drill-me — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited drill-me (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Interview the user relentlessly about every aspect of the plan until shared understanding is reached. Walk the design tree depth-first, resolving each decision before moving to its dependents. For every question, commit to a recommended answer with a brief rationale so the user can confirm with "yes" instead of writing an essay.
This is the opposite of yes-and brainstorming. The plan exists; the job is to find the unresolved forks, surface them in a sensible order, and close them.
Invoke when the user:
Don't invoke when:
If unsure whether to drill, ask once: "This looks like a [small/medium/large] change — want me to drill, or just do it?"
Every plan implies a tree of decisions:
Walk it depth-first. Resolve a parent before drilling into its children. When a decision opens new branches, surface them and queue them in the right order. Don't context-switch mid-branch unless the user redirects.
The job is not to dump every possible question in one shot. The job is to walk the tree in a sensible order, one node at a time, until every material decision is closed.
Hold the queue in your head (or a scratchpad list in chat). You don't need a tool for this — just be disciplined.
Never bundle. "How should we handle errors AND what's the data shape AND should we cache?" is three turns. Pacing is the point — the user gets to think clearly about each fork without juggling.
Open-ended questions burn the user's time. Commit to a default with a one-sentence rationale, and make at least one credible alternative explicit so rejection is easy.
Bad:
"How should errors be handled?"
Good:
"For errors in this handler, I'd return a typedResult<T, E>rather than throwing — the rest oflib/api/already uses that pattern and it keeps controller logic flat. Alternative: throw and catch at the route boundary; shorter but loses the type info. Go withResult?"
The recommendation must be specific enough to act on. "It depends" is not an answer. If you genuinely can't recommend without more info, ask the smallest possible question that unblocks the recommendation, then come back.
"Postgres or SQLite?" is faster than "what database?". Closed questions accelerate the interview. Open them up only when the option space is genuinely unclear and you need the user's framing.
If a question can be answered by reading the repo, the tests, git log, or config — read first, then ask only the remaining gap. The user's time is more expensive than your tool calls.
Questions you should answer yourself:
package.json / pyproject.tomlls migrations/State what you found before asking the next question, so the user can correct a wrong inference: "Saw zod used throughout src/server/, so I'll use it here too. Sound right? Next: ..."
Some questions are too obvious to ask. State the assumption inline and move on: "Assuming this should be idempotent (it's a webhook). Next question: ..." — the user can flag it if they disagree.
This is also how you keep the interview from feeling robotic. A skilled interviewer doesn't ask "is the sky blue" — they assume, state, and move.
Scan these categories at the start so you don't miss a major branch. Not every plan needs every category — calibrate to scope.
The order above is roughly dependency-ordered: scope feeds data model feeds interface feeds rollout. But adapt — if a deeper branch unblocks a shallower one, take it.
"Relentlessly" doesn't mean infinitely. It means don't bail early to be polite. The interview ends when:
When you think you're at the stop condition, say so explicitly:
"I think we're aligned on the material decisions. Want me to summarize the resolved plan and start, or is there a branch I missed?"
If the user pushes back ("keep drilling"), continue — but be honest that the remaining branches are minor and tell them what's left.
Match depth to stakes:
If a plan is genuinely trivial, say so and offer to skip: "This is a 10-line change — drilling probably isn't worth it. Want me to just do it, or drill anyway?"
When drilling ends, produce a tight summary:
## Resolved plan: <short title>
**Goal:** <one sentence>
**Scope (in):** <bullets>
**Scope (out):** <bullets>
**Decisions:**
- <Area>: <decision> — <one-line why>
- <Area>: <decision> — <one-line why>
...
**Open questions deferred until implementation:** <bullets, or "none">
**Next step:** <single concrete action>Then offer: "Want me to save this to docs/plans/<slug>.md?"
If the work is implementation-bound and the user has the superpowers:writing-plans skill, suggest handing off to it.
User: "drill me on adding a webhook receiver for the Stripe checkout.session.completed event"
Bad:
"Sure, I have some questions. What database should we use? How should errors be handled? Should this be idempotent? Where should the file live?"
Good:
Reading the codebase first.
>
[Grepssrc/api/, finds existing pattern insrc/api/webhooks/github.ts— zod validation, idempotency via aWebhookEventtable, transactional handler.]
>
I can see you already have a webhook handler pattern insrc/api/webhooks/github.ts: zod-validated payload, idempotency via theWebhookEventtable, everything in one transaction. I'll mirror that structure unless you say otherwise.
>
Q1 — scope: when the event fires, should the handler (a) just persist aPaymentrow tied to theOrder, (b) also flip the order status topaid, or (c) also trigger the existingsendOrderConfirmationEmail? I'd recommend (c) — do all three in the same transaction, matching the github handler's "do everything atomically" style. Sound right?
One question, codebase already explored, recommendation given with reasoning, alternatives implicit, easy to confirm or redirect. That's the shape.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.