story-implementation-planner — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited story-implementation-planner (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Turn a clear story and repo context into an implementation plan sized for the model, agent, or human who will execute it.
user-story-clarifierstory-repo-scoutStory Card, Repo Context, acceptance criteria, open questions,and relevant file list before planning.
standard-agent by default when the user is unsurefrontier-gpt for strong GPT/Codex-style agents with broad context andreliable multi-file reasoning
local-small for smaller local models such as Qwen-class 20B-30B modelshuman when the plan is primarily for a developer to execute manuallyplan honestly, list the missing inputs instead of inventing work.
placeholders, dependency order, risky assumptions, and rollback needs.
standard-agentfrontier-gpttracks (e.g., Track A: API, Track B: UI) with explicit join points.
reasoning is required.
support it; flag the refactor scope explicitly so it can be approved or cut.
(rows: invariants; columns: files affected).
re-splitting.
local-smallexplicitly accepts the risk.
First Action block with exact files to open, first change ordecision, first validation checkpoint, and stop condition.
longer than 10 lines unless naming an exact existing function signature.
humanDecide: lines).commands. Example: pnpm test packages/auth -- --run, not run the tests.
First Action, Stop if, model token budgets);the human reads the whole plan.
~5 min, ~30 min, half-day) so thehuman can sequence around their own time.
decision checkpoints and validation milestones.
Use this structure by default:
## Implementation Plan
Plan Status: Ready | Needs Inputs | Blocked
### Target Executor
Model/profile and why it was chosen.
### Size
Small | Medium | Large - relative to the executor profile. For agent profiles,
9-12 top-level steps/tracks is a warning range and more than 12 should be
re-split. For `local-small`, more than 8 steps should be re-split or accepted
explicitly by the user.
### Goal
The behavior to implement, in one or two sentences.
### Inputs
- Story card, repo context, assumptions, and blockers used for planning.
### First Action
Required for `local-small`, optional for agent profiles when it reduces
handoff ambiguity, and omitted for `human`.
- Open:
- Do:
- Check:
- Stop if:
### Files
- Change: path/to/file.ext - expected reason.
- Read: path/to/file.ext - context needed.
- Test: path/to/test.ext - validation target.
- Do Not Touch: path/to/file.ext - boundary reason.
### Steps
1. Ordered, concrete implementation step.
### Dependencies
- Step ordering, blockers, and safe parallel work.
### Risks and Blockers
- Anything that could change the plan or needs confirmation.
### Validation
- Smallest checks, tests, or manual probes that prove the acceptance criteria.
### Rollback
- How to back out or pause safely if the plan is risky.
### Handoff Notes
- What the implementing agent or human should do first.Omit empty sections when they add no signal. Never invent paths, commands, or repo structure not supported by the story or repo context.
Plan Status legend: Ready = plan is executable as written; Needs Inputs = listed blockers must be resolved first; Blocked = cannot plan honestly without missing repo or story input. See story-implementation-orchestrator for the canonical vocabulary block when run end-to-end.
Do Not Touch boundaries from repo scouting unless the story or userexplicitly changes scope.
local-small, the First Action block must be executable without readingthe whole plan again.
reason validation is not yet available.
planning implementation.
wire format, public API, or shared file format: include a forward migration step, a backward-compatibility or rollback step, a backfill plan when data is rewritten, and a feature-flag or staged-rollout step. Risky or irreversible changes default to flag-gated. Note when the rollout requires coordinated deploys (e.g., consumer first, producer second).
standard-agent or frontier-gpt, or 8 steps for local-small, recommend re-splitting the story instead of compressing steps. Return Plan Status: Needs Inputs with a split rationale unless the user explicitly accepts the larger plan.
checkpoint exists every 2-3 steps. Do not front-load all refactors before any behavior is visible.
budget) blocks honest planning, include a Spike: step with a time-box, a concrete question to answer, and a stop-and-report checkpoint. Do not guess past a spike.
Reject and rewrite when these appear in a draft plan:
Refactor X for clarity without a named target,observable change, or test that proves equivalence.
Add tests without naming the assertion, fixture, orcommand that runs them.
and UI all at once. Split by layer with explicit ordering.
contracts but has no rollback or backout entry.
context. Re-scout instead of guessing.
Handle edge cases, Polish, orFinalize without concrete behavior or verification.
executor profile without flagging re-splitting or explicit acceptance.
user-story-clarifier (story card)and story-repo-scout (Repo Context). Output is consumed by the executor named in Target Executor.
Plan Status (Ready / Needs Inputs / Blocked) joinsstory Status and Confidence from the upstream skills. See story-implementation-orchestrator for the canonical vocabulary block.
repo-owned code changes, the plan should hand off to project-core-dev, plus the matching coding-guidance-<lang> overlay (e.g., coding-guidance-go, coding-guidance-python) and any relevant systems overlay (backend-systems-guidance, ui-guidance, ui-design-guidance). Use documenter for docs-only implementation plans and project-config-and-tests when config behavior or deterministic test coverage is the primary concern. Add tester-mindset when validation design, risk coverage, or acceptance-oracle quality is central to the story.
Needs Inputs plan that asks for a re-scout instead of inventing paths.
user-story-clarifier first when the story is unclear.story-repo-scout first when relevant files are missing.tester-mindset when the main question is what risk to cover.security for exploit-focused review.Create an actionable implementation plan from this story card and repo context. ->choose a model profile and output Implementation Plan.
Plan this ticket for a local qwen coding agent using the relevant files found. ->use the local-small profile and simple checkpoints.
Make a GPT-optimized plan from this story and repo scout output. -> usefrontier-gpt unless the user names a weaker executor.
Scour the repo and append relevant file paths. -> use story-repo-scout.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.