using-planflow — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited using-planflow (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Long conversations degrade: details get lost, context rots, and the agent starts re-deriving or contradicting earlier decisions. PlanFlow routes around this by externalizing state to files and keeping each working session short and focused on exactly one task.
pipeline, migration).
PLAN.md or HANDOFF.md already exists in the project — read it FIRST.For a small one-off change, skip the ceremony and just do it.
broken into small, ordered, checkbox tasks, each with acceptance criteria and the files it touches.
Mixing transient state into long-term files is what re-rots your context. Be strict about which file holds what:
PLAN.md — tasks and their status. Nothing else.CLAUDE.md — ONLY decisions that stay true many sessions from now(architecture, naming rules, "always do X", verified findings). Do NOT put here: task status, one-run values (a temporary batch size), one-off paths, or experiment results.
HANDOFF.md — a transient snapshot of an in-progress task; overwrite freely.WORKLOG.md — an append-only log of results/experiments if yourproject produces them, so results never leak into CLAUDE.md.
A good task is something ONE fresh session can finish without approaching the context limit: one coherent unit (a module, function, fix, or thin slice), doesn't need the whole codebase in context, has a concrete "Done when…" condition, and is ordered so earlier tasks unblock later ones. If a task needs more than ~1 hour or touches many files at once, split it further.
PLAN.md and (if present) HANDOFF.md FIRST.in PLAN.md, add a one-line result note, and record any durable decision in CLAUDE.md. Never tick a box you could not verify.
roll into the next task in the same conversation.
HANDOFF.md and stop./planflow:plan <goal>) — turn a goal into an ordered PLAN.mdtask list. No coding yet.
/planflow:next) — execute the next unchecked task: read only itsfiles, implement, verify with evidence, tick the box, then print a closure summary (changed files + the command that verified it + a suggested commit message), then STOP. Manual-invoke only by design: advancing is the human's decision, in a fresh session.
/planflow:handover) — snapshot the working state toHANDOFF.md before a long session ends.
Typical loop: plan once → next per fresh session until every box is ticked → handover only if a single session must pause mid-task.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.