gsd-tools — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited gsd-tools (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are gsd-tools - the central utility skill for all GSD (Get Stuff Done) operations. This skill provides foundational primitives that every GSD process and agent depends on: configuration management, slug generation, timestamp formatting, path resolution, and planning directory initialization.
This skill serves as the unified entry point for GSD infrastructure, consolidating the functionality originally spread across lib/commands.cjs, lib/config.cjs, lib/core.cjs, and lib/init.cjs in the original GSD system. Every GSD process calls gsd-tools at initialization to load configuration, resolve paths, and validate the planning directory state.
Key responsibilities:
.planning/config.json configuration.planning/ directory structure.planning/quick/.planning/ directory structureLoad and parse .planning/config.json with defaults:
{
"profile": "balanced",
"autoCommit": true,
"autoVerify": true,
"planCheckerEnabled": true,
"maxPlanRevisions": 2,
"waveParallelization": true,
"contextMonitor": true,
"contextWarningThreshold": 70,
"contextCriticalThreshold": 85,
"summaryVariant": "standard",
"tddEnabled": false,
"questioningDepth": "adaptive"
}Read config:
cat .planning/config.jsonIf config does not exist, create with defaults. Merge user overrides with defaults (user values take precedence).
Generate kebab-case slugs from descriptions:
Input: "Add user authentication with OAuth2"
Output: "add-user-authentication-with-oauth2"
Input: "Fix bug #123 in payment processing"
Output: "fix-bug-123-in-payment-processing"Rules:
-2, -3 if neededFormat timestamps for GSD artifacts:
Header: "2026-03-02T14:30:00Z"
Frontmatter: "2026-03-02"
Filename: "20260302-143000"
Display: "Mar 2, 2026 2:30 PM"Resolve paths within .planning/ structure:
Phase directory: .planning/phase-{N}/
Plan file: .planning/phase-{N}/PLAN-{M}.md
Summary file: .planning/phase-{N}/SUMMARY.md
Quick task: .planning/quick/{NNN}-{slug}/
Debug session: .planning/debug/{slug}.md
Codebase docs: .planning/codebase/
Research docs: .planning/research/
Milestone archive: milestones/v{X}.{Y}/Parse integer and decimal phase numbers:
"72" -> { major: 72, minor: null, display: "72" }
"72.1" -> { major: 72, minor: 1, display: "72.1" }
"72.2" -> { major: 72, minor: 2, display: "72.2" }Decimal phases are inserted phases (e.g., urgent work between phase 72 and 73).
Sequential numbering for quick tasks:
.planning/quick/001-fix-login-bug/
.planning/quick/002-add-rate-limiting/
.planning/quick/003-update-readme/Scan existing directories, find highest number, increment by 1. Zero-pad to 3 digits.
Ensure .planning/ directory exists with required structure:
.planning/
config.json
PROJECT.md (if new-project has run)
REQUIREMENTS.md (if new-project has run)
ROADMAP.md (if new-project has run)
STATE.md (always present after init)
quick/ (created on demand)
debug/ (created on demand)
codebase/ (created on demand)
research/ (created on demand)Detect current project state for routing:
const states = {
NO_PROJECT: "No .planning/ directory or no PROJECT.md",
INITIALIZED: ".planning/ exists with PROJECT.md but no phases started",
MID_PHASE: "A phase is in progress (has plans but no summary)",
PHASE_COMPLETE: "Current phase complete, ready for next",
MILESTONE_READY: "All milestone phases complete, ready for audit",
BLOCKED: "STATE.md has active blockers"
};Read to load .planning/config.jsonGlob to check for duplicates in target directoryBash to create directory structure with mkdir -pWrite to create config.json with defaults if missingRead + Glob to detect existing stateThis skill is used by all GSD processes as the first initialization step:
new-project.js - Initialize .planning/, create configplan-phase.js - Resolve phase paths, load config for planner settingsexecute-phase.js - Load config for executor settings, resolve task pathsquick.js - Generate quick task number and slug, resolve quick task pathdebug.js - Generate debug session slug, resolve debug pathprogress.js - Detect project state, load configcomplete-milestone.js - Resolve milestone archive pathadd-tests.js - Resolve phase paths for test generationresearch-phase.js - Resolve research output paths{
"operation": "init|config|slug|path|state",
"status": "success|error",
"result": {
"config": {},
"slug": "generated-slug",
"path": "/resolved/path",
"state": "NO_PROJECT|INITIALIZED|MID_PHASE|..."
},
"metadata": {
"planningDir": ".planning/",
"configPath": ".planning/config.json",
"timestamp": "2026-03-02T14:30:00Z"
}
}| Setting | Default | Description |
|---|---|---|
profile | balanced | Model profile (quality/balanced/budget) |
autoCommit | true | Auto-commit after each task |
autoVerify | true | Auto-verify after phase execution |
planCheckerEnabled | true | Run plan checker before execution |
maxPlanRevisions | 2 | Max plan revision cycles |
waveParallelization | true | Enable wave-based parallel execution |
contextMonitor | true | Enable context window monitoring |
summaryVariant | standard | Summary template variant |
| Error | Cause | Resolution |
|---|---|---|
Config parse error | Malformed config.json | Reset to defaults, warn user |
Planning dir not writable | Permission issue | Check filesystem permissions |
Slug collision limit | 10+ duplicates with same slug | Use timestamp suffix instead |
Phase number invalid | Non-numeric phase argument | Show valid format examples |
State detection failure | Corrupt STATE.md | Suggest health command to repair |
.planning/ directory without explicit instruction~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.