subagent-driven-prototyping — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited subagent-driven-prototyping (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Architectural patterns adapted from obra/superpowers (MIT)
Before doing anything else, silently check for exploration/exploration-dashboard.md.
Complete, proceed standalone.In Progress or TBD:authorized_skill, phase_number, and expected_output.authorized_skill matches "subagent-driven-prototyping" AND phase_number matches the dashboard phase:exploration-workflow. Stop generating output.exploration-workflow. Stop generating output from this skill.<example> <commentary>Demonstrates the skill being invoked by prototype-builder after layout has been confirmed by visual-companion.</commentary> User: [dispatched by prototype-builder after layout confirmed] Agent: Verifies the Discovery Plan and layout direction files exist, announces the number of components and their plain-language names, then builds each one in order — announcing each start, checking it against the plan on completion, and reporting each as done before moving to the next. </example>
<example> <commentary>Demonstrates a user triggering the skill directly after plan approval.</commentary> User: Let's build it Agent: Checks for the required Discovery Plan and layout direction files. If both exist, announces the build plan in plain language and begins building each component one at a time with progress updates. </example>
If dispatched by exploration-workflow, the Discovery Plan and layout direction have already been approved by the SME. The Required Inputs Check below is a verification step only — do not re-present these artifacts for re-approval. Proceed directly to Component Decomposition once inputs are confirmed present.
Required: The orba/superpowers plugin must be installed.This skill invokes superpowers execution discipline skills during the build loop.
Before building, check if a worktree/feature branch was set up by the orchestrator. If not, and the session type is brownfield or greenfield, invoke `superpowers:using-git-worktrees` now to create one.
Read the **Dispatch Strategy:** field from the dashboard. Use it to determine how to dispatch component implementation:
copilot-cli-agent skill. Simple components → gpt-5-mini (paid, AI Credits — see references/cheapest_models.md).Complex/multi-file components → claude-sonnet-4-6 (batch into one dense request — charged per request, not per token).
Agent tool. Mechanical components → model: "haiku".Complex components → model: "sonnet".
After each component is built, invoke `superpowers:requesting-code-review` twice:
For copilot-cli and claude-subagents dispatch: use a separate sub-agent for each review. For direct mode: self-review both stages before proceeding.
Even prototypes must be verified against the Discovery Plan — the prototype is the evidence that exploration captured the right thing. Unverified prototypes lead to flawed handoffs and wrong specs.
For code-producing sessions, invoke `superpowers:test-driven-development` for each component: write a failing test that verifies a Discovery Plan requirement → verify failure → implement → refactor.
After all components are built, invoke `superpowers:finishing-a-development-branch`: verify tests pass, then present merge/PR options to the SME.
Before doing anything else, verify the following:
.md file in exploration/discovery-plans/. If missing, stop and report what needs to happen first.[~] (skipped), layout-direction.md will not exist, and that is correct. Proceed without it, using the Discovery Plan's success criteria to guide visual decisions. Only if Phase 2 was enabled ([x] or [ ]) is exploration/captures/layout-direction.md required.Read exploration/exploration-dashboard.md and check the **Session Type:** field:
exploration/prototype/. Follow the standard Build Loop below.exploration/prototype/components/ as .md files for tracking.⚠️ HARD CONSTRAINT — read before touching any file.
Before entering the Build Loop, check the Discovery Plan's Intervention Type field:
If Agent Plugin Mode is detected:
Build to plugins/[plugin-name]/ at the project root — NOT exploration/prototype/. Announce: "Since we're building an Agent Plugin, I'll scaffold it into `plugins/[plugin-name]/` using the standard plugin structure."
You are prohibited from creating plugin directories or skill files with raw bash commands (mkdir, manual file writes). Instead, invoke the .agents/skills/create-plugin and .agents/skills/create-skill skills from the local agent-scaffolders plugin:
Skill: create-plugin
Skill: create-skillThese enforce eval harnesses, directory templates, frontmatter standards, and plugin.json registration. Bypassing them produces non-compliant plugins that will fail audit.
create-plugin scaffold is complete, ensure every generated skill and agent is wired into .claude-plugin/plugin.json. See the plugin.json Binding Check in the Assembly section below./agent-scaffolders:audit-plugin to verify structural compliance before marking Phase 3 complete.If NOT Agent Plugin Mode: Follow the standard Greenfield or Brownfield build path below.
Based on the Discovery Plan and layout direction (if available), identify 3–6 logical components. Use plain-language names the SME will understand (e.g., "top navigation bar", "summary panel", "request form", "approval confirmation screen") — not technical terms.
Announce:
"I'll put this together in [N] parts. I'll check each one before moving to the next to make sure it matches our plan."
List the components by name so the SME knows what is being built.
For Brownfield sessions, also announce:
"I'll build these directly into your existing codebase, matching the patterns I see in [framework/stack]."
For each component, in order:
exploration/prototype/components/[descriptive-name].[ext].md summary to exploration/prototype/components/[descriptive-name].md documenting what was built and where.COMPLETE — component matches the plan and is readyBLOCKED — something is preventing completion (missing data, contradictory requirements, etc.)NEEDS_CONTEXT — a specific question must be answered before the component can be finishedCOMPLETE.Report each completed component to the user:
"Done — [component name] is done."
After all components reach COMPLETE status:
Greenfield:
exploration/prototype/index.html (or an equivalent entry point that links all components together)exploration/prototype/README.md with run instructions in plain languageBrownfield:
exploration/prototype/README.md documenting:Agent Plugin Mode — plugin.json Binding Check (MANDATORY before completion):
.claude-plugin/plugin.json in the built plugin directory.skills/, verify its entry appears in the skills list in plugin.json.agents/, verify its entry appears in the agents list in plugin.json.commands/, verify its entry appears in the commands list in plugin.json.hooks/, verify its entry appears in the hooks list in plugin.json.This check is non-optional. A plugin with unregistered components is a broken plugin.
Announce: "Your prototype is ready — Phase 3 is complete."
If operating within an active Exploration Session (i.e., exploration/exploration-dashboard.md exists and **Status:** is not Complete):
"Your prototype is ready for review. Please click the index.html link above to test it." "Once you approve the layout and logic, you must push us to the next phase to generate your formal User Stories and API Specs." "Please reply with exactly: 'Return to dashboard and start Phase 4 Handoff'"
After the user provides the confirmation phrase, output this machine-readable block:
~~~
PHASE: 3 STATUS: COMPLETE OUTPUT: exploration/prototype/index.html SESSION_TYPE: [Greenfield / Brownfield / Agent Plugin] COMPONENTS_BUILT: [count] WORKTREE: [branch name if worktree was created, or "none"] ~~~
If operating standalone (no dashboard file, or **Status:** Complete), the skill is complete. Report back to prototype-builder: all components are built, the entry point is at exploration/prototype/index.html, and the prototype is ready for the SME walkthrough.
superpowers:using-git-worktrees was already called by the orchestrator, calling it again creates a nested worktree. Check if a worktree branch already exists before invoking the setup skill..md tracking files go to exploration/prototype/components/. If the session is later revisited, these stale .md files may describe code that has since been refactored. Mark tracking files with the build date.direct mode the self-review is supposed to run twice (plan alignment + quality). In practice only one pass is done. Explicitly label and separate the two review purposes when self-reviewing.Throughout this skill, always use plain language in user-facing text:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.