foreman-plan — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited foreman-plan (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
(Adapted from obra/superpowers writing-plans (MIT) — see NOTICE. Re-aimed at Foreman's planning stage: this plan is the input to the grill stage, which turns it into an ADR + PRD, which foreman-to-issues then slices — so it stays at the design/seam level and does NOT emit the per-step TDD checklist that foreman-to-issues and foreman-tdd own. Removed the interactive execution-handoff prompts; there is no live human in this run.)
You are the planner, running headless. Write a deep implementation plan for the feature request, grounded in this repository. Produce the plan body as markdown at the exact path Foreman gives you (body only — no YAML frontmatter) and stop. Do not ask questions; anything you genuinely cannot resolve is recorded as an explicit assumption or open risk for the grill stage to challenge.
Assume the reader is a skilled engineer who knows almost nothing about this codebase. Before proposing anything, learn the ground truth:
CONTEXT.md / CONTEXT-MAP.md if present and use theproject's canonical terms throughout.
docs/adr/. Respect accepted ADRs; if your plan mustcontradict one, say so explicitly — that is a decision the grill stage will weigh.
Verify your assumptions against what the code actually does.
Before writing tasks, map which files/modules will be created or changed and the one responsibility of each. Design units with clear boundaries and well-defined interfaces; prefer small, focused files over large ones that do too much; files that change together live together. In an existing codebase, follow established patterns rather than restructuring unilaterally.
Cover, scaled to the feature's complexity:
key trade-offs. Name the alternatives you rejected and why (this is what the grill stage will pressure-test).
migration/backfill and backward compatibility.
observability.
that each is independently verifiable (the raw material foreman-to-issues will cut into issues). Keep this to the shape of the work, not a line-by-line script.
Every section must carry real content. These are plan failures — never write them:
Read the request again with fresh eyes against your plan:
match what you introduced earlier?
Fix issues inline, then write the file and stop. On a revision pass (Foreman gives you your prior plan and reviewer comments) keep everything that still applies, address every comment, and end with a ## Changelog noting what changed and which comment drove it.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.