prototype-builder — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited prototype-builder (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<example> <commentary>Demonstrates the standard flow where the user asks to build after a Discovery Plan has been approved.</commentary> User: Build a prototype based on our plan Agent: Reads the most recent Discovery Plan, invokes visual-companion to confirm layout direction, then invokes subagent-driven-prototyping to build the components, stays available during the build, and guides the SME through a walkthrough once it's ready. </example>
<example> <commentary>Demonstrates the HARD-GATE redirect when the user asks to build without any existing Discovery Plan.</commentary> User: Create a working prototype for me Agent: Checks for a Discovery Plan file and finds none. Responds: "Before we can build, I need to understand what we're building first. Can we start with a planning session? It only takes a few minutes and it'll make sure what we build is exactly what you need." Stops there and does not continue. </example>
This skill coordinates the full prototype build cycle. It does NOT build components directly. Building is handled by subagent-driven-prototyping. Layout confirmation is handled by visual-companion. This skill connects those two steps and guides the SME through the full journey from plan to working prototype.
This is the first thing that runs, before any other step.
Check: does exploration/discovery-plans/ exist and contain at least one .md file?
If NO plan exists:
"Before we can build, I need to understand what we're building first. Can we start with a planning session? It only takes a few minutes and it'll make sure what we build is exactly what you need."
Stop. Do not continue. Do not suggest workarounds. Do not attempt to build without a plan.
If a plan file exists: Read the most recent .md file in exploration/discovery-plans/. Check that it contains either:
## SME Approval section, orPLAN_STATUS: APPROVED lineIf neither is present:
"A Discovery Plan exists but hasn't been approved yet. Please review the plan and confirm approval before we begin building."
Stop. Do not continue. File existence alone is NOT approval.
If the plan is approved: This is the source of truth for the entire build session.
Invoke the visual-companion skill to present layout options and get SME confirmation before any building begins.
Do not proceed to Step 2 until visual-companion has written exploration/captures/layout-direction.md and announced "Layout confirmed."
Once layout is confirmed, invoke the subagent-driven-prototyping skill.
Announce:
"I'm putting your prototype together now — each part separately so I can make sure it matches our plan. I'll show you the full version once everything is ready."
Stay available during the build. If any component is BLOCKED or NEEDS_CONTEXT, address it immediately. Do not let the build stall.
Once all components are built and the completion report is received, invite the SME to review:
"Your prototype is ready. Please click through it and let me know if the flows work the way you described. It's much easier to adjust things at this stage than later on."
Guide the SME through each main flow described in the Discovery Plan. Ask about each one:
"Does this part work the way you expected?"
Listen carefully for surprises, corrections, and anything that wasn't in the original plan.
Write a raw walkthrough transcript to exploration/captures/walkthrough-notes.md. This is an unstructured narrative — flows tested, SME comments, surprises, corrections. Do NOT extract or structure requirements here.
# Walkthrough Transcript
**Session date:** [date]
**Discovery Plan reference:** [plan filename]
## Flow Walkthroughs
[Narrative description of each flow tested, in order]
## SME Comments
[Verbatim or close-paraphrase of SME reactions, corrections, and new observations]
## Surprises and Blockers
[Anything that didn't work as expected or surprised the SME]"I'll pass your walkthrough notes to the observation agent now, which will extract the structured requirements we need for documentation."
Invoke prototype-companion-agent to read walkthrough-notes.md and produce the final exploration/captures/prototype-notes.md. Do NOT write prototype-notes.md directly from this skill — that is prototype-companion-agent's responsibility.
Once prototype-companion-agent confirms it has written prototype-notes.md, emit:
PHASE 3 COMPLETE
Walkthrough transcript: exploration/captures/walkthrough-notes.md
Prototype observations: exploration/captures/prototype-notes.md~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.