
- Independent Answer: JWT (JSON Web Tokens) - self-contained, no server-side session storage
- Status: ✓ VERIFIED
# Answer
JWT (JSON Web Tokens) - stateless, self-contained, widely supported
# Confidence
0.85 (HIGH) - Multiple authoritative sources confirm JWT is the standard
## Contracted: A3
**Original Question:** How should tokens be stored client-side?
**Contracted Question:** Given that JWT is the recommended auth standard for stateless APIs,
how should JWT tokens be stored client-side?
**Baked-in Context:**
- A1: JWT - stateless, self-contained, widely supported
After using UltraThink, responses are marked:
Each atom includes a numerical confidence score (0.0-1.0) with categorical label and explanation, providing an audit trail for how answers were derived.
Skip UltraThink for:
MIT
FAQs
Claude Code plugin integrating Atom of Thoughts (AoT) and Chain of Verification (CoVe) reasoning frameworks
We found that questionably-ultrathink demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.