bloom-plan-ad957d — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited bloom-plan-ad957d (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Decision-transparent planning with Plan-Execute-Verify. Activate: /bloom-plan, /plan, "plan this", "make a plan". Deactivate: /plan-off, "stop planning". Artifacts → .cursor/plans/. On activation: confirm mode + deactivation command in plain text. Plan mode auto-activates bloom mode (plans produce HTML).
.cursor/plans/<name>.plan.md + .cursor/plans/<name>.plan.html. Name = kebab-case. Run self-audit (below) before presenting the plan..plan.md (re-read and resume), reject (stop), or scope down.executing → verified.Detect from project context and user prompt:
| Scale | Trigger | Decision scope |
|---|---|---|
| Greenfield | No codebase, or 0.x with no conventions | Every foundational decision gets a full table (stack, architecture, tooling, security, perf, impl order) |
| Brownfield | Established codebase with patterns | Implementation-level choices get tables; foundational decisions locked |
| Phase | Master plan exists, planning a phase | Task-level "which approach" tables; atomic steps with file paths |
Rate every decision's benchmark quality on a 3-point scale:
| Rating | Criteria | Action |
|---|---|---|
| Strong | Verifiable metric (stars, deps, perf numbers, prod usage) | Keep table as-is |
| Weak | Observation only ("dir exists", "feels cleaner", "implies curated") | Strengthen to a metric, or collapse to one-line rationale |
| Empty | All alternatives interchangeable, choice is trivial | Skip table; write one-line rationale |
Collapse rule: If all alternatives are equally valid (e.g., directory location for a one-file script, language choice for a single print statement), DO NOT force a table. Write: "Decision: [what]. Chosen: [option]. Alternatives considered: [B, C] — not meaningfully different." This prevents ceremony over substance.
Anti-pattern (from hello-world test): "Dir already in repo" as a benchmark. Fix: "0 added deps, no packaging impact, pre-existing .gitignore cover."
Every non-trivial decision (per self-audit) MUST include 3–4 alternatives:
#### Decision: [what]
**Chosen:** [Option] — [rationale]
| # | Option | Example | Benchmark | Why not chosen |
|---|--------|---------|-----------|----------------|
| ✅ | [A] | [concrete: library/pattern/API] | [measurable metric] | — |
| 2 | [B] | [concrete] | [metric] | [specific reason] |
| 3 | [C] | [concrete] | [metric] | [specific reason] |Example = concrete (library name, pattern, API — never vague). Benchmark = verifiable and specific: "38k stars", "0 deps", "2× faster", "used by Stripe" — never "dir exists" or "feels right". Why not chosen = specific tradeoff: "adds 450KB", "no TS support", "abandoned 2024".
In .plan.html: expandable <details> cards — chosen in --clay, alternatives in --gray-700.
research → draft → approved → executing → verifiedsrc/config/auth.ts line 24-38", not "update config")..plan.html companion ✓Follow Bloom Construction Rules (1–12) and Security Rules (S1–S8). Required: decision cards as expandable <details>, checklist persisting to localStorage, risk matrix (color-coded: --rust=high, --clay=med, --olive=low), status timeline (Research→Draft→Approved→Executing→Verified), scale badge, copy-as-markdown button (Clipboard API + execCommand('copy') fallback), @media print stylesheet.
Self-check (before finalizing any plan):
.plan.md and .plan.html both written to .cursor/plans/~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.