make-goal — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited make-goal (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill to turn engineering intent into a runnable task contract for an agent. The output is a /goal contract, a review of an existing goal, or a catalog-entry draft when explicitly requested. Do not implement the underlying software task unless the user separately asks for execution.
A good goal is not a wish. It is a contract with one measurable objective, real context to inspect, hard constraints, auditable completion, fresh verification, and stop rules for uncertainty or risk.
create: The user gives a task, issue, failure, plan, or vague request and wants a new /goal.tighten: The user gives an existing draft and wants it made safer or more executable.review: The user asks whether a goal is good; lead with defects, missing evidence, and risk.catalog: The user wants to add a goal pattern to an awesome-goal-prompts style catalog; read references/catalog-contribution.md.If the user asks for a goal and also asks you to execute it, first produce the goal contract. Execute only after the user confirms or separately asks for execution.
Before drafting, inspect available context instead of guessing:
AGENTS.md or CLAUDE.md, relevant issue/PLAN/docs/logs, and the files or commands named by the user.CONTEXT.Ask at most three concise questions only when missing information changes the contract. The highest-value questions are:
If the request is only "make this project better", "fix everything", or similarly broad, use clarify_first: ask for the primary goal, context, and done-when condition instead of drafting a fake comprehensive goal.
Use the full shape by default. Use compact only for routine, low-risk work with clear context and one or two simple verification commands.
Use full when any of these are true:
Do not over-process tiny tasks. If the requested change is routine and the diff could be described in one sentence, use compact or answer directly when the user did not ask for a goal.
Read references/contract-shape.md for the full and compact templates.
For long-horizon work where a single prompt would become a backlog, keep the /goal itself short and make the goal require durable local artifacts:
Use this only when the task genuinely needs multiple independently verifiable phases. Do not turn a small one-file task into an artifact system.
Use source-backed patterns first when a close match exists. They are trusted shapes backed by public examples, not text to copy verbatim.
Use seed patterns only as raw reusable shapes when no source-backed pattern fits. Never describe a seed as collected from X, GitHub, docs, or a named author.
Read:
references/pattern-selection.md when choosing between source-backed and seed patterns.references/source-backed-index.md for common rescue contracts and goal-workflow patterns.references/seed-patterns-index.md only when the source-backed index lacks a close shape.When reviewing generated output, run the bundled linter if a local shell is available:
python3 scripts/lint_goal.py <goal-or-response.md>Use --profile compact, --profile data-migration, --profile security-xss, --profile read-only, --profile launch-readiness, or --profile clarify when the task type is known. Combine profiles with commas, such as --profile read-only,security-xss, when a goal has multiple risk modes. Use --json when another script will consume the result.
Run the deterministic fixture evals after changing this skill:
python3 scripts/run_evals.pyEvery full goal must contain exactly these sections:
/goal
GOAL:
<One measurable goal.>
CONTEXT:
- <Files, docs, issues, logs, screenshots, commands, baseline, and conventions to inspect first.>
CONSTRAINTS:
- <What must not change; what must be preserved; safety, data, security, test, and scope boundaries.>
DONE WHEN:
- <Mechanically auditable completion condition.>
VERIFY:
- <Fresh command, report, screenshot, artifact, manual check, or explicit blocker.>
OUTPUT:
- <Changed files if execution occurs, key decisions, verification output, remaining risk, follow-up.>
STOP RULES:
- <When to pause instead of guessing.>Compact form:
/goal <single measurable goal>
Read first: <files/issues/logs>.
Constraints: <what must not change; what must be preserved>.
Done when: <mechanically checkable end state>.
Verify with: <commands/reports/screenshots/evidence>.
Stop if: <missing input, destructive operation, repeated failed fixes, production access, or unclear product decision>.
Final output: <changed files, verification, risks, next action>.Include these constraints unless they conflict with a more specific user requirement:
Verification integrity: constraint when edits, validation, generated outputs, tests, lint, typecheck, screenshots, or external checks are involved. Use this shape: Verification integrity: do not weaken or bypass tests, assertions, lint, typecheck, validation, generated-output checks, screenshots, or external blockers to make the goal pass; fix the root cause or report the blocker.DONE WHEN.For full goals that may lead to file edits, include the scope, verification-integrity, and repository-instruction defaults as actual CONSTRAINTS text, not only as internal guidance.
Keep context precise. Name the minimum useful files, issues, logs, screenshots, URLs, commands, or baselines instead of asking the agent to read the whole repository. Treat AGENTS.md and CLAUDE.md as context sources with different tool semantics; do not imply every coding agent loads the same instruction files automatically.
Add category-specific constraints when relevant:
dry-run into the goal. Require a dry-run when the stack supports it; if true dry-run is unavailable, say so explicitly and require a disposable-environment rehearsal instead. Also require rollback or forward-only recovery notes, row-count/checksum or equivalent integrity evidence, and no silent data loss.For non-trivial goals, include risk, trade-off, or blast-radius reporting in OUTPUT rather than adding a new top-level section.
Read references/quality-bar.md before finalizing high-risk goals.
When creating or tightening a goal:
text block.是否现在启动这个 goal?如果你回复“启动”或“开始执行”,我会先注册 active goal(如果当前运行环境支持),再按这个 contract 执行;否则只保留为可复制的 goal。create_goal with the contract objective before executing, and call the completion tool such as update_goal only after DONE WHEN and VERIFY are satisfied. If no active-goal mechanism is available, say that explicitly before executing manually.When reviewing a goal:
VERIFY, unsafe constraints, or weak stop rules.When writing a catalog entry:
references/catalog-contribution.md.source-backed from seed.Before responding, verify:
CONTEXT names real files, issues, logs, docs, commands, screenshots, or baselines when available.CONSTRAINTS say what must not change.DONE WHEN is mechanically checkable or evidence-based.VERIFY requires fresh evidence from the actual run or an exact blocker, not only a generic phrase such as "run tests".STOP RULES cover secrets, production access, destructive operations, repository settings or owner approval when relevant, unclear decisions, and repeated failed fixes.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.