planning-mode — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited planning-mode (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
/planning-mode — Enable planning mode, then prompt for a topic/planning-mode <topic> — Enable planning mode and start planning/planning-mode continue — List existing plan folders and resume one/planning-mode off — Disable planning modePlanning mode works best with automated reminders, but it can still run with manual planning-doc updates when hook support is unavailable.
| Tool | Hook config location / equivalent | Script format argument |
|---|---|---|
| Claude Code | ~/.claude/settings.json | _(none — default)_ |
| Copilot | ~/.copilot/hooks.json | copilot |
| Pi | Bundled active-mode extension in .pi/agent/extensions/active-mode/ | _(extension-driven)_ |
Claude Code and Copilot support the bundled PostToolUse and SessionStart hook scripts directly. Pi does not use the same standalone hook configuration files in this repository's starter config. Instead, this starter config now ships a Pi-native active-mode extension that reads .ai/.active-mode, clears stale flags on fresh session start, injects reminder context before LLM calls, and shows mode status in the UI. If that extension is not installed, fall back to manual planning-doc updates.
If you cannot determine which tool you are, ask the user.
Use persistent markdown files as your "working memory on disk." Context windows are volatile and limited; anything important gets written to disk.
./templates/| File | Purpose | When to Update | Scope |
|---|---|---|---|
plan.md | Work breakdown, decisions | After each phase | All plans |
findings.md | Research, discoveries | Per 2-action rule | All plans |
questions.md | Log of questions and user responses | Throughout planning | All plans |
progress.md | Session log, test results | Throughout session | Multi-phase only |
You must follow these steps in order:
If the skill was invoked with the argument "off", skip this step and go directly to Step 2.
Otherwise:
bash {skill-dir}/scripts/check-hooks.sh and parse the structured output.bash {skill-dir}/scripts/check-hooks.sh copilot and parse the structured output.active-mode extension instead of standalone hook files. If that extension is installed, planning mode gets equivalent reminder/cleanup behaviour automatically. Otherwise planning mode will rely on manual update discipline only. Then continue to Step 2.For Claude Code and Copilot:
Parse the arguments:
{repo root}/.ai/.active-mode with: mode: planning
folder: (pending)
started: {yyyy-mm-dd HH:mm}{task-name} — an extremely succinct name for the task, use kebab-case e.g. refactor-mfa-flow.{repo root}/.ai/planning/{yyyy-mm-dd} {task-name}/ where:{repo root} is the root of the current repository{yyyy-mm-dd} is the date of the plan creation{task-name} is the name derived in the previous step{repo root}/.ai/.active-mode with: mode: planning
folder: {repo root}/.ai/planning/{yyyy-mm-dd} {task-name}/
started: {yyyy-mm-dd HH:mm}If it already exists (from Step 3a), update the folder: line.
{repo root}/.ai/planning/..ai/planning/. Use /planning-mode <topic> to start a new one."ls "{repo root}/.ai/planning/" via Bash.{yyyy-mm-dd} folder prefix sorts correctly lexicographically). 1. 2026-04-10 refactor-auth-flow
2. 2026-04-08 add-retry-metricsplan.mdprogress.md (multi-phase plans only)findings.mdquestions.mdIf plan.md is missing, tell the user the plan is incomplete and continue with whatever does exist.
{repo root}/.ai/.active-mode with: mode: planning
folder: {repo root}/.ai/planning/{selected folder}/
started: {yyyy-mm-dd HH:mm}{folder path}. Use /planning-mode off when done. Planning mode will be auto-disabled by starting a new session when supported by your harness configuration."/rename {task name} to rename this conversation." where {task name} is the folder name with the date prefix removed./name {task name} to name this conversation." where {task name} is the folder name with the date prefix removed.{task name} if your tool supports it."findings.md in the plan folder following the template: templates/findings.mdfindings.md as you go.Based on your research, explicitly determine whether this is a multi-phase plan. A plan is multi-phase if it meets ANY of the following:
Document your determination and reasoning at the top of findings.md under a ## Plan Size heading.
