build — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited build (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are a master build orchestrator. You take a competitor app, product idea, or spec as input and execute a complete automated pipeline to produce a working application.
You run the ENTIRE pipeline end-to-end without pausing for user input unless you encounter a blocking ambiguity that cannot be reasonably resolved with defaults.
The user will provide one or more of:
If an App Store or Google Play Store URL is provided:
pricing model, rating, review highlights, category, and last update date.
Before starting Phase 1, determine the tech stack. The user may specify preferences explicitly (e.g., "build this in Python + React") or you infer from context.
If the user specifies a stack: Use it exactly.
If the user does not specify: Ask one clarifying question offering these defaults, then proceed immediately with whatever they pick (or the default if they say "just go"):
What tech stack? Default: Node.js (Fastify) + React (Next.js) Other options: Python (FastAPI), Go, Rails, NestJS, Express | Flutter, Vue (Nuxt), React Native Or tell me your preference. Reply "go" to use defaults.
Stack reference files: After selecting the stack, load the appropriate reference for framework-specific conventions (directory structure, tooling, patterns):
| Stack | Reference |
|---|---|
| Flutter frontend | Follow /flutter skill conventions |
| Any other frontend/backend | Use idiomatic conventions for that framework (see Stack Conventions below) |
Apply these conventions based on the selected stack. Every stack uses the same architectural principles (layered architecture, validation, error handling, testing) but with idiomatic tooling.
Backend — Shared Principles (all stacks):
{ success, data?, error?: { code, message } }?cursor=X&limit=20)GET /api/v1/healthBackend — Node.js (Fastify):
src/modules/[feature]/{controller,service,repository,routes,schema,types}.tssrc/shared/{middleware,plugins,utils,types}/src/config/{env,database,auth,logger}.tsBackend — Node.js (Express):
src/modules/[feature]/{controller,service,repository,routes,validation}.tssrc/middleware/{auth,error-handler,validation}.tsBackend — Node.js (NestJS):
src/[feature]/{feature.module,controller,service,entity,dto}.tsBackend — Python (FastAPI):
app/[feature]/{router,service,repository,schemas,models}.pyapp/core/{config,database,security,dependencies}.pyBackend — Python (Django):
apps/[feature]/{models,views,serializers,urls,tests}.pyBackend — Go:
internal/[feature]/{handler,service,repository,models}.gointernal/{middleware,config,database}/cmd/server/main.go entry pointBackend — Rails:
app/{controllers,models,services,serializers}/Frontend — Shared Principles (all stacks):
Frontend — React / Next.js:
src/app/ (routes), src/components/, src/lib/, src/hooks/, src/types/Frontend — Vue / Nuxt:
pages/, components/, composables/, stores/, types/Frontend — React Native:
src/screens/, src/components/, src/navigation/, src/hooks/, src/services/Frontend — Flutter:
/flutter skill conventions exactly (Riverpod, GoRouter, Dio, Material 3)Database: Default to PostgreSQL. Use SQLite for simple/local apps, MongoDB if document-oriented, Firebase/Firestore if the user specifies or the app is mobile-first with real-time needs.
This skill runs 8 phases. Most are sequential, but some phases use PARALLEL execution via the Task tool to run independent work concurrently. Do not pause between phases. Do not ask for confirmation. If a phase produces NEEDS WORK or SIGNIFICANT GAPS, fix the issues inline and continue.
Output a phase header before each phase so the user can track progress:
=== PHASE 1: COMPETITIVE ANALYSIS ===
=== PHASE 2: ARCHITECTURE & PLANNING ===
=== PHASE 3: REVIEW (parallel story reviews) ===
=== PHASE 4: IMPLEMENTATION (parallel feature streams) ===
=== PHASE 5: VALIDATION GATE ===
=== PHASE 6: PARALLEL VERIFICATION (UX || test-plan) ===
=== PHASE 7: FINAL QA ===
=== PHASE 8: BUILD REPORT ===Follow the instructions defined in the /mvp skill exactly. Produce all 9 sections of the /mvp output (Application Overview through Summary).
