devplan — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited devplan (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build Haiku-executable development plans from interview through verification. No MCP server required — everything runs locally as skill instructions + templates.
Arguments passed: $ARGUMENTS
Takes a software project from idea to structured, executable plan:
Begin with the interview. Ask questions ONE AT A TIME, waiting for each response:
After gathering answers, proceed to brief creation.
brief — create or parse a briefIf a PROJECT_BRIEF.md exists, read and parse it. Otherwise create one from the interview answers. See references/templates.md for the brief template.
Write the brief to PROJECT_BRIEF.md in the project root.
plan — generate the development planRequires a PROJECT_BRIEF.md (create one first if missing).
Critical: Read references/templates.md for the plan structure template, then read examples/hello-cli-plan.md for the gold standard example of what a finished plan looks like.
Generate the plan following these rules:
Read references/validation.md for the full Haiku-executability rules and common pitfalls to avoid.
Write to DEVELOPMENT_PLAN.md in the project root.
agents — generate executor and verifier agentsRead references/agents.md for the agent templates. Generate:
.claude/agents/{project}-executor.md — Haiku-powered, executes subtasks mechanically.claude/agents/{project}-verifier.md — Sonnet-powered, validates against briefclaude-md — generate project CLAUDE.mdGenerate a CLAUDE.md with project overview, tech stack, directory structure, commands, coding standards, and session checklists. Tailored to the project type.
validate — check plan qualityRead the DEVELOPMENT_PLAN.md and validate it against the rules in references/validation.md. Check both structural completeness and Haiku-executability. Report specific issues with fix instructions.
progress — show completion statusParse DEVELOPMENT_PLAN.md checkbox states to show:
export mermaid — generate Mermaid diagramRead references/workflows.md for the export format. Parse the plan and generate a Mermaid flowchart showing phases, tasks, dependencies, and status.
export reactflow — generate ReactFlow JSONRead references/workflows.md for the ReactFlow export format.
issue <number> — convert GitHub issue to remediation taskFetch the issue with gh issue view <number> --json number,title,body,labels,comments,url, then generate a remediation task with subtasks following the same plan format. Can be appended to an existing DEVELOPMENT_PLAN.md or written as a standalone REMEDIATION_PLAN.md.
implement — kickoff the buildPrint instructions for using the executor agent to build subtask-by-subtask, then the verifier agent to validate. Remind the user to run verification after the executor finishes.
The defining principle: every subtask must contain complete, working code that Claude Haiku can copy-paste and execute without interpretation.
If you write {placeholder}, // TODO, or "implement the logic here" — it is NOT Haiku-executable. Haiku treats each subtask independently and cannot infer missing details from earlier context.
**Subtask 1.1.1: Create configuration file**
**Complete Code:**
Create file `src/config.py`:
\`\`\`python
import os
from dataclasses import dataclass
@dataclass
class Config:
api_key: str
base_url: str = "https://api.example.com"
timeout: int = 30
@classmethod
def from_env(cls) -> "Config":
return cls(
api_key=os.environ["API_KEY"],
base_url=os.getenv("BASE_URL", "https://api.example.com"),
timeout=int(os.getenv("TIMEOUT", "30")),
)
\`\`\`
**Verification:**
\`\`\`bash
python -c "from config import Config; c = Config(api_key='test'); print(c.base_url)"
# Expected: https://api.example.com
\`\`\`instructions from earlier in the document. Include ALL required commands (git, verification, completion steps) explicitly in EVERY subtask.
must grep for TODO/FIXME and fail if any remain.
Never assume a prior subtask's imports carry over.
from real classes. Never hand-write mock dataclasses for Pydantic models.
also verify the wiring (lifespan, middleware, etc.) actually works at runtime.
use grep to find target sections, read with offset/limit, and edit surgically.
**Subtask X.Y.Z: Title** (bold text),not ### Task X.Y headings. Validators only recognize the bold format.
Too many means it's too large (split it).
After planning is complete, explain this to the user:
Use the {project}-executor agent to execute subtask [X.Y.Z]Use the {project}-verifier agent to validate against PROJECT_BRIEF.mdSave any issues the verifier found as Nellie lessons for future projects.
Load these as needed — do not load all at once:
references/templates.md — Brief, plan, and CLAUDE.md templates for all 4 project typesreferences/validation.md — Structural + Haiku-executability validation rulesreferences/agents.md — Executor and verifier agent generation templatesreferences/workflows.md — Mermaid and ReactFlow export formatsexamples/hello-cli-plan.md — Gold standard example plan (study this before generating any plan)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.