writing-plans — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited writing-plans (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Write comprehensive implementation plans assuming the engineer has zero context for our codebase and questionable taste. Document everything they need to know: which files to touch for each task, code, testing, docs they might need to check, how to test it. Give them the whole plan as bite-sized tasks. DRY. YAGNI. TDD. Frequent commits.
Assume they are a skilled developer, but know almost nothing about our toolset or problem domain. Assume they don't know good test design very well.
Announce at start: "I'm using the writing-plans skill to create the implementation plan."
Before writing the implementation plan, you MUST verify:
triage skill) detailing category, acceptance criteria, and out-of-scope boundaries. If no brief exists, stop and run the triage skill first.docs/adr/. If missing but required, write the ADR first.Context: If working in an isolated worktree, it should have been created via the superpowers:using-git-worktrees skill at execution time.
Save plans to: docs/superpowers/plans/YYYY-MM-DD-<feature-name>.md
If the spec covers multiple independent subsystems, it should have been broken into sub-project specs during brainstorming. If it wasn't, suggest breaking this into separate plans — one per subsystem. Each plan should produce working, testable software on its own.
Before writing any tasks, operate in read-only mode:
Do NOT write code during planning. The output is a plan document, not implementation.
Map what depends on what before defining tasks. This determines implementation order:
Database schema
│
├── API models/types
│ │
│ ├── API endpoints
│ │ │
│ │ └── Frontend API client
│ │ │
│ │ └── UI components
│ │
│ └── Validation logic
│
└── Seed data / migrationsImplementation order follows the dependency graph bottom-up: build foundations first.
If you skip this step, you'll order tasks by perceived importance instead of by what must exist before what, and later tasks will reference things that haven't been built yet.
Instead of building all the database, then all the API, then all the UI — build one complete feature path at a time:
Bad (horizontal slicing):
Task 1: Build entire database schema
Task 2: Build all API endpoints
Task 3: Build all UI components
Task 4: Connect everythingGood (vertical slicing):
Task 1: User can create an account (schema + API + UI for registration)
Task 2: User can log in (auth schema + API + UI for login)
Task 3: User can create a task (task schema + API + UI for creation)
Task 4: User can view task list (query + API + UI for list view)Each vertical slice delivers working, testable functionality. The system is never in a broken intermediate state.
Before writing tasks, map the approved request to the plan so execution cannot drift:
## Requirements Traceability
| Requested behavior / surface | Planned task(s) | Verification |
|-----------------------------|-----------------|--------------|
| `/login` is the primary entrypoint | Tasks 1, 2 | Playwright login flow |
| Admin portal can manage teams | Tasks 3, 4 | Integration test + browser check |
| Cards can be created and moved | Tasks 5, 6 | Unit + e2e drag/drop |If you cannot fill in this table, the plan is not ready. Missing rows are a stop-the-line issue.
For user-facing apps, include a route/surface map:
## Route And Surface Map
- `/login` — real auth surface, not a marketing page
- `/admin` — real management surface, not a static preview
- `/boards/:id` — real board interactions, not decorative cardsDo not let "polish", "modern UI", or "production-like" replace this mapping.
Before defining tasks, map out which files will be created or modified and what each one is responsible for. This is where decomposition decisions get locked in.
This structure informs the task decomposition. Each task should produce self-contained changes that make sense independently.
| Size | Files | Scope | Example |
|---|---|---|---|
| XS | 1 | Single function or config change | Add a validation rule |
| S | 1-2 | One component or endpoint | Add a new API endpoint |
| M | 3-5 | One feature slice | User registration flow |
| L | 5-8 | Multi-component feature | Search with filtering and pagination |
| XL | 8+ | Too large — break it down further | — |
If a task is L or larger, break it into smaller tasks. Agents perform best on S and M tasks.
When to break a task down further:
Within each task, steps are one action (2-5 minutes):
Every step has the actual code or command. No "then implement the feature" — show the code.
