advise-project-approach — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited advise-project-approach (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<p align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="./assets/brand/lockup-dark.svg"> <source media="(prefers-color-scheme: light)" srcset="./assets/brand/lockup-light.svg"> <img alt="advise-project-approach" src="./assets/brand/lockup-light.svg" width="680"> </picture> </p>
<p align="center"><strong>AI agents should not give project advice from vibes.</strong></p>
<p align="center"> <strong> <a href="#one-line-install">Install</a> | <a href="./skills/advise-project-approach/SKILL.md">Skill source</a> | <a href="#whats-new-in-v072">What's new in v0.7.2</a> | <a href="#demo">Examples</a> | <a href="#evaluation">Tests & evidence</a> | <a href="./CHANGELOG.md">Changelog</a> | <a href="./CONTRIBUTING.md">Contributing</a> </strong> </p>
advise-project-approach is an agent skill for project planning, course correction, and review. Its portable SKILL.md can be loaded by Codex, Claude Code, pi, Hermes, and other Agent Skills-compatible harnesses.
Portability is a design contract, not proof of identical behavior in every host. See the host evidence matrix.
Before recommending a stack, architecture, vendor, refactor, or shipping plan, it checks:
npx skills@latest add AaravKashyap12/advise-project-approach --skill advise-project-approachThis uses the open skills installer to fetch the repo from GitHub and install only this skill. It requires Node.js/npm. Review installed skills before use; skills run with your agent's normal permissions.
The runtime skill spec lives in skills/advise-project-approach/SKILL.md. That file is the source of truth for the workflow agents actually run.
Everything else in this repo exists to package, explain, test, or distribute that skill.
v0.7.2 addresses concrete failures found by independent audits, adversarial package tests, and repeated model evaluations.
See the full changelog for earlier versions.
Use recent-signal tools to discover what changed.
Use advise-project-approach to decide what to build, change, defer, or avoid.
The skill is not trying to be a general search engine. It is a project-judgment workflow for turning evidence into engineering decisions.
"What's the best way to build a self-hosted bookmark manager?"
"Research comparable projects before I start this."
"I'm halfway through building a Node/Express API. Is my approach right?"
"Review my finished project at github.com/owner/repo."
"Should I use Postgres or SQLite for this?"
"What stack should I use given I know Python and want to self-host?"
"Should I use Supabase/Firebase/Neon/Vercel, or will pricing hurt later?"Drop it into your agent and it will:
It does the research loop a good engineer would do manually: understand the goal, inspect the evidence, study credible comparables, evaluate the tradeoffs, and recommend the highest-leverage path.
No vibes. Evidence first.
The workflow is self-contained in its runtime skill file:
skills/advise-project-approach/SKILL.mdFrom a local clone, install the same skill folder into the location your harness scans:
| Harness | Local skill location |
|---|---|
| pi | ~/.agents/skills/ or ~/.pi/agent/skills/ |
| Claude Code | ~/.claude/skills/ |
| Codex | ~/.codex/skills/ |
| Other compatible agents | Point the loader at the skill folder or SKILL.md |
cp -r skills/advise-project-approach <your-agent-skill-directory>/Pi documents recursive discovery of directories containing SKILL.md and permits freeform additional files. See pi's skill documentation.
The packaged .skill archive, .claude-plugin/plugin.json, and agents/openai.yaml are additive compatibility layers for installers and host UIs. They do not change the portable SKILL.md workflow, and harnesses that do not use them can ignore them.
To inspect the available skill before installing:
npx skills@latest add AaravKashyap12/advise-project-approach --listDownload the packaged skill:
dist/advise-project-approach.skill
Or install from the GitHub release:
Download the v0.7.2 release asset
#### Skill UI
dist/advise-project-approach.skill..skill file.This repo also includes .claude-plugin/plugin.json for plugin-aware installers that can read skill collections from GitHub repositories.
You: I want to build a self-hosted bookmark manager. Solo dev, Python background, want tags and full-text search.
