Skip to content
skillsafebeta
← Report library
Purpose / Development

Writing Plans Skill Security Audit

What the author says it does (original text)

Use when you have a spec or requirements for a multi-step task, before touching code

Independent security check

No obvious risks found in this check

Files checked
2
Risks found
0
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill generates detailed implementation plans and, by default, saves them to a date-based Markdown path inside the repository; a user-specified location overrides that default.

View source
SKILL.md:10In the instructionsOpen original file
Write comprehensive implementation plans assuming the engineer has zero context for our codebase and questionable taste. Document everything they need to know: which files to touch for each task, code, testing, docs they might need to check, how to test it. Give them the whole plan as bite-sized tasks. DRY. YAGNI. TDD. Frequent commits.
SKILL.md:18In the instructionsOpen original file
**Save plans to:** `docs/superpowers/plans/YYYY-MM-DD-<feature-name>.md`- (User preferences for plan location override this default)

Every generated plan must contain instructions directing a later execution agent to use another Skill named `superpowers:subagent-driven-development` or `superpowers:executing-plans`. The provided source requires writing these instructions into the plan but does not include the implementations of those external Skills.

View source
SKILL.md:56In the instructionsOpen original file
**Every plan MUST start with this header:**```markdown# [Feature Name] Implementation Plan> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
SKILL.md:165In the instructionsOpen original file
**If Subagent-Driven chosen:**- **REQUIRED SUB-SKILL:** Use superpowers:subagent-driven-development- Fresh subagent per task + two-stage review**If Inline Execution chosen:**- **REQUIRED SUB-SKILL:** Use superpowers:executing-plans- Batch execution with checkpoints for review

The plan template includes `git add` and `git commit` commands for implementation steps, but these are example steps written into the plan, not commands that this planning Skill itself immediately executes. After saving the plan, it is also supposed to offer the user a choice between two execution approaches.

View source
SKILL.md:123In the instructionsOpen original file
- [ ] **Step 5: Commit**```bashgit add tests/path/test.py src/path/file.pygit commit -m "feat: add specific feature"```````
SKILL.md:153In the instructionsOpen original file
## Execution HandoffAfter saving the plan, offer execution choice:**"Plan complete and saved to `docs/superpowers/plans/<filename>.md`. Two execution options:****1. Subagent-Driven (recommended)** - I dispatch a fresh subagent per task, review between tasks, fast iteration**2. Inline Execution** - Execute tasks in this session using executing-plans, batch execution with checkpoints**Which approach?"**

The separate reviewer file is a subagent prompt template inside a fenced code block, not automatic execution logic; the main Skill also explicitly says its self-review checklist is not a subagent dispatch.

View source
plan-document-reviewer-prompt.md:3In the instructionsOpen original file
Use this template when dispatching a plan document reviewer subagent.**Purpose:** Verify the plan is complete, matches the spec, and has proper task decomposition.**Dispatch after:** The complete plan is written.```Subagent (general-purpose):
SKILL.md:141In the instructionsOpen original file
## Self-ReviewAfter writing the complete plan, look at the spec with fresh eyes and check the plan against it. This is a checklist you run yourself — not a subagent dispatch.
Start here · InstructionsSKILL.md
writing-plans
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 2 more sections are available in the original file.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • plan-document-reviewer-prompt.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • plan-document-reviewer-prompt.mdSupporting file

Operations mentioned in code and instructions

Run commands
SKILL.md:125In the instructionsOpen original file
```bashgit add tests/path/test.py src/path/file.py
Lines read
222
File checksum (to compare versions)
e608c19cd8802acc2c3a35376073c5dfbd11b3e26588a185f404fc1cabbd8c4d