PlanSuite

Create, finalize, and execute detailed project plans with sub-plans, checkpoints, progress tracking, and change control across sessions using file-based work...

Security Scan

This is an instruction-only planning/workflow skill that only reads/writes three local files and contains no installs or credential requests; it appears coherent for its stated purpose, though registry/metadata inconsistencies and a few minor operational notes warrant caution.

Purpose & Capability

The SKILL.md describes a local file-based planning and execution workflow (task_plan.md, progress.md, findings.md). All instructions (create templates, freeze status, update progress/findings, use isolated sessions) align with that purpose. However, the package metadata is incomplete: there is no description/homepage/source, and _meta.json values (ownerId, version, publishedAt) don't match the registry metadata (ownerId and version differ). These metadata inconsistencies are administrative issues that don't change functionality but reduce trust.

Instruction Scope

Runtime instructions are narrowly scoped: create/maintain three files in the current working directory, follow a freeze/execute/change-control workflow, and optionally spawn an isolated session (SKILL.md references 'sessions_spawn'). The skill does not instruct reading unrelated system files, accessing environment variables, or contacting external endpoints. The only behavioral effect is file creation and modification in the current working directory (explicitly required by the workflow).

Install Mechanism

No install spec and no code files — the skill is instruction-only. There is nothing to download or execute, so there is low install risk.

Credentials

The skill requests no environment variables, no credentials, and no config paths. That is proportionate to a local planning workflow. Note: because it writes files in the current working directory, it can overwrite local files if run in a sensitive folder — the SKILL.md does advise creating/using these files but does not warn about overwriting existing unrelated files.

Persistence & Privilege

The skill is not set to always:true and does not ask to persist credentials or modify other skills/system-wide settings. It suggests using 'sessions_spawn' to create isolated sessions, which is a runtime behavior but not inherently privileged. Autonomous invocation (disable-model-invocation: false) is the platform default and expected.

Assessment

This skill is largely safe and consistent: it only creates and maintains three local files to manage plans and execution checkpoints and asks for no credentials. Before installing/using it: 1) verify the source/owner (registry metadata lacks description and homepage and _meta.json metadata doesn't match the registry owner/version), 2) run it from a dedicated project directory (to avoid accidental overwrites of unrelated files), 3) confirm what 'sessions_spawn' does on your platform (it suggests creating an isolated execution session — check its privileges), and 4) if you need provenance, ask the publisher for a homepage or repo. If those checks are satisfactory, the skill's behavior is coherent with its purpose.

把“写计划（含子计划）→ 冻结计划（变更控制）→ 独立会话执行（带检查点）”合成一个最小可用流程。

文件结构（在当前工作目录创建/维护）

• task_plan.md：计划主文件（含子计划/里程碑）
• progress.md：执行进度（每次推进都要写）
• findings.md：发现/决策/坑点（避免重复踩坑）

不要把这三份写到聊天里：写到文件，才能恢复/续跑。

工作流（强约束，防跑偏）

0) 初始化（第一次做这个项目）

1. 如果缺文件：用模板创建 task_plan.md/progress.md/findings.md（见 templates/）。
2. 让用户确认目标、范围、约束、完成定义（DoD）。

1) 计划阶段（拆子计划）

在 task_plan.md 里输出：

• 背景/目标
• 范围（做/不做）
• 风险 & 回滚
• 子计划（Milestones）：每个子计划要有
  • 输入/输出
  • 验收标准
  • 预计工具调用/文件改动
  • 风险与回滚点

2) 冻结阶段（FINALIZED）

只有当用户明确说“按这个计划执行”后：

1. 在 task_plan.md 顶部写入：STATUS: FINALIZED + 时间戳。
2. 把“接下来要执行的子计划编号/名称”写入 progress.md 的 Next。

规则：未 FINALIZED 不允许进入执行阶段（最多做调查/补充计划）。

3) 执行阶段（独立会话 + 检查点）

当进入执行：

1. 建议用 sessions_spawn 开一个隔离执行会话（避免污染主会话上下文）。
2. 每完成一个子计划：
   • 更新 progress.md（Done/Next/Blockers）
   • 更新 findings.md（关键决策、踩坑、验证命令、回滚步骤）
3. 检查点策略（默认每个子计划至少一次）：
   • 执行前：复述子计划的 DoD + 风险 + 回滚
   • 执行后：给出验证步骤 + 结果

4) 变更控制（计划变更）

如果执行中发现计划不成立：

1. 不要“边做边改”。先写入 findings.md，再把变更提案写入 task_plan.md。
2. 把 STATUS 改为 DRAFT，等待用户重新确认。

你在什么时候用什么文件

• 需要问清楚/拆任务 → task_plan.md
• 需要告诉用户进度/下一步 → progress.md
• 需要记录结论/命令/坑/回滚 → findings.md

模板

• templates/task_plan.md
• templates/progress.md
• templates/findings.md