hplan-ed5001 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hplan-ed5001 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use the file system as persistent working memory. overview.md stays concise (≤25 lines); detailed specs are split into separate directories by phase.
Context window = RAM (volatile, limited)
File system = Disk (persistent, unlimited)
→ Important information must be written to disk
→ Content injected by hooks must be concise
→ Content referenced in depth must be thorough
→ The two are separated, no conflictIf you feel context is missing, proactively read the relevant files under .plan/. All plan information is persisted in disk files and won't be lost due to context changes.
All plan files are stored in the .plan/ directory at the project root:
.plan/
├── overview.md ← Global summary (concise, repeatedly injected by hooks)
├── decisions.md ← All decision records
├── errors.md ← All error records
└── phases/
├── phase1_xxx/
│ ├── spec.md ← Detailed spec for this phase (files to modify, code changes)
│ ├── call_chain.md ← Call chain / architecture diagram (optional)
│ └── checklist.md ← Item-by-item completion status
├── phase2_xxx/
│ ├── spec.md
│ ├── call_chain.md
│ └── checklist.md
└── ...overview.md is the file injected into context by the PreToolUse hook on every call. Strictly keep it within 25 lines. Format as follows:
# [Project Name]
current_phase: phase2_xxx
## Goal
[One sentence describing the final objective]
## Phases
- [x] phase1_xxx: [Phase description] → complete
- [ ] phase2_xxx: [Phase description] → in_progress (2/4)
- [ ] phase3_xxx: [Phase description] → pending
## Blockers
[Current blockers, or None]
## Last Decision
[One-sentence summary of the most recent important decision]
## Last Error
[One-sentence summary of the most recent error, or None]Never put detailed file lists, code snippets, or call chains in overview.md. Those belong in the phase directories.
Each phases/phaseN_xxx/ directory contains complete information for that phase:
spec.md — Detailed specifications for the phase:
spec.md should be kept within 60 lines. When the user sends a new message and there's an active phase, the current phase's spec.md is automatically injected into context. If a phase's spec exceeds 60 lines, the phase granularity is too coarse — split it into two or more phases. When splitting, keep each phase's spec focused on a set of related changes rather than piling up all details.
call_chain.md (optional) — Call chain / architecture change diagram:
checklist.md — Item-by-item checklist for the phase:
# Phase 2: Backend Endpoint Refactor — Checklist
- [x] Create src/auth/token.py
- [x] Modify src/auth/routes.py
- [ ] Modify src/middleware/auth.py
- [ ] Modify config/auth.yaml
- [ ] Run unit tests to confirm no regressionsAfter receiving a complex task:
.plan/ directory structure (run sh scripts/init-plan.sh for quick initialization)Reference template files:
After plan creation, you must stop and wait for user confirmation. Starting execution on your own is strictly prohibited.
Present the following to the user and request confirmation:
Explicitly ask the user:
Only proceed to the execution phase after the user explicitly agrees. If the user suggests adjustments, modify the plan files and present again for confirmation.
#### Keep overview.md and phases/ Directory in Sync When Modifying Plans
When iterating on the plan with the user during confirmation, any additions, deletions, or modifications to phases must update both places simultaneously:
phases/phaseN_xxx/ directory with spec.md, checklist.mdphases/phaseN_xxx/ directoryphases/ (do not keep the old directory)After each plan modification, run sh scripts/validate-plan.sh to verify consistency. The script checks:
After user confirms the plan, enter the work loop:
[ ] → [x])current_phase to point to the next phasesh scripts/advance-phase.sh to assist with the switchWhen current_phase changes in overview.md:
1st failure: Diagnose and fix → record in errors.md
2nd failure: Try a different approach → record in errors.md
3rd failure: Re-examine assumptions → update spec.md
After 3rd still failing: Explain the situation to user, request guidanceThe Stop hook automatically checks completion status of all phases in overview.md. If incomplete phases remain, it will prompt you to review the remaining tasks. The user can exit the plan at any time by deleting the .plan/ directory.
You should aim to personally execute every item in the checklist rather than handing off work to the user for manual execution.
If you cannot complete a subtask (e.g., requires external service credentials, requires physical device operations), you should:
The following behaviors should be avoided:
After the plan is fully complete, the user may suggest modifications. Choose the approach based on modification complexity:
Direct fix (modification involves ≤2 files, no architecture changes):
Append phases (modification involves 3+ files, or requires call chain adjustments):
.plan/ (e.g., phase10_fix_xxx)current_phase to the new phasesh scripts/validate-plan.sh to verify consistencyBrand new plan (modification essentially overhauls the original design):
.plan/ to .plan.archived/ (preserve records)Decision criteria: If the user's modification can be expressed as "fix N issues on the existing architecture," append phases. If it must be expressed as "redesign the XXX module," start a new plan.
Use:
Don't use:
| Scenario | Action | Reason |
|---|---|---|
| Just wrote a file | Don't read | Content is still in context |
| Starting a new phase | Read spec.md + checklist.md | Fully understand work scope |
| Before an important decision | Read overview.md + related spec | Ensure goal alignment |
| Encountered an error | Read errors.md | Avoid repeating failures |
| Don't | Do Instead |
|---|---|
| Put detailed info in overview.md | Put it in the phase directory's spec.md |
| Let overview.md exceed 25 lines | Keep it to summary only |
| Let spec.md exceed 60 lines | Split into multiple phases, keep each spec focused |
| Skip plan creation and execute directly | Create a complete .plan/ directory first |
| Forget to update checklist.md | Update immediately after completing each item |
| Track status in spec.md | Status goes in checklist.md, specs go in spec.md |
| Repeat the same failing approach | Record the error, change approach |
| Hand off unfinished subtasks to the user | Try to execute them yourself; request user help when blocked |
| List remaining steps and then stop | Try to execute those steps before finishing |
| Start executing right after creating the plan | Present the plan and wait for user confirmation before executing |
| Modify overview.md without syncing phases/ directory | Update both places when adding/removing/modifying phases; validate with validate-plan.sh |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.