execute — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited execute (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Respond in the user's preferred language (detect from their recent messages, or fall back to the language setting in CLAUDE.md).
Read a plan and execute it fully without asking "proceed?" or "start?" — invoking execute is the go-ahead.
Workflow: take--workflow <name>from$ARGUMENTSif present, else runqq-config.py field workflow. Onprototype-loop, run §4 asshared/prototype-loop.md§Execute describes (failing check first per slice, no per-phase review subagents, the checklist re-read at each checkpoint) and keep the rest of this file, §5 Completion included: itsclearends the checkpoint, and without it/qq:gokeeps sending the work back to execute; onheavy-review(the default), follow this file as written.
Run qq scripts as${CLAUDE_PLUGIN_ROOT}/bin/<name>: they are not on PATH, so a bareqq-compile.shexits 127.
Live Unity Editor steps (inspect a component, change a scene object, open or save a scene, run a menu item — instead of writing code):qq-unity-cli.py channel --project "$PWD"prints the project's channel,unity-cli,tykitornone(shared/unity-live-state.mdexplains them; the plan may already name it). Never open or printLibrary/Pipeline/.unity-pipeline-port— it holds an eval token. - unity-cli:unity command --project-path "$PWD" --json --no-banner <command> -- <params>(e.g.set_component_properties,set_serialized_field,open_scene,save_all,menu). Look parameters up first withunity command --project-path "$PWD" --query <keyword> --detail full --json; command map and timeout recovery inshared/unity-cli-reference.md. - tykit: the MCP tools (unity_query,unity_object,unity_assets,unity_physics) or direct HTTP — seeshared/tykit-reference.md. - none: do the step in code or assets instead, and note it.
>
Editor changes persist only once saved (save_all/ tykitsave-scene). Compile and tests still go through qq (auto-compile,/qq:test) on every channel.
Arguments: $ARGUMENTS
--no-worktree: skip worktree guard--auto: after completion, auto-select and run the next workflow step instead of asking the user (includes push — user should be aware)Docs/qq/Execute in a linked git worktree. Skip it only when:
git rev-parse --path-format=absolute --git-dir differs from git rev-parse --path-format=absolute --git-common-dir.$ARGUMENTS contains the literal token --no-worktree (a user who only seems to mean it does not count).If something seems to require skipping the worktree, resolve it instead:
| Obstacle | Resolution |
|---|---|
| Plan file is untracked | Commit it (step 1 below), then enter the worktree — the plan is visible there. |
| Uncommitted changes in the working tree | Commit them if they belong to this plan, stash them if not, then enter the worktree. If the user wants them left as they are, they pass --no-worktree. |
State any skip and its reason in your first message (e.g. "Skipping worktree: user passed --no-worktree in arguments" / "Skipping worktree: already inside linked worktree <path>" / "Skipping worktree: plan is 2 steps, 1 file, no compile").
The procedure:
Design doc: line names (the review at the end reads it). Check them: git status -- <plan_file> <design_doc>If either is untracked or modified, commit them and say so:
git add -- <plan_file> <design_doc>
git commit -m "docs(plan): <slug> plan document" -- <plan_file> <design_doc> SOURCE_BRANCH=$(git rev-parse --abbrev-ref HEAD)
SOURCE_HEAD=$(git rev-parse HEAD)
echo "Source: $SOURCE_BRANCH @ $SOURCE_HEAD"EnterWorktree with name: <slug>. If EnterWorktree is unavailable, fall back to ${CLAUDE_PLUGIN_ROOT}/bin/qq-worktree.py create --name <slug>, tell the user to reopen in the new path, and stop — don't proceed in the main dir.EnterWorktree branches from origin/<default-branch> unless the user's worktree.baseRef setting is head: WT_HEAD=$(git rev-parse HEAD)
if git merge-base --is-ancestor "$SOURCE_HEAD" HEAD 2>/dev/null; then
echo "✓ Worktree HEAD ($WT_HEAD) includes source HEAD ($SOURCE_HEAD)"
else
echo "✗ Worktree HEAD ($WT_HEAD) does NOT include source HEAD ($SOURCE_HEAD) — resetting"
# The new worktree branch has no commits of its own yet.
git reset --hard "$SOURCE_HEAD"
echo " ✓ Reset worktree to $SOURCE_HEAD"
fiRecover with this reset, not cherry-pick: cherry-pick brings the commits over but leaves the branch's merge-base on the default branch, which breaks git diff source...HEAD-style scoping and the merge back.
.qq/state/worktree.json metadata that registers the worktree as qq-managed — EnterWorktree copies none of them): ${CLAUDE_PLUGIN_ROOT}/bin/qq-worktree.py seed-local-runtime --project . --source "<SOURCE_PROJECT>"Library/, etc.). Pass no --source — the metadata from step 6 names it: ${CLAUDE_PLUGIN_ROOT}/bin/qq-worktree.py seed-runtime-cache --project .Find the plan (user arg → conversation → Docs/qq/ scan → ask).
Resume check: Run:
qq-execute-checkpoint.py resume --project .If it returns progress with status: "running" or "paused", resume from the first uncompleted step. Report: "Resuming from step N (steps 1–M already complete)."
If empty, scan the plan's checkboxes and resume from the first unchecked step (- [ ]).
Read the plan, and AGENTS.md if the project has one.
Read the decisions the design and plan phases made, and keep implementation choices consistent with them:
qq-decisions.py summary --project .Don't write a new plan, enter plan mode, or save files to .claude/plans/ — the plan exists; execute it.
Classify the plan:
Use judgment for borderline cases.
