Code

Coding workflow with planning, implementation, verification, and testing for clean software development.

Security Scan

This is an instruction-only coding-workflow skill that asks only to read/write a small ~/code/ memory file on explicit user request and otherwise stays local — its requirements and instructions align with its stated purpose.

Purpose & Capability

The name/description (coding workflow, planning, verification, testing) match the files and runtime instructions. There are no unrelated required binaries, env vars, or installs; the only persistent artifact is a user-memory stored at ~/code/memory.md, which is reasonable for a code preferences helper.

Instruction Scope

Instructions are narrowly scoped to provide guidance, consult bundled reference files, read ~/code/memory.md, and access the user's project when needed. 'User's project' is somewhat vague (no explicit path rules), so in practice the agent may be permitted to read project files broadly — this is expected for a coding helper but users should be aware that project files can contain secrets.

Install Mechanism

No install spec and no code files; the skill is instruction-only so nothing is downloaded or written by an installer. This is the lowest-risk install model.

Credentials

The skill requests no environment variables, credentials, or external config paths beyond a user-local ~/code/ directory. This is proportionate to a workspace-preferences/coding-workflow skill.

Persistence & Privilege

always is false, autonomous invocation not disabled (normal). The only persistent change described is writing ~/code/memory.md when the user explicitly requests; the skill states it won't modify its SKILL.md or other auxiliary files. No cross-skill or system-wide configuration changes are requested.

Assessment

This skill appears coherent and low-risk: it only stores explicit user preferences in ~/code/memory.md and otherwise provides local guidance. Before using it, (1) avoid asking it to save secrets or API keys into memory.md, (2) be aware that when you let it read your 'project' it may access any files in that project (which can include credentials or config), and (3) monitor the ~/code/ directory after first use to verify only the expected memory.md is created. If you need stricter guarantees, don't allow it to write files or restrict the project path it may read.

When to Use

User explicitly requests code implementation. Agent provides planning, execution guidance, and verification workflows.

Architecture

User preferences stored in ~/code/ when user explicitly requests.

~/code/
  - memory.md    # User-provided preferences only

Create on first use: mkdir -p ~/code

Quick Reference

Topic	File
Memory setup	memory-template.md
Task breakdown	planning.md
Execution flow	execution.md
Verification	verification.md
Multi-task state	state.md
User criteria	criteria.md

Scope

This skill ONLY:

• Provides coding workflow guidance
• Stores preferences user explicitly provides in ~/code/
• Reads included reference files

This skill NEVER:

• Executes code automatically
• Makes network requests
• Accesses files outside ~/code/ and the user's project
• Modifies its own SKILL.md or auxiliary files
• Takes autonomous action without user awareness

Core Rules

1. Check Memory First

Read ~/code/memory.md for user's stated preferences if it exists.

2. User Controls Execution

• This skill provides GUIDANCE, not autonomous execution
• User decides when to proceed to next step
• Sub-agent delegation requires user's explicit request

3. Plan Before Code

• Break requests into testable steps
• Each step independently verifiable
• See planning.md for patterns

4. Verify Everything

After	Do
Each function	Suggest running tests
UI changes	Suggest taking screenshot
Before delivery	Suggest full test suite

5. Store Preferences on Request

User says	Action
"Remember I prefer X"	Add to memory.md
"Never do Y again"	Add to memory.md Never section

Only store what user explicitly asks to save.

Workflow

Request -> Plan -> Execute -> Verify -> Deliver

Common Traps

• Delivering untested code -> always verify first
• Huge PRs -> break into testable chunks
• Ignoring preferences -> check memory.md first

Self-Modification

This skill NEVER modifies its own SKILL.md or auxiliary files. User data stored only in ~/code/memory.md after explicit request.

External Endpoints

This skill makes NO network requests.

Endpoint	Data Sent	Purpose
None	None	N/A

Security & Privacy

Data that stays local:

• Only preferences user explicitly asks to save
• Stored in ~/code/memory.md

Data that leaves your machine:

• None. This skill makes no network requests.

This skill does NOT:

• Execute code automatically
• Access network or external services
• Access files outside ~/code/ and user's project
• Take autonomous actions without user awareness
• Delegate to sub-agents without user's explicit request