apw-plan — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited apw-plan (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when a task needs to be turned into a plan before anyone starts building it. It is the upstream companion to apw-implement and the downstream consumer of apw-research / apw-brainstorm: it takes a fuzzy brief (plus any docs or prior artifacts) and produces durable planning documents an implementation can execute against. It exists to fight two failures: jumping into code with the whole plan held only in volatile context — so steps get skipped and the work drifts from the original ask — and producing a plan that loses the thread of the requirements it was supposed to satisfy. Follow the steps below strictly and in order.
Before forming any plan, read everything that defines the task:
research.md or brainstorm.md artifacts exist (see apw-work-with-work-item-artifacts for where they live), the plan builds on them, it does not redo their work.Do not skip this step, even if the task looks small. A plan is only as good as the picture behind it.
First, write a concise statement of what you understand needs to be done — the goal, the scope as you read it, and the main pieces of work. This gives the user something concrete to correct before any document is written.
Then, in the same round:
requirements.md + design.md + plan.md. For larger or higher-stakes work where both the what and the how deserve to be pinned down before any code.design.md + plan.md. When the requirements are already clear (or captured upstream) but the technical/UI approach still needs deciding.plan.md only. For well-understood work that just needs to be broken into ordered, checkable steps.Wait for the user's answers and their depth choice before producing anything.
Write the documents (requirements.md, design.md, plan.md) to your work item's artifact folder — see apw-work-with-work-item-artifacts for where work-item artifacts live.
Produce the documents one by one, in dependency order — never all at once. After writing each artifact, stop: tell the user it's ready (with its path) and a one-to-two-line summary of what it contains, then wait for their review. The user either:
Only build the next artifact on a confirmed previous one — the design must not be written until requirements are approved, and the plan must not be written until the design (and requirements) are approved. This ordering is the point: later documents reference the IDs in earlier ones, so each gate prevents the next document from being built on something the user was about to change.
The sequence depends on the depth chosen in Step 2:
requirements.md → review → design.md → review → plan.md → reviewdesign.md → review → plan.md → reviewplan.md → reviewEach document, using the templates in this skill folder:
REQUIREMENTS_TEMPLATE.md. Give every requirement a stable ID (R1, R2, …) so the design and plan can reference it. IDs must not change once assigned.DESIGN_TEMPLATE.md. Covers technical design (the main tech decisions, how the pieces fit, what was rejected) and — only when the task has a user-facing surface — UI design as ASCII mockups. Give every design decision a stable ID (D1, D2, …) and tie it to the requirement(s) it serves. Delete the UI section when there is no UI.PLAN_TEMPLATE.md. The ordered list of sub-tasks. Rules:- [x]) as it completes that task — it is the hand-off mechanism to apw-implement.(implements: R2, D1). A plan that doesn't trace back to the requirements/design it came from is the exact drift this skill exists to prevent. In PLAN depth there are no upstream docs, so drop the references and keep each task self-contained.If, while planning, you find that the inputs contradict each other, a requirement is impossible as stated, or the scope is materially larger than the brief implied — stop and tell the user. Re-frame with them rather than writing a confident, well-structured plan for the wrong problem.
Each artifact was already reviewed and approved one by one in Step 3, so this is a short final wrap, not the first chance to object. Keep the chat brief — the detail lives in the artifacts. Report only:
Then confirm it's ready to hand to apw-implement, and offer one last look in case anything across the set should change now that it's all visible together.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.