plan-feature-79d222 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited plan-feature-79d222 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Take a feature idea from concept to an approved implementation plan with lean scope, council consensus, and a documented decision record. This skill challenges assumptions, asks hard questions, and pushes back at every stage — before councils review, after councils vote, and before final approval. The goal is to arrive at the strongest possible plan, not to rubber-stamp the first idea.
[!CAUTION] Scope boundary: This skill produces a _plan_, a decision record, GitHub issue(s), and integrates them into the Product Roadmap project with correct phase assignments. It does NOT write application code, create components, modify database schemas, run tests, create branches for implementation, or perform any build work. If the user asks to start building after the plan is approved, direct them to run /build-feature <issue-number> — do not begin implementation yourself.Ask the user to describe:
If the user provides a GitHub issue number, fetch the issue details:
gh issue view <number> --json title,body,labels,state,numberTrack the source issue number — if planning was initiated from a GitHub issue, store the issue number for later updates in Steps 3, 5, and 7.
If the issue has the build-ready label, it has already been through /plan-feature and was deemed sufficiently planned. Warn the user before proceeding:
[!WARNING] Issue #\<number\> already has thebuild-readylabel, which means/plan-featurehas been run on it before. Re-running will create a new decision record and may create duplicate implementation issues.
Ask the user whether to:
/build-feature <number> instead)Do not proceed past Step 1 without the user's explicit choice.
After gathering context, assess whether the issue actually needs the full council workflow. Not every issue warrants a Product Council, Feature Council, decision record, and implementation issue. If all of the following are true, the issue is likely too small:
If the issue meets these criteria, recommend the small-scope bypass to the user:
[!TIP] This issue looks small enough to skip the full /plan-feature council workflow. The scope is clear, the implementation is straightforward, and running two councils plus a decision record would add more overhead than value.>
Recommended action: Add thebuild-readylabel directly and run/build-feature <number>or/build-api <number>to implement.
Ask the user whether to:
build-ready and stop (they'll run /build-feature or /build-api separately)/plan-feature workflow anyway (e.g., if they want council input for precedent or policy reasons)If the user chooses (a):
build-ready label to the issueIf the user provides a brief description, that's sufficient — but do NOT simply accept it at face value. Proceed to Step 2.
Before sending the feature to council, act as a skeptical advisor. Your job is to stress-test the idea and help the user arrive at the strongest possible version of their feature.
Identify and question the implicit assumptions in the feature request:
Ask 2-4 pointed questions that expose gaps or weak spots in the proposal. Examples:
Based on your analysis, present:
Read the Product Council template from .claude/councils/product-council.md and evaluate the feature from all 6 member perspectives.
Model Selection: See the Model Selection section in README.md for mapping agent model specs to Task tool parameters.
Present the full Product Council evaluation with all votes and recommendations.
After the council votes, do not simply pass their results through. Add your own analysis:
Based on Product Council feedback, clearly define:
Read the Feature Council template from .claude/councils/feature-council.md and create the technical implementation plan.
Model Selection: See the Model Selection section in README.md for mapping agent model specs to Task tool parameters.
If the feature involves API work, invoke /backend-development:api-design-principles for detailed API design guidance.
Based on council input, produce a structured task breakdown:
Frontend Tasks: Component development, routing, state management, styling Backend Tasks: API endpoints, services, business logic, validation Database Tasks: Schema changes, migrations, seed data Testing Tasks: Test creation, coverage goals, E2E scenarios Estimated Complexity: Small / Medium / Large
Size and Schedule Estimates: For each task/issue that will be created, the council must provide:
After the Feature Council votes, add your own technical analysis:
Determine the next decision number by reading existing files in docs/decisions/.
Using the template from docs/decisions/001-example-architecture-decision.md, create a decision record that includes:
Decision records render in GitHub Flavored Markdown. Follow the GFM rules in .claude/CLAUDE.md:
- **Key**: value), never consecutive bold lines.> [!NOTE], > [!TIP], > [!IMPORTANT], > [!WARNING], > [!CAUTION]) for callouts instead of bold/italic emphasis.Invoke /documentation-generation:architecture-decision-records for ADR formatting guidance if the decision involves architectural choices.
origin/main following CONTRIBUTING.md conventions: git fetch origin main
git checkout -b feature/<feature-slug> origin/main docs/decisions/NNN-<feature-slug>.mdRegenerate the Decisions table in docs/decisions/INDEX.md by scanning all decision files in the directory. For each file (excluding INDEX.md and 001-example-architecture-decision.md):
Rebuild the full table in reverse chronological order (newest first). Do not modify any other section of INDEX.md (the intro, How to Use, or Related Resources sections remain static).