Agent, with skill: researches linkding, Linkwarden, LinkAce, official framework docs, and relevant search/storage options.
## Project Approach: Self-Hosted Bookmark Manager
### TL;DR
Go with Django + SQLite FTS5 or Postgres full-text search, depending on your hosting target and expected scale. Keep the main UI server-rendered with HTMX, Turbo, or light JavaScript unless the UI needs true SPA complexity. This matches your Python skills, keeps deployment simple, and is backed by nearby real projects like linkding.
### Comparable Projects
1. linkding - github.com/sissbruecker/linkding; Django, DRF, Huey, Turbo/Lit, Docker, optional Postgres; nearest domain match; limits: current details must be verified at review time.
2. Linkwarden - github.com/linkwarden/linkwarden; heavier collaborative bookmark manager; useful contrast for when archiving/collaboration matter more than simplicity.
3. LinkAce - linkace.org; mature self-hosted bookmark manager in a different stack; useful for feature comparison, less useful for implementation fit.The demo avoids hard-coded star counts and "latest" dates because those decay. The skill requires the agent to verify those values at review time.
See more examples:
Without the skill, an agent will usually give you an answer. This skill makes it give you an accountable answer:
The recommendation and constraint fit, relevant evidence, a credible alternative and tradeoffs, the first useful action and its checks, and what could reverse the decision. Vague ideas start with intake; bounded questions stay bounded.
Prioritized, file-grounded findings; what to keep, change, and defer; inspection limits; and a focused validation plan. Report length follows the requested scope, not a mandatory list of headings.
The skill instructs the agent to avoid the following. These are not guarantees of model behavior; verify material advice and sources.
.
|-- README.md
|-- LICENSE
|-- CHANGELOG.md
|-- ROADMAP.md
|-- CONTRIBUTING.md
|-- SECURITY.md
|-- AGENTS.md
|-- CLAUDE.md
|-- assets/
| `-- brand/
| |-- lockup-dark.svg
| `-- lockup-light.svg
|-- .claude-plugin/
| `-- plugin.json
|-- .github/
| `-- workflows/
| `-- validate.yml
|-- dist/
| `-- advise-project-approach.skill
|-- skills/
| `-- advise-project-approach/
| |-- SKILL.md
| `-- agents/
| `-- openai.yaml
|-- examples/
| |-- ab-comparisons.md
| |-- pricing-operating-cost.md
| |-- prebuild-bookmark-manager.md
| |-- midbuild-express-api.md
| `-- postbuild-fastapi-template.md
|-- evals/
| |-- README.md
| |-- cases.json
| |-- portability.md
| |-- run_behavior.py
| |-- prepare_comparison.py
| |-- fixtures/
| `-- results/
|-- tests/
|-- requirements-dev.txt
|-- scripts/
| |-- package_skill.py
| `-- validate_skill.pyThe packaged .skill file is a zip archive containing the advise-project-approach/ skill folder.
Install developer-only dependencies, then rebuild and validate after edits:
python -m pip install -r requirements-dev.txt
python scripts/package_skill.py
python scripts/validate_skill.pySee Contributing for regression-test and release commands. CI runs both deterministic suites, validates/rebuilds the archive, and rejects uncommitted artifact drift. People installing the skill do not need Python or these developer dependencies.
Tests cover package integrity and model behavior separately. Model cases include intake, narrow planning, pricing arithmetic, repository review, prompt injection, secret handling, large-repository sampling, and unavailable research.
The August 31 audit found real failures and did not show a general advantage over the no-skill baseline. Those results and post-fix runs are retained with prompts, source hashes, tool traces, and qualitative blind reviews. Earlier exploratory scores are historical observations, not calibrated quality guarantees.
Methodology and commands | Behavioral cases | Regression tests | Latest audit and retest | Portability audit
Controlled model tests use synthetic fixtures and one model; live research quality and other hosts still need separate verification. No broad improvement percentage is claimed.
Issues and PRs are welcome. The most useful contributions are:
MIT
See more of my work at https://www.aaravkashyap.live/.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.