task-flow — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited task-flow (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
My end-to-end flow for building a feature with trust. It is a thin orchestrator over superpowers — it sequences existing skills, it does not re-implement them. One human gate (after the plan); everything else runs automatically with per-task gates. The keystone is an adversarial verifier that re-checks "done" in fresh context.
constraints, definition of done. It also classifies greenfield vs brownfield and flags a hard-tech challenge (complex algorithm / performance bottleneck).
optional feature-dev plugin) to trace the existing code before planning. It ships agents, not skills — there is nothing to invoke with the Skill tool. Without the plugin, use the built-in Explore agent; either way the step is not optional, only the tool is.
candidates if needed (apply eskills:perf-bar), and pick the approach before committing the plan. The `code-architect` agent (same plugin, same caveat) helps here when present; it is not required.
Each task in the plan carries:
I review the plan + acceptance criteria and approve. Nothing in Phase 2 starts until I do.
Compact here. This gate is the prime context boundary: once the plan is approved, /compact to drop the exploration/brainstorming context and carry only the plan into Phase 2. Do the same after each milestone or before an unrelated task — strategic compaction at logical boundaries beats arbitrary auto-compaction mid-task.
superpowers:subagent-driven-developmentFor each task, in order:
DONE /DONE_WITH_CONCERNS / NEEDS_CONTEXT / BLOCKED.
implementer's self-report. Re-runs the gates itself — lint + typecheck + tests, per eskills:standards — and checks real output against the acceptance criteria. It defaults to NOT done, and marks done only when it has itself seen lint pass, typecheck pass, tests pass, and the output meet every acceptance criterion.
eskills:ux-bar / eskills:security-bar / eskills:arch-bar / eskills:perf-bar.
Model selection: the implementer runs on Sonnet (model: "sonnet"), and so do the fixes the reviewers send back to it. The spec reviewer, the adversarial verifier and the quality reviewer inherit the session model (Opus). Never Haiku for code.
Test discipline comes from eskills:standards (integration tests, in-memory fakes, no mocks) — intentionally, not from superpowers:test-driven-development; my test philosophy differs.
A human-pulled escape hatch, available throughout Phase 2. Not a sequential step — an interrupt I fire when, watching the changes go by, I realize the spec itself missed something (a component that should be reused instead of rebuilt, scope to drop, a plan assumption that's false). There is no automatic trigger: only I pull this cord.
When pulled (I say something like "stop, the spec is wrong about…"):
missed: drop scope ("don't build/use this"), redirect ("reuse object/component Y"), or fix a plan assumption.
eskills:spec-intake — update only the requirements I asked tochange. No trail; the "why" lives in the conversation, not the document.
superpowers:writing-plans from the corrected spec.Compact after a discard. A re-spec that discards work is a context boundary like the plan gate — /compact to drop the abandoned-work context before re-launching.
superpowers:verification-before-completion + a final review pass.superpowers:finishing-a-development-branch.eskills:standards), release-please.The known failure mode is an agent claiming tests pass when they don't. The spec and quality reviewers read the diff and can inherit a false "tests passing" claim. The adversarial verifier re-runs the gates in fresh context and defaults to "not done", turning "the agent says it's done" into "it's done, and here is the evidence a second agent produced while trying to prove otherwise." That is trust, made into a gate.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.