If any new documents were created in docs/ (including the decision record), verify that docs/INDEX.md reflects them. Decision records are covered by the decisions/INDEX.md entry already present, so no per-decision update is needed. However, if a new documentation file was added to docs/ outside of decisions/ (e.g., a new science document), add a row to the appropriate table in docs/INDEX.md.
docs(council): document feature plan for <feature-name> pnpm exec prettier --write <files>Stage and commit any formatting fixes separately:
style: fix Prettier formatting in decision record and skill git push -u origin feature/<feature-slug>
gh pr create \
--title "docs(council): add Decision NNN — <feature-name>" \
--body "## Summary\n\n- Adds Decision NNN documenting the council-approved plan for <feature-name>\n- Product Council (<tally>) and Feature Council (<tally>) both approved\n- Implementation issues: #N, #N, ...\n\n## Test plan\n\n- [ ] Decision record renders correctly in GitHub markdown\n- [ ] Mermaid diagrams render (if any)\n- [ ] All cross-references to existing issues and docs are valid links\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)" gh pr checks <pr-number> --watchIf checks fail, read the failure logs, fix the issue, commit, push, and re-watch. Do not proceed to issue creation until CI is green.
[!IMPORTANT] Every/plan-featurerun that produces a decision record must submit a PR to get the record merged to main. The PR must pass CI before the planning step is considered complete. The decision record branch is also the feature branch that/build-featurewill use for implementation.
If planning was initiated from a GitHub issue (tracked in Step 1), update the source issue with the council findings. This keeps the issue as a living document that reflects the planning outcome.
Add a comment to the source issue summarizing the council results:
gh issue comment <number> --body "$(cat <<'EOF'
## Council Planning Complete
### Product Council — <Vote tally> (Approve-Concern-Block)
<2-3 sentence summary of key Product Council decisions>
### Feature Council — <Vote tally> (Approve-Concern-Block)
<2-3 sentence summary of key technical decisions>
### Key Decisions
- <Decision 1>
- <Decision 2>
- <Decision 3>
### Artifacts
- **Decision Record**: [Decision NNN](docs/decisions/NNN-slug.md) _(link becomes active after the planning PR merges to main)_
- **Feature Branch**: `feature/<slug>`
- **Implementation Issue**: #<new-issue-number> (created in Step 9)
Planning completed via `/plan-feature`.
EOF
)"Add the build-ready label to the source issue (it has now been fully planned):
gh label list | grep -q "build-ready" || gh label create "build-ready" --description "Planned by /plan-feature and ready for /build-feature" --color "0E8A16"
gh issue edit <number> --add-label "build-ready"After labeling the source issue, verify it is tracked on the Product Roadmap project board. An issue with build-ready that is not on the board becomes an orphaned work item that /build-feature auto-pick cannot discover.
# Check if the issue is already on the project board
# --limit 200 covers the current board size; increase if the project grows beyond 200 items
EXISTING=$(gh project item-list {PROJECT_NUMBER} --owner {OWNER} --format json --limit 200 \
| python3 -c "
import json, sys
data = json.load(sys.stdin)
for item in data.get('items', []):
# <number> must be an integer literal, e.g., == 42, not == '42'
if item.get('content', {}).get('number') == <number>:
print(item['id'])
break
")
# If not on the board, add it and set fields
if [ -z "$EXISTING" ]; then
ITEM_ID=$(gh project item-add {PROJECT_NUMBER} --owner {OWNER} --url "https://github.com/{OWNER}/{REPO}/issues/<number>" --format json | python3 -c "import json,sys; print(json.load(sys.stdin)['id'])")
# Set phase and milestone fields to match the implementation issues that will be created in the Issue Creation step
gh project item-edit --project-id {PROJECT_ID} --id "$ITEM_ID" --field-id {PHASE_FIELD_ID} --single-select-option-id <phase-option-id>
echo "Added issue #<number> to the project board and set phase."
fi[!NOTE] The source issue retains its original content as context. The comment provides a clear audit trail of what the councils decided and links to the detailed decision record. After the implementation issue is created in the Issue Creation step (Step 9), come back and edit this comment to include the implementation issue number.
