writing-plans — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited writing-plans (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Write comprehensive implementation plans assuming the engineer has zero context for our codebase and questionable taste. Document everything they need to know: which files to touch for each task, code, testing, docs they might need to check, how to test it. Give them the whole plan as bite-sized tasks. DRY. YAGNI. TDD. Frequent commits.
Assume they are a skilled developer, but know almost nothing about our toolset or problem domain. Assume they don't know good test design very well.
Announce at start: "I'm using the writing-plans skill to create the implementation plan."
Context: This should be run in a dedicated worktree (created by brainstorming skill).
Save plans to: docs/superpowers/plans/YYYY-MM-DD-<feature-name>.md
If the spec covers multiple independent subsystems, it should have been broken into sub-project specs during brainstorming. If it wasn't, suggest breaking this into separate plans — one per subsystem. Each plan should produce working, testable software on its own.
Before defining tasks, map out which files will be created or modified and what each one is responsible for. This is where decomposition decisions get locked in.
This structure informs the task decomposition. Each task should produce self-contained changes that make sense independently.
Each step is one action (2-5 minutes):
Every plan MUST start with this header:
# [Feature Name] Implementation Plan
> **For agentic workers:** REQUIRED: Use superpowers:subagent-driven-development (if subagents available) or superpowers:executing-plans to implement this plan. Steps use checkbox (`- [ ]`) syntax for tracking.
**Goal:** [One sentence describing what this builds]
**Architecture:** [2-3 sentences about approach]
**Tech Stack:** [Key technologies/libraries]
---This structure is a machine-readable contract between `writing-plans` and `subagent-driven-development`. subagent-driven-development parses tasks by looking for ### Task N: headings. Any deviation breaks task extraction.
Rules (never break these):
### Task N: [Name] (H3, "Task", number, colon)## Chunk N: or #### Step N: or any other heading as the task boundary### Task begins## Chunk N: headings ONLY for grouping tasks into review batches — not as task boundaries### Task N: [Component Name]
**Files:**
- Create: `exact/path/to/file.py`
- Modify: `exact/path/to/existing.py:123-145`
- Test: `tests/exact/path/to/test.py`
- [ ] **Step 1: Write the failing test**
def test_specific_behavior(): result = function(input) assert result == expected
- [ ] **Step 2: Run test to verify it fails**
Run: `pytest tests/path/test.py::test_name -v`
Expected: FAIL with "function not defined"
- [ ] **Step 3: Write minimal implementation**
def function(input): return expected
- [ ] **Step 4: Run test to verify it passes**
Run: `pytest tests/path/test.py::test_name -v`
Expected: PASS
- [ ] **Step 5: Commit**
git add tests/path/test.py src/path/file.py git commit -m "feat: add specific feature"
Before finalising each task's test cases, walk through these attack surfaces. For any that apply, write an explicit failing test. These are stack-agnostic patterns — substitute your domain's concrete types.
Numeric boundaries
amount = 0 or any input that rounds/truncates to zero0.0000004 × 10^6 = 0.4 → round(0.4) = 0. Pick the test value by working backwards from the expected truncated result, not by guessing.Self-reference
External API / SDK: success ≠ semantic success
response.error, result.value.err, status != "ok", etc.Configuration misuse
Output injection
Public API consistency
fromEnv({ x: ... })), the type must accept it and the runtime must use itPackage release artifacts
input × scale = y → round(y) = z), then pick the test value from that mathAfter completing each chunk of the plan:
Chunk boundaries: Use ## Chunk N: <name> headings to delimit chunks. Each chunk should be ≤1000 lines and logically self-contained.
Review loop guidance:
After saving the plan:
"Plan complete and saved to `docs/superpowers/plans/<filename>.md`. Ready to execute?"
Execution path depends on harness capabilities:
If harness has subagents (Claude Code, etc.):
If harness does NOT have subagents:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.