apw-implement — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited apw-implement (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when asked to implement a feature, fix, or any change. Follow the steps below strictly and in order.
Before doing anything else, read everything relevant to the task:
plan.md artifact exists (from apw-plan; see apw-work-with-work-item-artifacts for where it lives), it is your task list and source of intent; read it, along with any requirements.md / design.md it referencesroot-cause.md artifact exists (from apw-find-root-cause; see apw-work-with-work-item-artifacts for where it lives), it names the proven defect the fix must address; read it before deciding the approachDo not skip this step, even if the task looks simple. The goal is to have a complete picture before forming any opinion.
If anything is unclear after familiarizing yourself, ask up to 5 targeted questions. Questions should resolve genuine ambiguity that would change the implementation approach.
Skip this step entirely if the task is clear after Step 1. Do not ask questions for the sake of asking.
Write a concise plan that states:
Then ask: "Ready to proceed?"
If the task is too large or complex to do well in one session, say so explicitly. Name the parts that should be handled first (research, API exploration, spec writing, etc.) and recommend tackling those before implementation begins. Do not start a partial implementation that will leave things in a broken state.
Wait for the user to confirm or correct the plan before moving to Step 4.
Proceed with the implementation as agreed. Use the TodoWrite tool (if available) to track each step and mark tasks complete as you finish them — do not batch completions.
If you are working from an apw-plan plan.md, tick each - [ ] box to - [x] as you complete that task, so the plan stays a live record of what's done and what's left.
Code comments: Do not leave any comments in the code unless the project's AGENTS.md, CLAUDE.md, or a similar project-level instruction file explicitly requires them. This applies to inline comments, block comments, and docstrings alike. If no such rule exists, write no comments.
If you discover something during implementation that contradicts the plan — an unexpected API shape, a constraint in the codebase, a missing dependency, a design conflict — stop and describe the issue to the user. Do not silently work around it or make a unilateral decision that changes the plan. Resume only after the user decides how to handle it.
When done, provide a concise summary:
Be honest. Do not present a clean picture if tradeoffs were made.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.