brainstorming — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited brainstorming (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Register: TECHNIQUE Goal: Understand what's being built and why, produce a design both human and agent can commit to. Constraints: No code before SPEC_APPROVED: true set in spec frontmatter. Terminal state: audit-design → writing-plans. Never invoke writing-plans directly. Adapt: questions, pace, and depth to conversation — but every checkpoint must be reached.
Announce: "Using brainstorming to design before implementation."
# Load domain context if available:
!head -40 docs/superskills/CONTEXT.md 2>/dev/null || echo "No CONTEXT.md — consider running domain-alignment first for new projects"If CONTEXT.md is missing and this is a new project or unfamiliar domain → recommend domain-alignment first. If human prefers to proceed → proceed, but note vocabulary may need alignment mid-session.
7b. DPS SYSTEM INTENT check — C3+ only, or if project has DPS / spec will be promoted to DPS (see Step 7b below)
Goal: understand what's being built, why, and what success looks like. Constraints:
Exploring approaches:
Presenting the design:
Design for isolation:
Write spec:
# Save to:
docs/superskills/specs/YYYY-MM-DD-<topic>-design.mdSpec self-review:
Fix inline. Ask user to review.
Skip this step for C0-C2 tasks unless the project already uses DPS structure. If complexity-gate rated C3+, OR project has DPS initialized, OR spec will be promoted to DPS: Verify spec có answers cho tất cả SYSTEM INTENT fields:
[ ] PROBLEM: stated from user perspective (not technical solution)
[ ] FOR: specific user segment (not "everyone" / "users")
[ ] ASSUMING: ≥ 2 explicit world assumptions written down
[ ] WILL_DRIFT_IF: ≥ 1 trigger for assumption failure (business context, not technical)
[ ] NON-GOALS: ≥ 1 explicit out-of-scope item
[ ] ANTI-REQUIREMENTS: at least considered (may be "none identified")If any missing → fix in spec before setting SPEC_APPROVED: true. These fields prevent scope creep and assumption drift throughout implementation.
Set SPEC_APPROVED flag:
---
title: <feature>
date: YYYY-MM-DD
author: <name>
SPEC_APPROVED: true
SPEC_ESCALATION: false
ESCALATION_FINDING: ""
---git add docs/superskills/specs/
git commit -m "docs: spec approved — <feature-slug>"→ SPEC_APPROVED: true triggers audit-design. After audit-design PASS → writing-plans is invoked.
Optional: Promote to DPS structure For non-trivial projects, run dps-init after this commit. dps-init extracts SYSTEM INTENT, schemas, and components from this spec into structured DPS canonical files.
"Too simple to need a design" — Simple projects hide the most assumptions. Design can be short. It must exist.
"Skip CONTEXT.md, I know this domain" — The agent doesn't. Vocabulary mismatches survive into code.
"Invoke writing-plans directly" — Never. audit-design runs between spec approval and planning. Always.
<!-- Populated by knowledge-compound after cycles where this skill underperformed --> <!-- New entries must follow shared/gotcha-schema.md -->
status: ACTIVE source: production-audit evidence: T2 scope: skill applies_when: >- this skill is active and the same failure mode is plausible avoid_when: >- newer T1/T2 evidence shows this failure mode no longer applies in the current project last_seen: 2026-05-31 retire_if: >- no recurrence after 6 relevant cycles, or contradictory newer T1/T2 evidence narrows or invalidates the pattern claim: >- Spec drift: features mô tả là 'X' trong spec shipped là weaker stubs — gap không bị catch trong brainstorming (Apollos, 3 README gaps: human escalation, motion-aware blocking, SSE stream) root_cause: >- brainstorming approve concept của 'human escalation' mà không stress-test 'implementation tối thiểu nào satisfy spec này literally nhưng miss safety intent?' do_instead: >- Với mọi safety-critical hoặc user-trust feature trong spec: explicitly hỏi 'implementation đơn giản nhất có thể technically satisfy requirement này là gì?' Nếu answer là stub hoặc hardcoded value → add 'not a stub' như explicit acceptance criterion.
status: ACTIVE source: production-audit evidence: T2 scope: skill applies_when: >- this skill is active and the same failure mode is plausible avoid_when: >- newer T1/T2 evidence shows this failure mode no longer applies in the current project last_seen: 2026-05-31 retire_if: >- no recurrence after 6 relevant cycles, or contradictory newer T1/T2 evidence narrows or invalidates the pattern claim: >- Operational dependencies không được surface trong design — 'manual SQL seed required' emerge ở audit, không phải ở design (Tikai H9) root_cause: >- brainstorming focus vào 'what to build' mà không hỏi 'điều gì phải đúng trong environment để feature này produce correct output?' do_instead: >- Cuối brainstorming: explicitly hỏi 'environment preconditions nào phải đúng để feature này produce correct output?' Mỗi precondition không trong automated migration là deployment risk — flag trong spec.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.