oma-pm — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited oma-pm (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Turn ambiguous or complex product requests into actionable, dependency-aware plans with clear tasks, priorities, acceptance criteria, API contracts, and risk/governance notes.
task-board.md-compatible task breakdown.agents/results/outputs:
- name: plan
description: PM task breakdown JSON for orchestrator consumption
artifact: ".agents/results/plan-*.json"
required: trueresources/execution-protocol.md, examples, task template, and ISO planning guide| Action | SSL primitive | Evidence |
|---|---|---|
| Read requirements/context | READ | User request and project context |
| Select planning structure | SELECT | Task template and workflow needs |
| Infer tasks and dependencies | INFER | Domain decomposition |
| Validate acceptance criteria | VALIDATE | Checklist and task schema |
| Write plan artifacts | WRITE | JSON plan and task-board markdown |
| Notify plan summary | NOTIFY | Final planning report |
1. Define API/data contracts.
2. Decompose tasks with agent, title, priority, dependencies, and acceptance criteria.
3. Save `.agents/results/plan-{sessionId}.json` using the injected session ID. Write the run-scoped report from the shared memory/result contract.| Scope | Resource target |
|---|---|
MEMORY | Requirements, assumptions, dependencies |
LOCAL_FS | .agents/results/plan-{sessionId}.json, injected claim path and task/run-scoped report |
CODEBASE | Optional project context and API/data model references |
{id, description} acceptance criteria, covering required_checks with exact argv/cwd, a replayable task prompt, priority tier (1 = independent, lower runs first), dependencies, and scope../_shared/core/code-intelligence.md (code search/navigation)../_shared/runtime/memory-protocol.md, ../_shared/runtime/result-contract.mdresources/execution-protocol.mdresources/examples.mdresources/iso-planning.mdresources/error-playbook.mdresources/task-template.jsonresources/plan-phase-protocol.md (used when this skill runs inside the ultrawork workflow)../oma-orchestration/resources/memory-schema.md/plan workflow, also generate docs/plans/work/{NNN}-{name}.md per .agents/workflows/plan.md../_shared/core/api-contracts/template.md; write generated contracts to .agents/results/api-contracts/ (run artifact) or docs/plans/contracts/ (durable spec)../_shared/core/context-loading.md../_shared/core/difficulty-guide.md (unresolved scope or dependencies)../_shared/core/clarification-protocol.md../_shared/core/context-budget.md../_shared/core/lessons-learned.md (matching prior failure or requested retrospective)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.