mk:validate-plan — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited mk:validate-plan (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Validates a plan file against 8 dimensions to catch gaps before implementation begins. Does NOT replace Gate 1 (human approval). Supplements it with systematic checks.
For green-field harness sprints (generator↔evaluator loop), usemk:sprint-contractinstead.mk:validate-planoperates on plans frommk:plan-creator(cook flow only).
/mk:cook detects a COMPLEX task (auto-suggested)| # | Dimension | Pass Criteria | Common Failure |
|---|---|---|---|
| 1 | Scope Clarity | In-scope and out-of-scope sections are explicit and non-overlapping | Vague scope: "improve the auth system" without boundaries |
| 2 | Acceptance Criteria | Every criterion is binary (pass/fail), not subjective | Subjective: "should feel fast" vs binary: "response < 200ms" |
| 3 | Dependencies Resolved | All external dependencies identified with status (available/blocked) | Missing: needs DB migration but not listed as dependency |
| 4 | Risks Identified | At least 1 risk flag with mitigation strategy | No risks listed (every plan has risks; zero = not evaluated) |
| 5 | Architecture Documented | Technical approach references existing patterns or includes ADR | "We'll figure out the architecture during implementation" |
| 6 | Test Strategy | Test approach covers acceptance criteria; edge cases identified | "We'll add tests after" (violates TDD) |
| 7 | Security Considered | Auth, data access, input validation addressed (or explicitly N/A) | No mention of security for a feature handling user data |
| 8 | Effort Estimated | Time/complexity estimate with confidence level | No estimate or "it depends" without qualification |
tasks/plans/YYMMDD-name/plan.md## Plan Validation: [Plan Name]
| # | Dimension | Status | Finding |
| --- | ----------------------- | -------------- | ------------------ |
| 1 | Scope Clarity | PASS/FAIL/WARN | [specific finding] |
| 2 | Acceptance Criteria | PASS/FAIL/WARN | [specific finding] |
| 3 | Dependencies Resolved | PASS/FAIL/WARN | [specific finding] |
| 4 | Risks Identified | PASS/FAIL/WARN | [specific finding] |
| 5 | Architecture Documented | PASS/FAIL/WARN | [specific finding] |
| 6 | Test Strategy | PASS/FAIL/WARN | [specific finding] |
| 7 | Security Considered | PASS/FAIL/WARN | [specific finding] |
| 8 | Effort Estimated | PASS/FAIL/WARN | [specific finding] |
**Result:** [N]/8 passed | [Action: proceed / revise dimensions X,Y]After scoring the 8 dimensions and BEFORE emitting the validation report, run a cross-file consistency check on the plan directory.
Why: Distributed plans (plan.md + N × phase-*.md) drift after edits. One phase gets renamed; another phase still references the old name. Each phase reads as self-consistent but the plan as a whole is contradictory.
Procedure:
plan.md and every phase-*.md in the plan dirOutput: Append a sweep_failures block to the validation report. Sweep failures DO NOT auto-FAIL — they surface inconsistencies the human must reconcile before Phase 3.
sweep_failures:
- phase-02.md:18 references `userController` (renamed to `authController` in plan.md:42)
- phase-04.md:8 declares scope item that plan.md:62 marks out-of-scopeSkip conditions: plan has only plan.md (no phase files); plan dir not found.
Source: Adapted from external verification-role guidance for whole-plan consistency sweeps.
In /mk:cook, validation runs automatically for COMPLEX tasks:
Gate 1 (plan approved) → mk:validate-plan → Phase 2 (Test)For STANDARD tasks, validation is optional (user-triggered). For TRIVIAL tasks, validation is skipped.
mk:plan-creator/scripts/validate-plan.py validates plan file structure (required sections exist). This skill validates plan content quality (are acceptance criteria binary? are risks identified?). Both can run — they check different things.Note: plan-creator's step-06 now includes an enhanced validation interview with detection keywords and section mapping. mk:validate-plan focuses on 8-dimension structural validation, which is complementary — not a replacement.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.