plan-features — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited plan-features (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generate a structured execution plan document that enables multi-team agent work with worktree isolation. The plan is the product -- execution is mechanical downstream.
/plan-features [description of features/changes] [--doc path/to/requirements.md] [--output path/to/plan.md]Examples:
/plan-features "add WebSocket support for real-time updates"/plan-features --doc docs/brainstorms/SECURITY_ROADMAP.md --output docs/brainstorms/EXECUTION_PLAN.md/plan-features "refactor plugin system to support async initialization and health checks"A single markdown document containing everything an executor needs to run teams without ambiguity:
Read the user's feature description or requirements doc. If the scope is ambiguous, ask clarifying questions BEFORE proceeding:
Spawn an Explore agent to map the affected areas:
This is the most important step. The file list drives everything.
Break the work into teams where each team:
Sizing rule: If a team touches >8 files, it's too big. Split it.
Naming rule: Teams get letter codes (A, B, C) for the main plan or numbered codes (Team 1, Team 2) for sub-plans. Names should be descriptive: "Team J: httpOnly Cookie Auth" not "Team J".
This is the MOST CRITICAL artifact. It determines merge order.
### Shared File Conflicts
| File | Touched by Teams |
|------|-----------------|
| `path/to/shared_file.py` | A, C, D |
| `path/to/other_file.js` | B, C |Rule: If two teams touch the same file, they CANNOT run in parallel (worktree merge conflicts). They must be sequenced, and the merge order matters.
Two types of dependencies:
### Dependency Chain
- Team A (independent) -- can start immediately
- Team B (blocked by A) -- A's output is B's input
- Team C (blocked by A, B) -- touches files modified by bothThe longest chain of sequential dependencies. This determines minimum execution time.
### Critical Path
Team A -> Team C -> Team D -> Team FEach team spec MUST include ALL of the following:
### Team X: [Descriptive Name]
**Blocked by:** [Team(s) or "none -- can start immediately"]
**Read these files first:** (CRITICAL -- prevents agents from building on stale assumptions)
- `path/to/file.py` -- [why: current auth system]
- `path/to/other.py` -- [why: middleware stack order]
**Files touched:**
- New: `path/to/new_file.py` -- [description]
- Modified: `path/to/existing.py` -- [what changes]
**Deliverable:** [One sentence: what exists after this team finishes]
**Validation:**
- [ ] `specific test command` passes
- [ ] `specific lint command` passes
- [ ] [Manual check if applicable]
**Agent instructions:**
- You MUST `git add` + `git commit` before finishing
- Follow existing patterns in [specific file]
- [Any team-specific constraints]The "Read these files first" section prevents the #1 execution failure: agents building on assumptions from their training data instead of the actual codebase state.
The "Agent instructions" section prevents the #2 failure: agents not committing their work, causing it to be lost when the worktree is cleaned up.
## Risk Register
| Risk | Likelihood | Impact | Mitigation |
|------|-----------|--------|------------|
| Team X breaks Y | Medium | High | [specific mitigation] |Focus on:
Group teams into execution sessions based on:
## Session Plan
### Session 1
**Sequential:** Team A -> Team C -> Team D (shared file conflicts)
**Parallel after D:** Teams E, F, G (no shared files)
**Validation gate:** Full test suite between sessions
### Session 2
**Sequential:** Team H -> Team I (depends on Session 1 output)The plan document MUST follow this structure:
# [Feature Name] -- Execution Plan
> Generated from [source]. Last updated: [date]
## Constraints
- [Hard constraints from user]
- [Discovered constraints from recon]
## File Conflict Table
[Step 4 output]
## Dependency Graph
[Step 5 output]
## Critical Path
[Step 6 output]
---
## Teams
### Team A: [Name]
[Step 7 spec]
---
### Team B: [Name]
[Step 7 spec]
---
[...more teams...]
## Risk Register
[Step 8 output]
## Session Plan
[Step 9 output]pytest tests/api/test_session_auth.py -x -q -- 21 tests pass" is.security_middleware.py, they are SEQUENTIAL, period.grep -c or wc -l output -- never eyeballed. An audit that says "20 importers" when the real count is 51 produces plans with wrong blast-radius estimates. Recon agents must run the count command and include the exact number.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.