Best-practice Agent Skill for plan/runbook docs containing configurable values
SaferSkills independently audited parameterizing-plan-docs (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A plan or implementation doc serves two readers: the historical record of what was built, and the template for re-applying it elsewhere. Hardcoded configurable values (ports, namespaces, repo names, version pins) scattered as body literals break both roles -- the artifact rots as values drift; the template is invisible until a reader hits a collision. This is the best-practice pattern for resolving that tension.
Core principle: Factor configurable parameters into a top-of-doc table documenting the option range and rationale; leave body code blocks with the project's concrete defaults. Body = historical artifact. Top table = template lens. Both stay accurate; neither contaminates the other.
When NOT to use: single-use scripts; compliance / security / contract docs with mandated fixed values; project-internal conventions baked into code (use CLAUDE.md / AGENTS.md / GEMINI.md instead).
## <Category> Selection (e.g., Host Port Selection, Namespace Selection, Version Pinning)<PLACEHOLDER> syntax -- that breaks copy-paste, removes the doc's value as a faithful artifact, and forces readers to re-render mentally on every reading.| Parameter type | Table column | Rationale column |
|---|---|---|
| Port | Port number | Memorability, collision odds, IANA status |
| Namespace | Namespace name | Convention, isolation tier, naming scheme |
| Version pin | Version string | Compatibility, stability, security posture |
| Repo name | Org/repo path | Ownership, naming convention |
| Path | Path string | Mount points, FHS conventions, project layout |
| Secret name | Secret identifier | Naming scheme, scope, rotation policy |
Applied to a 3500-line plan with 30+ references to a single configurable host port (originally hardcoded to a heavily-trafficked dev-tool port), the pattern collapsed re-application from "audit every code block" to "read the top table, run the substitution checklist." Body stayed canonical; table became the template lens.
RELATED: superpowers:writing-plans -- general plan-doc structure conventions; this skill refines them on the configurability axis.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.