Every plan MUST start with this header:
# [Feature Name] Implementation Plan
> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
**Goal:** [One sentence describing what this builds]
**Architecture:** [2-3 sentences about approach]
**Tech Stack:** [Key technologies/libraries]
---### Task N: [Component Name]
**Files:**
- Create: `exact/path/to/file.py`
- Modify: `exact/path/to/existing.py:123-145`
- Test: `tests/exact/path/to/test.py`
**Acceptance criteria:**
- [ ] [Specific, testable condition]
- [ ] [Specific, testable condition]
**Dependencies:** [Task numbers this depends on, or "None"]
**Estimated scope:** [XS/S/M]
- [ ] **Step 1: Write the failing test**
def test_specific_behavior(): result = function(input) assert result == expected
- [ ] **Step 2: Run test to verify it fails**
Run: `pytest tests/path/test.py::test_name -v`
Expected: FAIL with "function not defined"
- [ ] **Step 3: Write minimal implementation**
def function(input): return expected
- [ ] **Step 4: Run test to verify it passes**
Run: `pytest tests/path/test.py::test_name -v`
Expected: PASS
- [ ] **Step 5: Commit**
git add tests/path/test.py src/path/file.py git commit -m "feat: add specific feature"
Insert review checkpoints between major phases of the plan:
## Checkpoint: After Tasks 1-3
- [ ] All tests pass: `npm test`
- [ ] Application builds without errors: `npm run build`
- [ ] Core user flow works end-to-end
- [ ] Review with human before proceedingArrange tasks so that:
After the task list, include a risks section:
## Risks and Mitigations
| Risk | Impact | Mitigation |
|------|--------|------------|
| [Risk description] | High/Med/Low | [Strategy to address it] |
| [Risk description] | High/Med/Low | [Strategy to address it] |
## Open Questions
- [Question needing human input before implementation starts]
- [Assumption that needs validation]If there are no open questions, say "None" — don't skip the section.
Every step must contain the actual content an engineer needs. These are plan failures — never write them:
| Rationalization | Reality |
|---|---|
| "I'll figure it out as I go" | That's how you end up with a tangled mess and rework. 10 minutes of planning saves hours. |
| "The tasks are obvious" | Write them down anyway. Explicit tasks surface hidden dependencies and forgotten edge cases. |
| "Planning is overhead" | Planning is the task. Implementation without a plan is just typing. |
| "I can hold it all in my head" | Context windows are finite. Written plans survive session boundaries and compaction. |
| "This is too small to need a plan" | Small tasks don't need long plans, but they still need acceptance criteria and a verification step. A 3-step plan is fine. |
| "I'll add the tricky parts later" | The tricky parts are exactly what needs planning. If you're skipping them, the plan is incomplete. |
| "Horizontal slicing is easier to plan" | Easier to plan, harder to execute. Horizontal slices leave the system broken until the last task connects everything. Vertical slices deliver working software at every step. |
After writing the complete plan, look at the spec with fresh eyes and check the plan against it. This is a checklist you run yourself — not a subagent dispatch.
1. Spec coverage: Skim each section/requirement in the spec. Can you point to a task that implements it? List any gaps.
2. Placeholder scan: Search your plan for red flags — any of the patterns from the "No Placeholders" section above. Fix them.
3. Type consistency: Do the types, method signatures, and property names you used in later tasks match what you defined in earlier tasks? A function called clearLayers() in Task 3 but clearFullLayers() in Task 7 is a bug.
4. Dependency order: Does every task reference only things built in earlier tasks (or things that already exist in the codebase)? If a task depends on something from a later task, the order is wrong.
5. Vertical slice check: Does each task deliver working, testable functionality on its own? If a task only makes sense after 3 other tasks are done, it's not a vertical slice.
6. Sizing check: Are any tasks L or larger? If so, break them down. Are there tasks with more than 5 acceptance criteria? If so, they're doing too much.
7. Traceability check: Can every requested route, surface, and behavior be pointed to in the traceability table? If not, add or fix tasks.
8. Surface integrity check: For user-facing apps, does the route map prove that the primary entrypoint and requested surfaces are functional in the planned slice? If not, the plan is drifting.
If you find issues, fix them inline. No need to re-review — just fix and move on. If you find a spec requirement with no task, add the task.
After saving the plan, offer execution choice:
"Plan complete and saved to `docs/superpowers/plans/<filename>.md`. Two execution options:
1. Subagent-Driven (recommended) - I dispatch a fresh subagent per task, review between tasks, fast iteration
2. Inline Execution - Execute tasks in this session using executing-plans, batch execution with checkpoints
Which approach?"
If Subagent-Driven chosen:
If Inline Execution chosen:
Before starting implementation, confirm:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.