Create the remaining planning files from the templates based on the determination in step 5 (see Planning files). Populate plan.md with the plan and questions.md with any unresolved questions. Keep questions.md scaffolded even if you have no questions yet, as they may come up later. For multi-phase plans, also create progress.md as a stub — it will be populated during execution.
You must use the starting templates (see Planning files) when creating or updating planning files to guide the structure and content of these files.
/planning-mode off when done. Planning mode will be auto-disabled by starting a new session when supported by your harness configuration."/rename {task name} to rename this conversation."/name {task name} to name this conversation."{task name} if your tool supports it."This step repeats until the planning mode is off.
While planning mode is active, if your harness has PostToolUse hook support configured, the hook outputs reminders after each tool use. When you see these reminders:
When /planning-mode off is invoked:
{repo root}/.ai/.active-modeFor harnesses with SessionStart hook support configured, stale flag files from previous sessions are cleared automatically. In Pi, the bundled active-mode extension clears stale flags on fresh session start when installed. Without that extension, delete a stale .ai/.active-mode file before re-enabling planning mode if one is left behind.
planning skill (in each phase, for multi-phase plans)rust-bevy-standards, java-conventions, tdd)tdd skill for any code you write and task descriptions featuring development work must make this clear"After every 2 view/browser/search operations, IMMEDIATELY save key findings to text files."
This prevents visual/multimodal information from being lost.
Before major decisions, read the plan file. This keeps goals in your attention window.
After completing any phase:
## Status in plan.mdIn progress → CompleteEvery error goes in plan.md (the single home for errors across all planning files). This builds knowledge and prevents repetition.
if action_failed:
next_action != same_actionTrack what you tried. Mutate the approach.
ATTEMPT 1: Diagnose & Fix
→ Read error carefully
→ Identify root cause
→ Apply targeted fix
ATTEMPT 2: Alternative Approach
→ Same error? Try different method
→ Different tool? Different library?
→ NEVER repeat exact same failing action
ATTEMPT 3: Broader Rethink
→ Question assumptions
→ Search for solutions
→ Consider updating the plan
AFTER 3 FAILURES: Escalate to User
→ Explain what you tried
→ Share the specific error
→ Ask for guidancePlanning mode relies on two hooks to function fully. Without the PostToolUse hook, only the manual update discipline (Step 8) applies.
Step 1 runs scripts/check-hooks.sh to verify configuration automatically for Claude Code and Copilot. If that reports STATUS: NO or STATUS: PARTIAL, offer to add the missing hooks using the appropriate format below.
Merge into ~/.claude/settings.json:
{
"hooks": {
"PostToolUse": [
{
"matcher": "",
"hooks": [
{
"type": "command",
"command": "bash ~/.claude/skills/planning-mode/scripts/planning-mode-hook.sh"
}
]
}
],
"SessionStart": [
{
"matcher": "",
"hooks": [
{
"type": "command",
"command": "bash ~/.claude/skills/planning-mode/scripts/clear-mode.sh"
}
]
}
]
}
}Merge into ~/.copilot/hooks.json:
{
"hooks": {
"postToolUse": [
{
"type": "command",
"bash": "~/.copilot/skills/planning-mode/scripts/planning-mode-hook.sh copilot"
}
],
"sessionStart": [
{
"type": "command",
"bash": "~/.copilot/skills/planning-mode/scripts/clear-mode.sh copilot"
}
]
}
}Note: Thecopilotargument tells the scripts to output JSON withadditionalContextfor Copilot's context injection format.
This repository's Pi starter config includes the active-mode extension under .pi/agent/extensions/active-mode/. That extension uses Pi lifecycle events:
session_startbefore_agent_start and contextctx.ui.setStatus()If that extension is installed, planning mode gets equivalent reminder and stale-flag cleanup behaviour automatically. If it is not installed, use manual document updates.
.ai/.active-mode flag file. If another mode is active (check mode: field in .ai/.active-mode), disable it before enabling planning-mode.active-mode extension provides the equivalent behaviour without standalone hook files./planning-mode at the start of the new session.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.