executing-plans — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited executing-plans (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 2 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Load plan, review critically, execute all tasks, report when complete.
Announce at start: "I'm using the executing-plans skill to implement this plan."
Note: Tell your human partner that Aegis works much better with access to subagents. The quality of its work will be significantly higher if run on a platform with subagent support (such as Claude Code or Codex). If subagents are available, use aegis:subagent-driven-development instead of this skill.
If the plan has multiple tasks, may span sessions, or includes architecture / contract / workflow changes:
For each task:
Pre-Edit Complexity Check or create a compact one:
Use using-aegis/references/complexity-governance.md for shared artifact classes, pressure signals, and over-budget handling.
Complexity Budget:
- Artifact class:
- Target files / artifacts:
- Current pressure:
- Projected post-change pressure:
- Budget result: within-budget | at-risk | over-budget
- Planned governance:
Pre-Edit Complexity Check:
- Safer edit boundary:
- Decision: edit-in-place | extract helper | add owner file | split task | pause for plan updateIf the check contradicts the plan's file boundary, pause and return to plan review instead of silently stuffing logic into an overloaded owner. If the budget result is over-budget and the task does not also govern that overrun, stop execution and return to plan review rather than pushing the task through as if it were still atomic.
TodoCheckpointDraft and DriftCheckDraft before marking the task completedAfter all tasks complete and verified:
STOP executing immediately when:
Ask for clarification rather than guessing.
Return to Review (Step 1) when:
Don't force through blockers - stop and ask.
Required workflow skills:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.