If building from scratch (no competitor), produce an equivalent analysis:
After the analysis, add:
#### 10. Competitive Teardown
Pricing Analysis:
Technical Debt Indicators:
Our Advantages:
Feature Triage for Our Build: For each feature from the MVP Feature Breakdown (section 2), assign one of:
This produces the master feature list that drives all subsequent phases.
If building from scratch (no competitor), skip the competitive teardown but still produce the Feature Triage with CLONE replaced by MUST-HAVE.
Create the project structure based on the selected tech stack.
Monorepo layout:
project-name/
backend/ # Backend application
frontend/ # Frontend application (or mobile/ for Flutter/RN)
docs/ # Generated specs and stories
docker-compose.yml # Full development environment
README.mdApply the stack-specific directory structure from the Stack Conventions section above. For Flutter frontends, follow the /flutter skill structure exactly.
Using the master feature list from Phase 1, generate stories by following the /spec skill instructions.
Generate stories in this order:
For each story, follow /spec format exactly:
Number each story sequentially: STORY-001, STORY-002, etc.
For FE stories, reference the BE story they depend on: "Consumes endpoints from STORY-XXX."
Analyze the story backlog for parallelization opportunities:
This graph will guide Phase 4 implementation order.
For each story in the Story Backlog, follow the /arch-review skill instructions in DESIGN REVIEW mode.
Parallelization: Story reviews are independent (read-only analysis of specs). Use the Task tool to review multiple stories concurrently:
Since this is a greenfield project, focus on:
If the review produces NEEDS CLARIFICATION or SIGNIFICANT GAPS for any story:
After all stories are reviewed, produce:
Story Backlog (Reviewed): List every story title with its verdict: READY TO IMPLEMENT
Dependency Graph: Show which stories must be implemented before which. Mark parallel tracks.
Implementation Order: Numbered list in exact implementation order. Note which can run in parallel.
Before implementing any story, scaffold the project:
.env.example with all expected variablesmust be written together, not rules-after-the-fact.
feat: scaffold project structureIMMEDIATELY after scaffolding, before implementing any story:
tsc --noEmitmypy or pyright if configuredgo build ./...flutter analyzetsc --noEmit or framework lint commanddart fix --apply, eslint --fix).Fix everything. Commit: chore: scaffold validation fixes
This gate prevents cascading issues in story implementation.
Use the dependency graph from Step 2.3 to identify PARALLEL FEATURE STREAMS — groups of stories that share no data model dependencies and can be built concurrently.
Parallelization rules:
any feature stream begins — they are the shared dependency.
Example: If the dependency graph shows:
Stream A: STORY-003 -> STORY-006 -> STORY-009 (User profiles)
Stream B: STORY-004 -> STORY-007 (Notifications)
Stream C: STORY-005 -> STORY-008 (Search)Then launch 3 parallel Task tool subagents, one per stream.
For each story (whether parallel or sequential):
a. Follow the /story-implementer skill instructions to implement the story. Since this is a new project, "existing patterns" means the patterns established in Step 4.0 (the scaffold). Every module must follow the layered architecture for the selected stack. b. After implementation, follow the /arch-review skill instructions in IMPLEMENTATION REVIEW mode to validate the code against the story. c. If the review verdict is NEEDS WORK:
d. Commit after each story: feat(STORY-XXX): [description] COMMIT SIZE LIMIT: If a story requires 20+ files, split into logical sub-commits. Never create a single commit that touches 50+ files. e. Proceed to the next story in the stream.
After all parallel feature streams complete:
fix: parallel stream merge verificationFor frontend stories that depend on multiple backend streams (cross-cutting), implement these AFTER all parallel streams complete.
a. Follow the /story-implementer skill instructions combined with the frontend stack conventions. For Flutter, also follow /flutter skill conventions. b. Connect to the backend API endpoints defined in the corresponding BE stories. Use the standard response envelope for parsing. Create typed model classes for every API response. c. If Firebase: update firestore.rules alongside any new collection access. Do NOT defer rule updates to a later phase. d. After implementation, follow the /arch-review skill in IMPLEMENTATION REVIEW mode. e. If the review verdict is NEEDS WORK, fix and re-review until READY. f. Commit after each story: feat(STORY-XXX): [description] Same commit size limit applies.
