apw-decompose — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited apw-decompose (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when a task has been handed in but the right sequence of skills to apply is not yet decided. It sits before every other skill in the workflow: it maps the task to the minimal set of steps that will actually be needed, so later phases do not waste effort or skip work that matters. Follow the steps below strictly and in order.
Before assessing anything, read everything that defines the task:
research.md, brainstorm.md, tech-design.md, plan.md, or similar artifact (see apw-work-with-work-item-artifacts for where they live), read them — they may already answer questions that would otherwise trigger additional steps.Do not skip this step. A workflow built without reading the affected code is a guess.
If anything remains genuinely ambiguous after Step 1 — something that would change which steps are needed or in what order — ask up to 5 targeted questions.
Skip this step entirely if the task is clear. Do not ask for the sake of asking.
Wait for the user's answers before proceeding.
Present your honest self-assessment and proposed workflow in chat:
Self-assessment. State what you know and what you don't, organized by dimension:
Proposed workflow. An ordered list of skills, each with a one-to-two sentence rationale explaining why this specific step is needed for this specific task. Use only the steps that are genuinely needed — do not add steps "just in case."
Available skills and when to include them:
| Skill | Include when |
|---|---|
apw-brainstorm | The approach space is genuinely unclear and options need exploring before committing |
apw-research | Specific technical questions must be answered before a design or implementation can be settled; scope it tightly to the actual unknowns |
apw-tech-design | There are meaningful architectural choices with real tradeoffs that need evaluation |
apw-plan | The work is large enough to need ordered, checkable sub-tasks before coding begins |
apw-implement | The what-and-how is settled enough to build |
apw-write-test | Tests need to be written before or alongside the implementation |
apw-verify | There are concrete requirements or a spec to check the finished implementation against |
apw-review | The finished work deserves adversarial critique before being considered done |
apw-find-root-cause | The task is a bug or defect fix — mandatory first step, no exceptions |
Calibration guidance — typical shapes for common task types:
apw-implementapw-plan → apw-implementapw-research (scoped) → apw-implementapw-find-root-cause → apw-implement [→ apw-verify]apw-research → apw-tech-design → apw-plan → apw-implement → apw-verify → apw-reviewThen ask: "Does this workflow look right? Should I write workflow.md?"
Wait for the user's answer before proceeding.
Once the user confirms, write the result to your work item's `workflow.md` artifact — see apw-work-with-work-item-artifacts for where work-item artifacts live — using .claude/skills/apw-decompose/WORKFLOW_TEMPLATE.md as the structure.
Then output a concise summary:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.