Output a brief summary to the user (plain text, not a file):
Executing: <plan name> (coordinator mode, N phases)
Phase 0: ... → Phase 1: ... → ...Then initialize checkpoint and begin immediately:
qq-execute-checkpoint.py save \
--project . --plan "<PLAN_PATH>" --step 0 --total <M> \
--mode <coordinator|direct> --phase "<FIRST_PHASE>" --status runningBefore writing any engine source code, run the preflight check. $PROJECT below is the engine project root — the directory holding ProjectSettings/, project.godot, the .uproject or the .sbproj; don't assume it is the CWD.
qq-preflight.py --project "$PROJECT" --prettyPreflight only reports; the user resolves its blockers, not a flag.
ready: true → continue.block_reason: "virgin_project" → stop. Tell the user to open the project in the engine's editor (Unity Hub / Godot / Unreal), wait for import, then confirm. Save checkpoint with --status paused, and write no source files until the user confirms.ready: false → report the message and stop.After ready: true, do a test compile to verify the pipeline end-to-end:
qq-compile.sh --project "$PROJECT"If this fails, diagnose and resolve before proceeding.
Thecompile-gate-check.shPreToolUse hook also blocks engine source writes whenLibrary/is missing (linked git worktrees are exempt) or the last compile failed. While it is red, the files with errors, the file that broke the build, files of types named in the errors, and new files stay editable — fix those first.
After each checkpoint (both modes), check the plan's Milestones table: when every step of a milestone is in completed_steps (printed by save) and it has not been announced yet (on resume, milestones finished before the resume point count as announced):
/qq:test <narrowest scope> without --auto and skip its Handoff; fix failures as in the Fix step.Then continue without waiting for an answer. If a later compile has no verdict because the Editor is in Play mode (the user is trying the milestone), that is not a failure. Without --auto: save --status paused, ask the user to leave Play mode, and resume with /qq:execute. With --auto: tell the user once, then re-check the compile about once a minute until Play mode ends.
Subagents already load CLAUDE.md. Paste inline what they cannot see — don't ask them to read the plan file or AGENTS.md:
For each step, decide:
After each step:
qq-compile.sh --project "$PROJECT" and check exit code 0. Fix before proceeding. If unfixable after 3 attempts, save --status paused and stop.Execute phases in the order the plan specifies (which may not be numeric — e.g. Phase 9.1 before Phase 2). Work out from the plan which phases are sequential (a phase uses interfaces an earlier phase creates; see the steps' Depends-on lines) and which are parallel (e.g. "Phase 3 + Phase 4 parallel"). Never run a phase in parallel with one whose interfaces it uses.
Sequential phases — for each phase:
qq-compile.sh --project "$PROJECT" and check exit code 0. If it fails: dispatch fix subagent (max 3 rounds, then --status paused)shared/user-decisions.md)qq-execute-checkpoint.py saveParallel phases (independent, no shared interfaces):
qq-compile.sh --project "$PROJECT" and check exit code 0For truly large module-crossing refactors (10+ files, 3+ independent modules), consider dispatching subagents with isolation: "worktree" to avoid file conflicts.
Review prompt:
"Review the changes made in [PHASE_NAME] for behavior correctness. Compilation already passed — focus on logic errors that the compiler cannot catch: 1. Are event triggers conditional on the right state? (e.g. only on kill, not every hit) 2. Is state stored on an object whose lifetime matches the data's? (e.g. data that must survive a scene change is not kept on a scene-scoped object) 3. Are edge cases handled? (null checks at system boundaries, empty collections) Report findings as [Critical] / [Moderate] / [Minor]. Be concise."
qq-execute-checkpoint.py save \
--project . --plan "<PLAN_PATH>" --step <N> --total <M> \
--mode <MODE> --phase "<PHASE_NAME>" --step-title "<STEP_TITLE_TEXT>"This updates .qq/state/execute-progress.json and the plan file checkbox together; don't edit the plan file yourself.
If the plan has a Cross-cutting Seams section (跨切面接缝清单) and .claude/seams.yml exists, run every grep command in that checklist (Grep tool / rg) first. Each fan-out point must be handled — your diff edited it, or you can justify "no change needed"; don't finish with a row the plan marks as needing a change untouched in your diff. Append any newly hit seam that is not yet in .claude/seams.yml.
Clear the checkpoint:
qq-execute-checkpoint.py clear --project .Summarize: what was implemented, deviations from plan, issues resolved, and any "Needs the user's decision" entries.
Code review here defaults to Claude (/qq:claude-code-review), with or without --auto; Codex review (/qq:codex-code-review) is kept for merge gates and large refactors, as the README's Pre-merge gate and Two warnings sections say. Plan review differs on purpose: /qq:plan prefers Codex when it is available.
Pass the plan to the review as a spec, and the design doc too when the plan's Design doc: line names one: /qq:claude-code-review --spec <design-doc> --spec <plan>. The review still picks its own scope (normally the uncommitted changes); the specs make it also check the code against the plan and the design's Acceptance Checklist.
Without `--auto`: recommend the next step and wait for the user. The order is always review → test → commit-push:
/qq:claude-code-review/qq:test/qq:commit-pushWith `--auto`: run qq-execute-checkpoint.py pipeline-advance --project . --completed-skill "/qq:execute" --next-skill "/qq:claude-code-review" --plan-doc "<plan>" --design-doc "<design doc, if named>", then take the full path automatically: /qq:claude-code-review (with the --spec arguments above) → /qq:test → /qq:commit-push
shared/user-decisions.md)/qq:add-tests over hand-writing test files~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.