Before creating GitHub issue(s), validate the planning artifacts:
[!WARNING] A council member voted to Block this feature. Creating an implementation issue with unresolved Block votes is unusual. Consider addressing the concern before proceeding.
Ask the user whether to proceed or resolve the concern first.
Status: Approved. If not approved, warn the user before proceeding. gh issue list --state open --limit 200 --json number,title,labelsCompare the planned issue title(s) and scope against existing issues. If a potential duplicate is found:
[!WARNING] Potential duplicate detected: issue #N has a similar title/scope. Review the existing issue before creating a new one.
Present the potential duplicate(s) to the user and ask whether to:
Do NOT create issues that substantially duplicate existing work items.
[!IMPORTANT] GitHub issues are actionable work items derived from the decision record — they do NOT replace it. The decision record (Step 6) remains the authoritative project-level record of council evaluations, rationale, and architectural context. Issues reference the decision record and provide a task-oriented view for /build-feature to consume.Create GitHub issue(s) containing the full implementation plan so that /build-feature can be run from an issue at any time — immediately or days later.
gh label list | grep -q "feature-implementation" || gh label create "feature-implementation" --description "Implementation plan from /plan-feature" --color "1D76DB"
gh label list | grep -q "security-audit" || gh label create "security-audit" --description "Phase security audit checkpoint" --color "D93F0B"Build the issue body following the template at .github/ISSUE_TEMPLATE/feature-implementation.yml. Include these sections:
Problem Statement: From the decision record's Question and Context sections. Explain what is being solved and why.
Council Decisions: Summarize both councils:
Use a collapsible <details> section for full council votes if they exceed ~30 lines.
Implementation Plan: The Action Items from the decision record, organized by layer (Frontend, Backend, Database, Testing) with checkboxes. This is the primary content that /build-feature will consume.
Success Metrics: The measurable outcomes from the lean scope definition (Step 4).
Technical Context: Key technical decisions — architecture patterns, API contracts, schema changes, component structure.
Decision Record Reference: Link to the decision record file: [Decision NNN](docs/decisions/NNN-slug.md)
Feature Branch: The branch name created in Step 7.
Feature Flag: Flag name and strategy, if applicable.
Estimated Complexity: Small / Medium / Large from the Feature Council assessment.
If the implementation plan has multiple distinct phases, ask the user:
The implementation plan has N phases. Would you like:
>
1. A single issue with all phases as task groups 2. Separate issues per phase (cross-referenced)
If separate issues, create them in sequence with "Part X of N" and links to sibling issues. Each issue must be assigned to the correct project phase (see Phase & Project Mapping below).
When creating multiple phase issues, also create a parent issue and set up sub-issue relationships per the "Parent Issues and Sub-Issues" section in AGENTS.md:
CHILD_ID=$(gh api repos/{OWNER}/{REPO}/issues/<child-number> --jq '.id')
gh api repos/{OWNER}/{REPO}/issues/<parent-number>/sub_issues -X POST -F sub_issue_id=$CHILD_IDgh api repos/{OWNER}/{REPO}/issues/<number> -X PATCH -F milestone=null) and clear its project phase field via GraphQL (clearProjectV2ItemFieldValue). The parent is a tracking container; children carry milestone and phase assignments. If a source issue was used as the parent and already had a milestone, remove it.Before presenting issues for confirmation, determine the correct project phase and size for each issue:
gh project field-list 6 --owner {OWNER} --format jsondocs/PRODUCT.md and the nature of the work. Consider where the issue fits in the existing roadmap progression.Present a table summarizing all issues that will be created or modified, their project phase assignments, and any project changes:
Issues to create/update:
| Action | Issue | Title | Phase | Size | Milestone | Start | Target |
|---|---|---|---|---|---|---|---|
| Create | NEW | <title> | <phase> | <XS/S/M/L/XL> | <M1-M5> | YYYY-MM-DD | YYYY-MM-DD |
| Update | #N | <title> | <phase> | <size> | <M1-M5> | YYYY-MM-DD | YYYY-MM-DD |
If new phases are recommended:
| New Phase | Position | Rationale |
|---|---|---|
M_N_: <Name> | After M_N_ | Why this phase is needed |
If GTM review issues or security audit issues need to be created or updated for affected phases (see GTM Review Gate and Security Audit Gate below), include them in the summary.