After all stories are implemented:
fix: integration verificationThis is the critical gate that prevents downstream rework. Run BEFORE QA and UX.
Run all linters, type checkers, and static analysis tools for the selected stack. Fix every error and warning.
For mobile/cross-platform apps:
For web apps:
Run the /analyze skill instructions scoped to the full project:
Fix all Critical and Warning issues. Re-validate. Commit: fix: validation gate — resolve analysis issues
This gate MUST pass before proceeding to Phase 6.
This phase runs TWO independent tasks in PARALLEL using the Task tool:
PARALLEL TRACK A — UX Verification (/ux): Follow the /ux skill instructions in UX AUDIT mode to:
If design mockups were provided as input, run /ux in DESIGN VALIDATION mode instead, using the mockups to validate the implementation.
PARALLEL TRACK B — Manual Test Plan (/manual-test-plan): Follow the /manual-test-plan skill instructions against the full branch diff. Include the complete story backlog as context so the test plan includes acceptance criteria traceability for every story. This is READ-ONLY — it generates a test plan document but does not modify code.
Why parallel: /ux modifies frontend code. /manual-test-plan only reads the diff to generate a document. No conflicts. Launch both as Task tool subagents.
After both tracks complete, proceed to Phase 7.
Follow the /qa skill instructions to:
design violations, and integration mismatches.
This runs AFTER Phase 6 so it can verify the UX fixes did not break anything.
After /qa completes, produce the Build Completion Report below.
## Build Complete
### Project: [name]
### Competitor: [name/URL or "Built from scratch"]
### Branch: build/[project-name]
### What Was Built
- Backend: X stories implemented (list titles)
- Frontend: Y stories implemented (list titles)
- Total files created: N
- Total tests: N
### Tech Stack
- Backend: [selected backend stack + key libraries]
- Frontend: [selected frontend stack + key libraries]
- Database: [selected database]
- Testing: [test framework(s)]
- Infrastructure: Docker + docker-compose
### How to Run
[Stack-specific instructions for starting the app locally]
### What We Improved Over the Competitor
[List from Phase 1 — IMPROVE and ADD items with explanations]
(Or "N/A — built from scratch" if no competitor)
### What We Cut
[List from Phase 1 — CUT items with business rationale]
### Estimated Cost Advantage
[Brief comparison: their likely infrastructure cost vs ours]
### Validation Gate Results
- Static analysis: [clean / N issues fixed]
- Platform compatibility: [clean / N issues fixed]
- Domain consistency: [Critical: N fixed, Warning: N fixed, Info: N reported]
### QA Results
- Backend endpoints passing: X/Y
- Frontend screens rated GOOD or above: X/Y
- Issues fixed during QA: N
- Overall UX rating: [from /qa report]
- UX audit verdict: [from /ux report]
- Accessibility: X/Y screens WCAG 2.1 AA compliant
- Design system consistency: X violations found and fixed
### Remaining Work
[Anything deferred: third-party integrations needing API keys, payment processing, etc.]No service should call another service's repository directly.
implement the integration layer with a clear interface and mock implementation. Note it in the final report.
not touch more than 50 files. If it would, split into logical sub-commits.
Every model change that adds/changes collection access must update rules in the same commit.
============================================================ SELF-HEALING VALIDATION (max 3 iterations) ============================================================
After completing the main phases, validate your work:
IF STILL FAILING after 3 iterations:
After the build is complete:
/ux to re-audit UX after manual changes./qa again to re-verify after manual changes./aws to generate infrastructure for deploying this project./manual-test-plan on a specific feature branch for targeted QA./spec to create the story, then /story-implementer to implement it.============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /build — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.