design-flow — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited design-flow (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Design a complete user flow at the right altitude. Most flow design fails because it stops at the happy path — this skill walks the full surface (decisions, branches, edge cases, recovery) and outputs something engineers can actually build.
Before designing anything, get answers in one round:
Do not start designing without these. Designing the wrong flow takes the same time as designing the right one — and one of them ships.
Walk the journey end to end in plain language. 5–12 numbered steps. Each step:
This pass tests whether the journey is coherent before any wireframing.
Every flow has decisions. Build a table:
| Decision point | Default path | Alternatives | If user bails | If error |
|---|---|---|---|---|
| Pick auth method | Magic link to email | Google OAuth, SAML SSO | Save email, send link 1h later | Show error + retry |
| Confirm phone | Enter SMS code | Resend, change number | Hold account 7d | Show error + alt verification |
Every alternative path that's reachable must have its own design. Branches you don't design will break in production.
Walk these explicitly:
Each relevant edge case needs a planned response.
For every screen, name the strings that matter:
Don't ship "Submit" or "Error: invalid input." Specify the actual copy. Voice and tone come from the project's existing convention (read existing UI for the pattern); fall back to direct, friendly, verb-led if no convention exists.
For flows that have a thousand prior implementations (signup, checkout, password reset, invitations, onboarding), look at how 2–3 mature products handle it before designing. The /competitive-analysis skill is the deep version of this. For a quick check, just name the references in the output: "Stripe handles this with X; we'll differ because Y."
Write the result to .claude/memory/project/flow-<name>.md so future sessions inherit it. Add to MEMORY.md index.
## Flow: <name>
### Goal
<one sentence>
### User
<persona — specific>
### Success criterion
<measurable>
### Entry points
- <where they come from>
- <where they come from>
### Story
1. User arrives at <X> from <source>. They see <screen 1 summary>. They <action>.
2. System <response>. User sees <screen 2 summary>. They decide <decision 1>.
3. …
### Screens (state-by-state)
| Screen | Purpose | States needed | Key components |
|---|---|---|---|
| /signup | First-touch | default, error (email taken), loading | Email input, primary CTA, OAuth alts |
| /signup/verify | Confirm code | default, code-sent, error (bad code), expired | Code input, resend link, change-email link |
| …
### Decisions and branches
[table]
### Edge cases
- <case 1> — handled how
- <case 2> — handled how
### Microcopy
| Screen | Element | Copy |
|---|---|---|
| /signup | Page title | "Create your account" |
| /signup | Primary CTA | "Send magic link" |
| /signup | Error: email taken | "That email's already in use. Sign in instead?" |
| …
### Open questions for you
1. <question>
2. <question>
### Engineering handoff
- Routes needed: …
- Backend endpoints: …
- New components needed: …
- Reused components: …
- Analytics events to instrument: …~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.