Wait for explicit user approval before creating any issues or modifying the project.
Ensure required labels exist:
gh label list | grep -q "feature-implementation" || gh label create "feature-implementation" --description "Implementation plan from /plan-feature" --color "1D76DB"
gh label list | grep -q "build-ready" || gh label create "build-ready" --description "Planned by /plan-feature and ready for /build-feature" --color "0E8A16"
gh label list | grep -q "gtm-review" || gh label create "gtm-review" --description "Go to Market & Business Review checkpoint" --color "0E8A16"
gh label list | grep -q "security-audit" || gh label create "security-audit" --description "Phase security audit checkpoint" --color "D93F0B"build-ready LabelingFor each issue being created, decide whether it is sufficiently planned to go straight to /build-feature:
/plan-feature pass to refine scope and get council input. This is common for large child issues in multi-issue plans where only the high-level direction was established.For each approved issue, create it and assign it to the project with the correct phase, size, milestone, and dates:
# Create the issue (add --label "build-ready" if the issue is fully planned)
ISSUE_URL=$(gh issue create \
--title "<title>" \
--body "<body>" \
--label "enhancement" \
--label "feature-implementation" \
--milestone "<milestone-name>" | tail -1)
# Extract issue number from URL
ISSUE_NUM=$(echo "$ISSUE_URL" | grep -o '[0-9]*$')
# Add to project and set phase + size fields
ITEM_ID=$(gh project item-add {PROJECT_NUMBER} --owner {OWNER} --url "$ISSUE_URL" --format json | python3 -c "import json,sys; print(json.load(sys.stdin)['id'])")
gh project item-edit --project-id {PROJECT_ID} --id "$ITEM_ID" --field-id {PHASE_FIELD_ID} --single-select-option-id <phase-option-id>
gh project item-edit --project-id {PROJECT_ID} --id "$ITEM_ID" --field-id {SIZE_FIELD_ID} --single-select-option-id <size-option-id>
# Set Start and Target dates (computed from size estimate and schedule position)
gh project item-edit --project-id {PROJECT_ID} --id "$ITEM_ID" --field-id {START_FIELD_ID} --date <start-date>
gh project item-edit --project-id {PROJECT_ID} --id "$ITEM_ID" --field-id {TARGET_FIELD_ID} --date <target-date>[!NOTE] Project field IDs — Refresh from gh project field-list 6 --owner {OWNER} --format json if the project structure changes.>
- Phase field:{PHASE_FIELD_ID}— Options: M0 (5d1aaeb2), M1 (4cfa6c51), M2 (27c0efa8), M3 (ed327f33), M4 (df98aad8), M5 (0604582f) - Size field:{SIZE_FIELD_ID}— Options: XS (88044618), S (27e6800e), M (c4753411), L (cde643b6), XL (286a9b9c) - Milestone numbers: M0=1, M1=2, M2=3, M3=4, M4=5, M5=6 - Start field:{START_FIELD_ID}- Target field:{TARGET_FIELD_ID}
When creating issues, compute Start and Target dates following the scheduling rules in AGENTS.md:
gh project item-list {PROJECT_NUMBER} --owner {OWNER} --format json --limit 200Find the latest Target date of any non-gate item in the milestone. Gate items are issues labeled gtm-review or security-audit — exclude them when determining the insertion point.
gh api repos/{OWNER}/{REPO}/milestones/<number> -X PATCH -f due_on="<new-target>T00:00:00Z"[!IMPORTANT] No issue of any kind (feature, bug fix, chore, test, etc.) may ever be scheduled after the GTM review and security audit gate items. These two items are always the final items in every milestone, and their order (GTM → security audit) is an invariant that must be preserved on every project update.
If multiple issues were requested, create each in sequence and capture the issue numbers for cross-referencing.
Report the created issue number(s), URL(s), project phase assignment(s), milestone(s), and scheduled dates.
