feature-dev-db1801 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited feature-dev-db1801 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Execute a structured 7-phase feature development workflow. This workflow guides you through understanding, exploring, designing, implementing, and reviewing a feature.
Execute these phases in order, completing ALL of them:
Goal: Understand what the user wants to build.
Accept the following inputs:
Goal: Understand the relevant parts of the codebase.
Goal: Resolve any ambiguities before designing.
Prompt the user for answers to critical unknowns. Only ask questions that would significantly impact the implementation.
If no clarifying questions are needed, inform the user and proceed.
Goal: Design the implementation approach.
Design 2-3 approaches with different trade-offs:
Approach 1: Design a minimal, focused approach prioritizing simplicity
Approach 2: Design a flexible, extensible approach prioritizing future changes
Approach 3: Design an approach optimized for the project's existing patterns (if applicable)For each approach, delegate to an architecture design task (from the core-tools package):
Feature: [feature description]
Design approach: [specific approach]
Based on the codebase exploration:
[Summary of relevant files and patterns]
Design an implementation that:
- Lists files to create/modify
- Describes the changes needed in each file
- Explains the data flow
- Identifies risks and mitigations
Return a detailed implementation blueprint.Prompt the user to select an approach or request modifications.
internal/docs/adr/internal/docs/adr/NNNN-[feature-slug].md (create internal/docs/adr/ if needed)Goal: Build the feature.
Ask the user: "Ready to begin implementation of [feature] using [chosen approach]?" Wait for confirmation before proceeding.
Before making any changes, read the complete content of every file you'll modify.
Goal: Review the implementation for issues.
Review 1: Review for correctness and edge cases
Review 2: Review for security and error handling
Review 3: Review for maintainability and code qualityFor each review task:
Review focus: [specific focus]
Files to review:
[List of files modified/created]
Review the implementation and report:
- Issues found with confidence scores (0-100)
- Suggestions for improvement
- Positive observations
Only report issues with confidence >= 80.Show the user:
Prompt the user to choose:
Goal: Document and celebrate accomplishments.
Present to the user:
[Unreleased] section with:CHANGELOG.md doesn't exist, create it with proper header[Unreleased]Congratulate the user and offer next steps:
If any phase fails:
Use this template when generating Architecture Decision Records in Phase 4.
# ADR-NNNN: [Title]
**Date:** YYYY-MM-DD
**Status:** Accepted
**Feature:** [Feature name/description]
## Context
[Describe the situation that led to this decision. Include:]
- What problem are we solving?
- What constraints do we have?
- What are the driving forces?
## Decision
[State the decision clearly and concisely. Include:]
- What approach are we taking?
- Key architectural choices made
- Technologies/patterns selected
## Consequences
### Positive
- [Benefit 1]
- [Benefit 2]
- [Benefit 3]
### Negative
- [Tradeoff 1]
- [Tradeoff 2]
### Risks
- [Risk 1 and mitigation]
- [Risk 2 and mitigation]
## Alternatives Considered
### Alternative 1: [Name]
[Brief description]
- **Pros:** [List]
- **Cons:** [List]
- **Why rejected:** [Reason]
### Alternative 2: [Name]
[Brief description]
- **Pros:** [List]
- **Cons:** [List]
- **Why rejected:** [Reason]
## Implementation Notes
[Any specific implementation guidance:]
- Key files to create/modify
- Important patterns to follow
- Integration points
## References
- [Link to related docs]
- [Link to similar implementations]internal/docs/adr/NNNN-feature-slug.md0003-user-authentication.mdinternal/docs/adr/ directory if it doesn't exist# ADR-0003: User Authentication with JWT
**Date:** 2024-01-15
**Status:** Accepted
**Feature:** User login and session management
## Context
The application needs user authentication. Users should be able to log in and maintain sessions across page refreshes. The API is stateless and serves both web and mobile clients.
Key constraints:
- Must work with stateless API
- Must support multiple clients
- Session should persist across browser refreshes
- Need to handle token refresh gracefully
## Decision
We will use JWT (JSON Web Tokens) for authentication with the following approach:
- Access tokens with 15-minute expiry
- Refresh tokens with 7-day expiry stored in httpOnly cookies
- Token refresh handled automatically by API client interceptor
## Consequences
### Positive
- Stateless authentication scales horizontally
- Works seamlessly with mobile clients
- Standard approach with good library support
### Negative
- Cannot immediately invalidate tokens (must wait for expiry)
- More complex than session-based auth
- Requires careful handling of token storage
### Risks
- Token theft: Mitigated by short access token expiry and httpOnly cookies
- XSS attacks: Mitigated by not storing tokens in localStorage
## Alternatives Considered
### Alternative 1: Session-based authentication
Using server-side sessions with cookies.
- **Pros:** Simple, immediate revocation
- **Cons:** Requires session storage, harder to scale
- **Why rejected:** Doesn't fit our stateless API architecture
### Alternative 2: OAuth 2.0 with external provider
Using Google/GitHub for authentication.
- **Pros:** No password management, trusted providers
- **Cons:** Dependency on external services, some users prefer local accounts
- **Why rejected:** Users need local account option
## Implementation Notes
- Create `src/auth/` module for authentication logic
- Use `jsonwebtoken` library for JWT operations
- Add middleware to verify tokens on protected routes
- Store refresh token in `users.refresh_token` column
## References
- JWT Best Practices: https://tools.ietf.org/html/rfc8725
- OWASP Auth Cheatsheet: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.htmlUse this template when adding feature changelog entries in Phase 7.
Entries should be concise, user-focused lines under the appropriate category:
### Added
- Add [feature name] with [key capability]
### Changed
- Update [component] to [new behavior]
### Fixed
- Fix [issue description]CHANGELOG.md in the repository root## [Unreleased]If creating a new CHANGELOG.md:
# Changelog
All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/),
and this project adheres to [Semantic Versioning](https://semver.org/).
## [Unreleased]
### Added
- Your new feature entry here#### Simple Feature
### Added
- Add user profile editing with avatar upload support#### Feature with Multiple Changes
### Added
- Add profile edit form with real-time validation
- Add avatar upload with image cropping
### Changed
- Update navigation to display user avatar#### Referencing ADRs
### Added
- Add JWT-based user authentication (see ADR-0003)Use these categories from Keep a Changelog (in this order):
| Category | Use For |
|---|---|
| Added | New features |
| Changed | Changes to existing functionality |
| Deprecated | Features that will be removed in future |
| Removed | Features that were removed |
| Fixed | Bug fixes |
| Security | Security improvements |
For feature development, Added and Changed are most common.
What this component does: Orchestrates a complete feature development lifecycle from requirements through implementation and review, with architecture decision records and changelog updates.
Capabilities needed:
Adaptation guidance:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.