A portable Agent Skill that checks project rules, verification paths, review workflow, and done criteria before agentic development starts.
SaferSkills independently audited agentic-dev-preflight (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Before development starts, determine whether the repository is ready for agentic engineering: can an agent understand the project rules, make a bounded change, verify it locally or through runtime evidence, and hand it back for review?
The output is a readiness judgment, bootstrapping order, and minimum workflow build plan, not only a task brief.
Treat preflight as read-only by default. Read files, inspect configuration, and run non-mutating discovery commands when useful. Do not edit files, install dependencies, change configuration, run migrations, delete content, push, rebase, or reset during preflight.
If the user asks to add missing rules, CI, tests, or configuration, first report the proposed changes and affected files. Stop for explicit confirmation when the action touches user or project safety boundaries.
If the project already has AGENTS.md, CLAUDE.md, .cursor/rules, README files, architecture docs, plans, or local workflow docs, read them first and treat project rules as authoritative.
Check each gate in order. Mark every gate as present, missing, partial, or not_applicable, and include evidence such as paths, commands, or observed absence.
For every missing or partial gate, state the smallest durable workflow artifact that would close the gap. Prefer concrete files, commands, report fields, or review roles over general advice.
| Gate | What to Check |
|---|---|
| 1. Rule Files | AGENTS.md, CLAUDE.md, .cursor/rules, or equivalent; directory rules, redlines, validation checklist, engineering discipline |
| 2. Task Brief | Goal, scope, exclusions, validation criteria, and whether large changes require a plan |
| 3. Local Verification | Discoverable lint, typecheck, test, build, smoke, or equivalent commands |
| 4. Runtime Evidence | Browser checks, screenshots, curl, logs, examples, sample input/output, or other observable acceptance paths |
| 5. CI / Automation | .github/workflows, pre-commit, Makefile, justfile, scripted validation entrypoints, or documented local-only fallback |
| 6. Review Workflow | Implementer / Tester / Reviewer / Orchestrator perspectives; whether they are assigned as agents, sessions, separate passes, or explicit review focus areas |
| 7. Done Standard | Fresh verification evidence, remaining risks, environment state, and review conclusion instead of only "done" |
| 8. Checkpoint / Rollback | Commit, branch, PR, rollback point, or staged gate expectations |
Treat role separation as a workflow requirement, not a requirement to always launch multiple agents. Check whether the workflow creates independent perspectives at the right moments:
Classify the review workflow:
present: the four perspectives are explicitly assigned as agents, separate sessions, separate passes, or documented review focus areas.partial: code review exists, but implementation, verification, direction, boundary, or risk perspectives are mixed together.missing: the implementer self-reviews without independent verification, direction review, or risk review.When the repository is not fully ready, propose the minimum workflow changes needed before or alongside development. Keep this plan read-only unless the user explicitly asks for implementation.
Cover only the gaps that apply:
Probe only capabilities relevant to the current project. Prefer evidence from project files over assumptions.
package.json, Vite or Next config, Playwright or Vitest setup, browser automation, screenshots, and documented smoke paths.Classify missing capabilities:
required_before_development: continuing would make the change unverifiable or likely to cross boundaries.recommended_before_merge: local work can proceed, but merge or release should wait.optional_later: improves speed or quality but is not a current gate.Give evidence before asking for user guidance. Ask only questions that change engineering direction, bootstrapping cost, or safety boundaries.
When the workflow is incomplete, prefer bootstrapping the workflow before business implementation.
Preflight: READY_FOR_DEVELOPMENT | NEEDS_BOOTSTRAP | BLOCKED
Workflow Readiness:
- Rule files:
- Task brief standard:
- Local verification:
- Runtime evidence:
- CI / automation:
- Review workflow:
- Done standard:
- Checkpoint / rollback:
Capability Gaps:
- Required before development:
- Recommended before merge:
- Optional later:
Workflow Bootstrap Plan:
- Rule files:
- Task slicing:
- Verification entrypoints:
- Runtime evidence:
- Review roles:
- Current model:
- Missing perspectives:
- Minimum split:
- No multi-agent fallback:
- Done report:
- Checkpoint / rollback:
Guidance Needed:
- ...
Proposed Next Step:
- ...READY_FOR_DEVELOPMENT: key gates exist, verification is clear, and the current task can be sliced into a verifiable increment.NEEDS_BOOTSTRAP: work can continue, but rules, verification, runtime evidence, review workflow, or done standard should be added first.BLOCKED: critical context, safety boundary, verification path, branch state, or repository state is missing; continuing would be unsafe or unverifiable.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.