Every project phase must end with a comprehensive Go to Market & Business Review issue. After creating or assigning feature issues, verify GTM coverage for every affected phase:
gh issue list --state open --label "gtm-review" --json number,title gh issue create \
--title "gtm: Go to Market & Business Review — <Phase Name>" \
--body "<body>" \
--label "enhancement" \
--label "marketing" \
--label "gtm-review"The GTM review issue body must include:
[!IMPORTANT] All user-facing copy produced during GTM work (landing pages, blog posts, in-app text, marketing content) must follow the User-Facing Content Style rules in AGENTS.md. No em dashes, no AI-slop vocabulary, no promotional inflation.Add the GTM review issue to the project with the correct phase, size, milestone, and dates:
GTM_URL=<created-issue-url>
GTM_NUM=$(echo "$GTM_URL" | grep -o '[0-9]*$')
# Add to project and set fields
GTM_ITEM_ID=$(gh project item-add {PROJECT_NUMBER} --owner {OWNER} --url "$GTM_URL" --format json | python3 -c "import json,sys; print(json.load(sys.stdin)['id'])")
gh project item-edit --project-id {PROJECT_ID} --id "$GTM_ITEM_ID" --field-id {PHASE_FIELD_ID} --single-select-option-id <phase-option-id>
gh project item-edit --project-id {PROJECT_ID} --id "$GTM_ITEM_ID" --field-id {SIZE_FIELD_ID} --single-select-option-id <size-option-id>
gh project item-edit --project-id {PROJECT_ID} --id "$GTM_ITEM_ID" --field-id {START_FIELD_ID} --date <start-date>
gh project item-edit --project-id {PROJECT_ID} --id "$GTM_ITEM_ID" --field-id {TARGET_FIELD_ID} --date <target-date>The GTM issue is S (2 business days). Its Start date is the next business day after the last feature issue's Target in the phase. Compute dates using the same schedule logic as feature issues (see Schedule Date Computation above).
[!IMPORTANT] GTM review issues ensure that every shippable phase includes a business review checkpoint. They are not optional — every phase must have one before the phase is considered complete. Exemption: Phases that are purely bug fixes or continuous delivery/maintenance (e.g., dependency upgrades, security patches, CI improvements) are exempt.
Every project phase must end with a comprehensive Security Audit issue as its final work item — after the GTM review. This ensures that any code changes introduced during the GTM review are also covered by the audit. After verifying GTM coverage, verify security audit coverage for every affected phase:
gh issue list --state open --label "security-audit" --json number,title gh issue create \
--title "security: Comprehensive Security Audit — <Phase Name>" \
--body "<body>" \
--label "enhancement" \
--label "security-audit"The security audit issue body must include:
Add the security audit issue to the project with the correct phase, size, milestone, and dates:
SEC_URL=<created-issue-url>
SEC_NUM=$(echo "$SEC_URL" | grep -o '[0-9]*$')
# Add to project and set fields
SEC_ITEM_ID=$(gh project item-add {PROJECT_NUMBER} --owner {OWNER} --url "$SEC_URL" --format json | python3 -c "import json,sys; print(json.load(sys.stdin)['id'])")
gh project item-edit --project-id {PROJECT_ID} --id "$SEC_ITEM_ID" --field-id {PHASE_FIELD_ID} --single-select-option-id <phase-option-id>
gh project item-edit --project-id {PROJECT_ID} --id "$SEC_ITEM_ID" --field-id {SIZE_FIELD_ID} --single-select-option-id <size-option-id>
gh project item-edit --project-id {PROJECT_ID} --id "$SEC_ITEM_ID" --field-id {START_FIELD_ID} --date <start-date>
gh project item-edit --project-id {PROJECT_ID} --id "$SEC_ITEM_ID" --field-id {TARGET_FIELD_ID} --date <target-date>The security audit issue is M (3 business days). Its Start date is the next business day after the GTM issue's Target in the same phase. The security audit is always the last issue in a phase. Compute dates using the same schedule logic as feature issues (see Schedule Date Computation above).
[!IMPORTANT] Security audit issues ensure that every shippable phase includes a security checkpoint before release. They are not optional — every phase must have one before the phase is considered complete. The security audit is always the last issue in a phase, running after the GTM review. Run it using /security-audit. Exemption: Phases that are purely bug fixes or continuous delivery/maintenance (e.g., dependency upgrades, security patches, CI improvements) are exempt — same as the GTM review exemption.Present a clear summary:
Next step: Run /build-feature <issue-number> for full-stack implementation, or /build-api for backend-only work.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.