Code 1.0.4

Coding workflow with planning, implementation, verification, and testing for clean software development.

Security Scan

The skill's instructions are generally coherent for a local coding workflow, but metadata mismatches and a few ambiguous instructions (about 'executing' steps and what parts of a project may be read) create unexplained risks you should verify before installing.

Purpose & Capability

The name/description (coding workflow, planning, verification) matches the included instruction files that focus on planning, execution guidance, verification, and storing user preferences in ~/code. However, there are inconsistencies in the package metadata: the registry owner ID and the _meta.json ownerId do not match, and version numbers differ (skill is labeled 1.0.4 in files but registry metadata shows 1.0.0). Those mismatches are unexplained and could indicate packaging or provenance issues.

Instruction Scope

SKILL.md and supporting files keep scope local and user-driven: they instruct reading ~/code/memory.md and the user's project, only store preferences on explicit request, and declare no network access. A potential ambiguity: execution.md says 'When user approves a step: 1. Execute that step' — it's not explicit whether 'execute' means 'perform guidance actions (create files, run commands) on the host' or simply 'describe how to execute'. That ambiguity affects whether the agent might run commands in the project (with user approval) and should be clarified. Otherwise the instructions avoid reading unrelated system files and avoid autonomous actions.

Install Mechanism

No install spec and no code files — instruction-only skill. That is the lowest-risk install pattern (nothing is downloaded or written by an installer). The skill does mention creating ~/code on first use, which is a benign, explicit file-system write if the user consents.

Credentials

The skill requests no environment variables, no credentials, and no config paths beyond ~/code/memory.md. That is proportionate for a local coding workflow assistant.

Persistence & Privilege

always:false and no special privileges are requested. The skill intends to persist only a user-managed ~/code/memory.md file on explicit user request. It does not claim to modify other skills or system-wide settings.

What to consider before installing

This skill looks like a sensible, local coding-workflow guide, but there are a few things to check before installing or trusting it: 1) Metadata mismatch — the owner ID and version strings differ between the registry and the included _meta.json; ask the publisher or registry to explain and confirm provenance. 2) Clarify the meaning of 'Execute that step' — confirm whether the agent will only provide command text or whether it may actually run commands on your machine (even with your approval). 3) Remember the skill will create ~/code and may read your project files to provide contextual guidance; avoid running it in environments with sensitive secrets unless you review what the agent is asked to read. 4) Prefer skills with verifiable authorship (known owner, linked homepage or repository) if you need higher assurance. If you want, ask the publisher to fix the metadata inconsistencies and to explicitly state whether the agent will run commands or only provide instructions.

When to Use

User explicitly requests code implementation. Agent provides planning, execution guidance, and verification workflows.

Architecture

User preferences stored in ~/code/ when user explicitly requests.

~/code/
  - memory.md    # User-provided preferences only

Create on first use: mkdir -p ~/code

Quick Reference

Topic	File
Memory setup	memory-template.md
Task breakdown	planning.md
Execution flow	execution.md
Verification	verification.md
Multi-task state	state.md
User criteria	criteria.md

Scope

This skill ONLY:

• Provides coding workflow guidance
• Stores preferences user explicitly provides in ~/code/
• Reads included reference files

This skill NEVER:

• Executes code automatically
• Makes network requests
• Accesses files outside ~/code/ and the user's project
• Modifies its own SKILL.md or auxiliary files
• Takes autonomous action without user awareness

Core Rules

1. Check Memory First

Read ~/code/memory.md for user's stated preferences if it exists.

2. User Controls Execution

• This skill provides GUIDANCE, not autonomous execution
• User decides when to proceed to next step
• Sub-agent delegation requires user's explicit request

3. Plan Before Code

• Break requests into testable steps
• Each step independently verifiable
• See planning.md for patterns

4. Verify Everything

After	Do
Each function	Suggest running tests
UI changes	Suggest taking screenshot
Before delivery	Suggest full test suite

5. Store Preferences on Request

User says	Action
"Remember I prefer X"	Add to memory.md
"Never do Y again"	Add to memory.md Never section

Only store what user explicitly asks to save.

Workflow

Request -> Plan -> Execute -> Verify -> Deliver

Common Traps

• Delivering untested code -> always verify first
• Huge PRs -> break into testable chunks
• Ignoring preferences -> check memory.md first

Self-Modification

This skill NEVER modifies its own SKILL.md or auxiliary files. User data stored only in ~/code/memory.md after explicit request.

External Endpoints

This skill makes NO network requests.

Endpoint	Data Sent	Purpose
None	None	N/A

Security & Privacy

Data that stays local:

• Only preferences user explicitly asks to save
• Stored in ~/code/memory.md

Data that leaves your machine:

• None. This skill makes no network requests.

This skill does NOT:

• Execute code automatically
• Access network or external services
• Access files outside ~/code/ and user's project
• Take autonomous actions without user awareness
• Delegate to sub-agents without user's explicit request