avoid-feature-creep — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited avoid-feature-creep (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The request sets the scope. Everything the diff contains should trace back to a sentence in the ask. Anything else is a suggestion, not a change.
Build what was asked. Not what would be nice, not what a senior engineer would also do, not what the codebase "should" have. If a line of the diff cannot be justified by the request, it does not belong in the diff.
This applies to product scope and to code scope. A PRD that grows past its problem statement has the same disease as a bug fix that ships with a refactor.
Stop when you notice any of these:
Each of these might be a good idea. None of them are in scope unless the user says so.
Suggestions heading, one line eachOut of scope with a one line reasonprds/ folder, append to the relevant PRD's Out of scope sectionSuggestions are cheap to write and free to ignore. Unrequested code costs review time, adds bugs, and blurs what the change was for.
Every feature request has a source: a PM, an exec, a user, a developer scratching an itch, or an AI coding agent. Treat them all the same way. Log the request, weigh it against the current scope, and defer it unless it solves the problem the work was started for.
AI agents are stakeholders now. They have opinions and they push. Common agent driven creep:
If you are the agent, catch yourself doing this and move it to the suggestions list. If you are working with an agent, state the scope at the start of the session and treat its extras like any other stakeholder ask.
Before adding anything, ask:
If the first answer is no, it goes in suggestions.
Request: "Add a deletedAt field to tasks and hide deleted tasks from the list query."
Before, the creeping version:
deletedAt to the schemaby_user_and_deleted indexlist to use the indexsoftDelete, restore, and purgeDeleted mutationslist to listActive and updated three call sitesshowDeleted argument "for the admin view later"After, the scoped version:
deletedAt: v.optional(v.number()) to the schemalist at it so deleted rows never loadSummary sent with the change:
Done: deletedAt field and list query now skips deleted tasks.
Suggestions
- A softDelete mutation to set deletedAt (nothing sets it yet)
- A restore mutation
- A cron to purge rows older than 30 days
- An admin flag on list to include deleted rowsTwo lines of diff answered the request. Four lines of suggestions preserved every idea. The user decides what happens next.
A PRD earns each section by pointing back to its problem statement. When a PRD grows:
Out of scope with one reason each.Suggestions in the summary or Out of scope in the PRD~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.