writing-plans — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited writing-plans (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Any task that requires producing an implementation plan, task decomposition, step-by-step instructions, or structured execution guide. This includes feature plans, migration plans, refactoring plans, and any multi-step work breakdown.
Adapted from the PRP EXPLORE protocol (PRPs-agentic-eng by Wirasm). This is a discovery discipline that PRECEDES authoring the MindForge XML/structured plan — it does NOT replace the plan format. The output of EXPLORE feeds the plan's Context, Files, and Details sections with real, cited patterns.
Golden Rule: If you would need to search the codebase during implementation, capture that knowledge NOW, during EXPLORE.
#### The 8 Search Categories
Search the codebase directly (grep, find, file reads) for each category. Do NOT skip a category by assuming — confirm it against the actual repository.
service, controller, middleware, hook, etc.) in the area you'll modify.
closest analogue is the single most valuable reference.
named and organized in the relevant area.
features. Note versions where they matter.
setup/teardown, fixtures, and assertion style.
to users in similar code paths.
contracts/interfaces the new code must honor.
#### Patterns to Mirror (capture as file:line snippet references)
For each category that yields a concrete convention, record a Patterns to Mirror entry. Every entry MUST cite a real file:line source and quote the actual snippet — never paraphrase, never invent:
## Patterns to Mirror
### NAMING_CONVENTION
// SOURCE: src/services/userService.ts:1-5
[actual snippet copied from the file]
### ERROR_HANDLING
// SOURCE: src/middleware/errorHandler.ts:10-25
[actual snippet copied from the file]
### TEST_STRUCTURE
// SOURCE: tests/services/userService.test.ts:1-30
[actual snippet copied from the file]These mirrored snippets get folded into the plan's Details blocks so the executor writes code indistinguishable from existing code.
#### The "No Prior Knowledge" Gate (MANDATORY before authoring)
The plan must be executable by someone with NO prior knowledge of this repo. Therefore:
(a real file:line + snippet). If you cannot cite it, you have not explored enough — go search.
establish it, the plan does not assume it.
the new convention in the plan (rather than pretending it already exists).
Gate check: Before moving from EXPLORE to plan authoring, confirm — "Could a developer who has never seen this repo implement every step using ONLY this plan, without searching or asking?" If not, the EXPLORE pass is incomplete.
#### Core Principle: NO PLACEHOLDERS Every step in the plan must contain complete, executable instructions. A plan fails its purpose if the executor has to figure out what goes in a placeholder.
Bad (placeholder):
3. Add the authentication middleware to the routes.Good (complete):
3. Add authentication middleware to API routes.
File: src/middleware/auth.ts
Create a new middleware function:
- Import `verifyJWT` from `src/lib/jwt.ts`
- Extract the `Authorization` header, strip "Bearer " prefix
- Call `verifyJWT(token)` — if it throws, return 401 with `{ error: "Invalid token" }`
- If valid, attach `req.user = decoded` and call `next()`
File: src/routes/api.ts
- Import `authMiddleware` from `src/middleware/auth.ts`
- Add `router.use("/api/v1/protected", authMiddleware)` before the route definitions
on line ~45 (after the public routes, before the protected group)
Verify: Run `curl -H "Authorization: Bearer invalid" localhost:3000/api/v1/protected/me`
Expected: 401 response with `{"error": "Invalid token"}`#### Plan Structure Template
# Plan: [Feature/Task Name]
## Context
[1-3 sentences: WHY this work exists. Link to spec/ticket if applicable.]
## Scope
- IN: [What this plan covers]
- OUT: [What is explicitly excluded]
## Prerequisites
- [ ] [Anything that must be true before starting step 1]
## Steps
### Step 1: [Verb + Object] (estimated: Xmin)
**What**: [One sentence summary]
**Files**:
- `path/to/file.ts` — [what changes]
- `path/to/other.ts` — [what changes]
**Details**:
[Complete instructions with exact code patterns, not pseudocode]
**Verify**: [Exact command or check to confirm this step worked]
Expected: [What success looks like]
---
### Step 2: [Verb + Object] (estimated: Xmin)
**Depends on**: Step 1
...
## Verification (End-to-End)
[How to verify the entire plan was executed correctly]
## Rollback
[How to undo this work if something goes wrong]#### Step Design Rules
without completing the next step, merge them or restructure.
AND the API route AND the tests" is four steps, not one.
Independent steps are noted as parallelizable.
when you mean src/config/database.ts.
executor should never wonder "why are we doing this?"
runnable commands (npm test, curl, grep) over subjective checks ("looks right").
#### Handling Complexity
explicitly. Note the decision criteria clearly.
pre-plan task. Plans should not contain open-ended research.
#### Estimations
#### Dependencies and Parallelism
Depends on: Step N or Depends on: None (parallelizable). ### Steps 3-5 (parallelizable — no dependencies between them)make it explicit.
codebase follow these steps and produce a working result? If any step requires knowledge not in the plan, add it.
"as needed", "etc.", "similar to". Replace each with specifics.
(or explicitly marked as "create new file").
copy-pasted into a terminal.
Before marking a task done when this skill was active:
file:line snippets (no invented conventions).~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.