incremental-implementation — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited incremental-implementation (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build in thin vertical slices. Implement one piece, test it, verify it, then expand. NEVER implement an entire feature in one pass. Each increment MUST leave the system in a working, testable state. Slicing this way keeps large features tractable.
When NOT to use: Single-file, single-function changes where the scope is already minimal.
┌──────────────────────────────────────┐
│ │
│ Implement ──→ Test ──→ Verify ──┐ │
│ ▲ │ │
│ └───── Commit ◄─────────────┘ │
│ │ │
│ ▼ │
│ Next slice │
│ │
└──────────────────────────────────────┘For each slice:
Build one complete path through the stack:
Slice 1: Create a task (DB + API + basic UI)
→ Tests pass, user can create a task via the UI
Slice 2: List tasks (query + API + UI)
→ Tests pass, user can see their tasks
Slice 3: Edit a task (update + API + UI)
→ Tests pass, user can modify tasks
Slice 4: Delete a task (delete + API + UI + confirmation)
→ Tests pass, full CRUD completeEach slice delivers working end-to-end functionality.
When backend and frontend develop in parallel:
Slice 0: Define the API contract (types, interfaces, OpenAPI spec)
Slice 1a: Implement backend against the contract + API tests
Slice 1b: Implement frontend against mock data matching the contract
Slice 2: Integrate and test end-to-endTackle the riskiest or most uncertain piece first:
Slice 1: Prove the WebSocket connection works (highest risk)
Slice 2: Build real-time updates on the proven connection
Slice 3: Add offline support and reconnectionIf Slice 1 fails, you find out before investing in Slices 2 and 3.
Before writing code, ask: what is the simplest thing that could work?
After writing code, check it against:
SIMPLICITY CHECK:
✗ Generic EventBus with middleware pipeline for one notification
✓ Simple function call
✗ Abstract factory pattern for two similar components
✓ Two straightforward components with shared utilities
✗ Config-driven form builder for three forms
✓ Three form componentsThree similar lines beat a premature abstraction. Implement the naive, obviously-correct version first. Optimize only after correctness is proven with tests.
Touch only what the task requires. Do NOT:
When you notice something worth improving outside scope, record it — do not fix it:
NOTICED BUT NOT TOUCHING:
- src/utils/format.ts has an unused import (unrelated to this task)
- The auth middleware could use better error messages (separate task)
→ Want me to create tasks for these?Each increment changes one logical thing. NEVER mix concerns.
Bad: one commit that adds a new component, refactors an existing one, and updates the build config.
Good: three separate commits — one per change.
After each increment the project MUST build and existing tests MUST pass. NEVER leave the codebase broken between slices.
When a feature isn't ready for users but you need to merge increments, gate it behind a flag so partial work stays dark:
// TypeScript
const ENABLE_TASK_SHARING = process.env.FEATURE_TASK_SHARING === 'true';
if (ENABLE_TASK_SHARING) {
// work-in-progress sharing UI
}# Python
import os
ENABLE_TASK_SHARING = os.environ.get("FEATURE_TASK_SHARING") == "true"
if ENABLE_TASK_SHARING:
... # work-in-progress sharing pathThis merges small increments to the main branch without exposing incomplete work.
New code MUST default to conservative behavior — opt in to side effects, never opt out:
// TypeScript — disabled by default, caller opts in
export function createTask(data: TaskInput, options?: { notify?: boolean }) {
const shouldNotify = options?.notify ?? false;
// ...
}# Python — disabled by default, caller opts in
def create_task(data, *, notify: bool = False):
should_notify = notify
# ...Each increment MUST be independently revertable:
When directing an agent to implement incrementally, scope each increment explicitly:
"Implement Task 3 from the plan.
Start with the database schema change and the API endpoint only.
Leave the UI for the next increment.
After implementing, run the stack's test and build gates to confirm
nothing is broken."State what is in scope and what is NOT in scope for each increment.
After each increment, verify. Command examples span ecosystems — run whichever your stack uses:
npm test / pytest / go test ./... / cargo test).npm run build / python -m build / go build ./... / cargo build).tsc --noEmit / mypy . / cargo check).npm run lint / ruff check / golangci-lint run).Note: Run each verification command after a change that could affect it. After a successful run, do not repeat the same command unless the code has changed since — re-running on unchanged code adds no information.
| Rationalization | Reality |
|---|---|
| "I'll test it all at the end" | Bugs compound. A bug in Slice 1 makes Slices 2-5 wrong. Test each slice. |
| "It's faster to do it all at once" | It feels faster until something breaks and you can't find which of 500 changed lines caused it. |
| "These changes are too small to commit separately" | Small commits are free. Large commits hide bugs and make rollbacks painful. |
| "I'll add the feature flag later" | If the feature isn't complete, it MUST NOT be user-visible. Add the flag now. |
| "This refactor is small enough to include" | Refactors mixed with features make both harder to review and debug. Separate them. |
| "Let me run the build command again just to be sure" | After a successful run, repeating the same command adds nothing unless the code changed. Re-run after later edits, not as reassurance. |
After completing all increments for a task:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.