build-feature-0647cc — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited build-feature-0647cc (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Execute a full-stack feature implementation across database, backend, frontend, and testing layers. This skill follows the implementation plan produced by /plan-feature and builds all layers with integrated testing.
[!CAUTION] Scope boundary: This skill implements code and commits it. It does NOT create pull requests, push to remote, run code reviews, or submit anything for merge. When implementation and commits are complete, stop and suggest the user run/review-codenext. Do not proceed to PR creation — that is/submit-pr's job.
Check for an implementation plan using the following priority:
[!NOTE] GitHub issues created by /plan-feature are task-oriented work items — the decision record remains the authoritative source of council evaluations, rationale, and architectural context. When loading from an issue, always read the referenced decision record for full context.If the user provides a GitHub issue number (e.g., /build-feature 42 or /build-feature #42):
gh issue view <number> --json title,body,labels,state,numberbuild-ready label (warn if not — it may not have been through /plan-feature or may need further planning) # Single-developer constraint: only one issue should be in-progress at a time.
# First, remove in-progress from any other issue that has it:
gh issue list --label "in-progress" --state open --json number --jq '.[].number' | while read n; do
gh issue edit "$n" --remove-label "in-progress"
done
gh issue edit <number> --add-label "in-progress" # --limit 200 covers the current board size; increase if the project grows beyond 200 items
EXISTING=$(gh project item-list {PROJECT_NUMBER} --owner {OWNER} --format json --limit 200 \
| python3 -c "
import json, sys
data = json.load(sys.stdin)
for item in data.get('items', []):
# <number> must be an integer literal, e.g., == 42, not == '42'
if item.get('content', {}).get('number') == <number>:
print(item['id'])
break
")
if [ -z "$EXISTING" ]; then
ITEM_ID=$(gh project item-add {PROJECT_NUMBER} --owner {OWNER} --url "https://github.com/{OWNER}/{REPO}/issues/<number>" --format json | python3 -c "import json,sys; print(json.load(sys.stdin)['id'])")
echo "Warning: Issue #<number> was not on the project board. Added it now (item $ITEM_ID)."
fi[!WARNING] If the issue was missing from the project board, it may also be missing phase, size, and date fields. Check the project item and warn the user if fields are unset — this suggests the issue was created outside of/plan-featureor/security-audit, which are the skills that ensure board membership and field population.
If no issue number or description is given, automatically find the next build-ready ticket from the project roadmap:
gh api repos/{OWNER}/{REPO}/milestones \
--jq 'sort_by(.due_on) | map(select(.state == "open" and .open_issues > 0)) | .[0] | {title, number, due_on, open_issues}'If an issue already has the in-progress label, use its milestone instead:
gh issue list --state open --label "in-progress" --json number,title,milestone --jq '.[0]'build-ready label, excluding any already labeled in-progress: gh issue list --state open --label "build-ready" --milestone "<milestone-title>" \
--json number,title,labels \
--jq '[.[] | select(.labels | map(.name) | index("in-progress") | not)]'start field ascending: gh project item-list {PROJECT_NUMBER} --owner {OWNER} --format json --limit 200 | python3 -c "
import json, sys
data = json.load(sys.stdin)
# <candidates> is a Python set literal of issue numbers, e.g., {22, 23, 10}
candidates = <candidates>
results = []
for item in data.get('items', []):
num = item.get('content', {}).get('number')
if num in candidates:
# Field is 'start', not 'startDate'
start = item.get('start') or '9999-12-31'
results.append((start, num, item.get('title', '')))
results.sort()
for start, num, title in results:
display_start = start if start != '9999-12-31' else 'N/A'
print(f'{display_start}\t#{num}\t{title}')
"The first candidate (earliest start date) is the next ticket to work on. Issues without a start date sort last.
Show a table of all build-ready candidates in the current phase, sorted by start date, with the top candidate highlighted as the recommendation:
| # | Issue | Title | Start Date |
|---|---|---|---|
| → | #N | Top candidate title | YYYY-MM-DD |
| 2 | #N | Other candidate | YYYY-MM-DD |
Ask the user to confirm:
If the user confirms a ticket, proceed with that issue number using the same flow as Option A (fetch full issue details, validate build-ready, extract plan, set in-progress label, etc.).
