implement-plan-c4d3ae — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited implement-plan-c4d3ae (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Execute an implementation plan file.
At the start, use TaskCreate to create a task for each step:
/implement skillDetermine which plan file to implement using these rules in order:
add-image-cache), resolve to .turbo/plans/<slug>.md if that file exists.turbo/plans/*.md. If exactly one plan exists, use it.turbo/plans/ does not exist but .turbo/plan.md exists, use it/turboplan and stop. When a slug or path was passed but no file matched it, say which one was triedIf multiple plans exist and the most-recent choice is non-obvious (e.g., several plans were modified within the same minute), use AskUserQuestion to let the user pick from the candidates.
State the resolved plan path before continuing, then read the file.
Unless an explicit path or slug was passed, confirm the resolved plan still describes work that remains to be done:
status: is doneWhen you check whether a gate has passed, check each condition it names at its source of record, such as the remote's tags for another repository's release, rather than a local copy.
When a signal fires, output it as text. Then use AskUserQuestion to offer:
.turbo/plans/, then confirm that plan against these same signalsOn Leave it unimplemented, tell the user to bring the plan current with /refine-plan and run this skill again, or, for a plan whose gate has not passed, to run this skill again once it has. Mark the remaining implement steps deleted, then use the TaskList tool and proceed to any remaining task.
The read list, every file to read in full:
Project the read's share of the context window before the bulk of it. With one Bash call, get the size in bytes of each read-list file that exists, and their total. Call the mcp__context-level__read tool, then read the plan's Context Files. Once those reads have returned, call the tool again. While the reading has dropped fewer than five percentage points and read-list files remain unread, read a further batch and call the tool again. The projection is the drop from the first reading to the last, multiplied by the total bytes over the bytes read so far.
When the projection is above 25%, output as text that reading the plan's files is projected to take that share of the context window, with the number of files still unread. Then use AskUserQuestion to ask how to implement the plan:
Read the remaining read-list files unless the answer was One subagent per step.
/implement SkillRun the /implement skill. The plan file, its file references, and its Verification section are already in conversation context from Step 1. When Step 2 settled on one subagent per step, pass that choice along.
After /implement completes, set the plan's frontmatter status: to done with the Edit tool. If the plan is the legacy .turbo/plan.md without frontmatter, skip the status update.
When that edit is refused while this session runs inside a linked worktree, report that the status update was not applied and name the edit to make from a session that can write to the main checkout: status: done in the resolved plan path.
When the plan's Context names a larger source it implements part of (an assessment, a backlog, an issue), report the plan's completion separately from that source's: name the source's items the plan left out, and say whether another plan under .turbo/plans/ covers them.
/refine-plan or /draft-plan separately./implement. Restating steps as a turn-level narration counts as inline execution and bypasses the delegation.git commit, git push, or PR creation, halt before Step 3 and ask the user to remove them via /refine-plan. A Verification item that observes the result of a push without instructing one is not grounds to halt.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.