plan-feature-from-youtrack — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited plan-feature-from-youtrack (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generate a spec and optionally an implementation plan from a YouTrack card, grounded in the actual codebase.
Announce at start: "I'm using the plan-feature-from-youtrack skill to generate the [spec / spec and plan] for <card-id>."
From the user's message, identify:
INTOP-1486, ABC-123. If none is given, ask for it before proceeding.spec-only → user says "spec", "describe", "write a spec", or gives no indication they want tasks/planspec-and-plan → user says "plan", "implement", "create a plan", "give me tasks", "full plan"spec-and-plan and mention what you're doing.Run all three commands and collect the results:
yt issues show <card-id>
yt issues comments list <card-id>
yt issues related <card-id>The show command gives you the description, type, state, assignees, and custom fields. The comments provide additional context, decisions, and implementation notes added over time. The related command reveals dependencies, sub-tasks, and linked issues.
If a related issue looks relevant (e.g. a parent epic, a blocking dependency), fetch its details too:
yt issues show <related-id>Before writing anything, explore the repository to understand the landscape. You're looking for:
AGENTS.md, CLAUDE.md, .claude/CLAUDE.md you can find (root and subdirectories). These define how to behave in this codebase.README.md (and any other top-level .md files like CONTRIBUTING.md, ARCHITECTURE.md, DEVELOPMENT.md).The goal is to write a spec and plan that feel native to this codebase — not generic.
Before putting anything to paper, take a moment to surface ambiguities — things that the card and codebase together don't answer clearly enough to write a solid spec. These questions help the user articulate implicit assumptions and hidden expectations they may not have thought to write down.
How to do it:
DamageTypesUpdated merge with existing types or replace them entirely?")Save to: `<card-id>-spec.md` in the current working directory (or wherever the user says).
Use this structure:
# Spec: <Card Summary>
**YouTrack**: <card-id> · **Type**: <type> · **State**: <state>
## Background
<2–4 sentences: why this work exists, what problem it solves, and what triggered it.
Draw from the card description, comments, and any linked issues.>
## What We're Building
<Clear description of the change or feature. Be concrete — name the specific
entities, events, endpoints, or behaviors involved. If the card mentions
multiple items (e.g. five events), list them explicitly.>
## Technical Context
<What exists today that's relevant. Which modules/services are involved.
What patterns or abstractions already exist that this change should follow.
Reference actual file paths where useful (e.g. `src/orders/handler.rs`).>
## Acceptance Criteria
<Numbered list of observable, testable outcomes. Each criterion should
be verifiable — avoid vague statements like "it works correctly".>
1. ...
2. ...
## Out of Scope
<Explicitly call out adjacent things that are NOT part of this change,
to prevent scope creep. Derive these from the card and codebase context.>
## Open Questions
<Any ambiguities that need resolution before or during implementation.
Include things that aren't clear from the card or the codebase.>
## Notes
<Optional: implementation hints, risks, links to relevant code, Notion pages,
or other resources mentioned in the card.>Keep the spec honest: don't invent decisions that weren't made. Flag genuine uncertainty in "Open Questions" rather than papering over it.
spec-and-plan)Before writing the plan, do one more round of targeted questions — this time focused on implementation decisions rather than requirements. The spec is now written, so these questions are about how to build it, not what to build.
Typical plan-level questions:
Again, one question at a time, and only ask what genuinely matters for structuring the plan. If everything is clear from the spec + codebase, skip this step entirely and proceed to writing the plan.
Once answered (or if no questions are needed), tell the user: "Great — writing the plan now." Then proceed to Step 7.
spec-and-plan)Save to: `<card-id>-plan.md` in the same directory as the spec.
The plan is an ordered, trackable list of implementation tasks. It should be actionable — a developer (including an AI agent) should be able to pick up a task and know exactly what to do.
Use this structure:
# Implementation Plan: <Card Summary>
**Spec**: [<card-id>-spec.md](./<card-id>-spec.md)
**YouTrack**: <card-id>
## Overview
<1–2 sentences describing the overall approach and how the work is phased.>
## Files to Create / Modify
| File | Action | Purpose |
|------|--------|---------|
| `path/to/file.ext` | Create / Modify | What this file will do |
## Tasks
### Phase 1: <Meaningful name, e.g. "Data model" or "Event handling">
- [ ] **1.1** <Task title>
- **What**: <What to implement — be specific about logic, not just "add a handler">
- **Files**: `path/to/file.ext`
- **Test**: <How to verify this works — unit test, integration test, manual check>
- [ ] **1.2** <Task title>
...
### Phase 2: <Next phase>
- [ ] **2.1** ...
## Testing Strategy
<How to verify the whole feature end-to-end once all tasks are done.>
## Definition of Done
- [ ] All tasks above completed
- [ ] Tests pass (specify which test suite)
- [ ] <Any other project-specific done criteria from AGENTS.md/CLAUDE.md>Guiding principles for the plan:
When done, tell the user:
spec-and-plan mode: a one-line summary of the phases in the planIf you couldn't fetch some data (e.g. yt not authenticated, issue not found), say so clearly and generate what you can from available information.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.