If no issue number is given and no build-ready tickets are found on the roadmap:
docs/decisions/ that matches the current featureIf no decision record exists, ask the user what to build.
[!WARNING] No GitHub issue or decision record found. This means the planning pipeline (/plan-feature) was skipped — no council evaluation, no documented rationale, no structured task breakdown. Consider running/plan-featurefirst. Proceeding without a plan risks unreviewed architecture decisions.
From the plan (regardless of source), identify:
Ensure we are on a feature branch based on the latest main. Always fetch first:
git fetch origin mainIf on main, create a new feature branch from the latest origin/main:
git checkout -b feature/<feature-slug> origin/mainIf already on an existing feature branch, rebase it onto the latest origin/main to pick up any changes:
git status --porcelainIf the working tree is dirty, stash changes before rebasing:
git stash push -m "build-feature: stash before rebase"
git rebase origin/main
git stash popIf the working tree is clean, rebase directly:
git rebase origin/mainIf database changes are required:
/database-design:postgresql for schema design guidance/database-migrations:sql-migrations for migration best practices pnpm db:migrateInvoke /backend-development:feature-development for backend scaffolding guidance.
For each backend task from the plan:
Run backend tests:
pnpm testFor each frontend task from the plan:
Invoke /ui-design:create-component for guided component creation with:
/frontend-mobile-development:tailwind-design-system for patterns)[!NOTE] All user-visible text strings (headings, labels, descriptions, empty states, error messages, tooltips) must follow the User-Facing Content Style rules in AGENTS.md. No em dashes, no AI-slop vocabulary, no promotional inflation.If the feature requires client-side state:
/frontend-mobile-development:react-state-management for state patternsIf new pages or routes are needed:
If this feature involves marketing pages, landing page copy, or product descriptions:
/seo-content-creation:seo-content-writer for SEO content quality and E-E-A-T optimization/content-marketing:content-marketer for content strategy guidance/accessibility-compliance:wcag-audit-patterns alongside /ui-design:accessibility-audit for deeper WCAG complianceIf the plan specifies a feature flag:
const isEnabled = useFeatureFlag('FEATURE_NAME');
if (!isEnabled) return <ExistingComponent />;
return <NewFeature />;Write E2E test outlines for critical user flows:
If E2E test infrastructure exists, implement the tests.
Run the full test suite:
pnpm testReport coverage and any failures.
Before presenting to the user, perform a comprehensive self-review:
pnpm type-check # No TypeScript errors
pnpm lint # No linting violations
pnpm format:check # No Prettier formatting issues
pnpm test # All unit tests pass
pnpm test:smoke # DI wiring and component tree render OKIf format:check fails, run pnpm exec prettier --write on the reported files before proceeding.
Check for:
any types in TypeScriptIf this feature changes how the project is set up, built, or run, update the relevant documentation before committing:
docs/, add them to the appropriate table in the master documentation index[!IMPORTANT] A developer cloning the repo fresh must be able to get the project running by following README.md alone. If your feature adds a Docker service, database, new dev server, or environment variable, the docs MUST reflect it.
Wait for user approval before committing.
Create atomic, conventional commits. If the feature is small enough for one commit:
feat(<scope>): implement <feature-name>If the feature is large, break into logical commits:
feat(db): add <model> schema and migration
feat(api): add <resource> endpoints
feat(web): add <feature> components and pages
test: add tests for <feature>If implementation was initiated from a GitHub issue:
gh issue comment <number> --body "Implementation committed on branch \`<branch-name>\`. Proceeding to code review via \`/review-code\`."[!NOTE] Do not remove thein-progresslabel here. The label stays on the issue until it is closed (handled automatically by.github/workflows/label-cleanup.yml). This ensures the issue remains visibly in-progress through code review and PR submission.
[!CAUTION] This skill's work is done. Do NOT proceed to create a pull request, push to remote, or run a code review. Those are separate skills with their own workflows and checkpoints.
Present the next step to the user:
/review-code for multi-perspective review before submitting/review-code/ui-design:design-review before code reviewIf working from a GitHub issue, remind the user:
Closes #<number> so it auto-closes when merged/submit-pr will detect related issues from commit messagesDo not push the branch, create a PR, or invoke `/submit-pr` from within this skill.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.