Skills managing-workflow

📦

managing-workflow

Name: managing-workflow
Author: BrendanShields

Content revision r1 High Risk ⚙️ External commands📁 Filesystem access🔑 Env variables

Guide Specification Workflow

Feature work can lose scope, status, and review checkpoints across long sessions. This skill guides specification, planning, tasks, validation, and archiving with local artifacts.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "managing-workflow" from https://skillstore.io/skills/brendanshields-managing-workflow.md and its manifest at https://skillstore.io/api/skills/brendanshields-managing-workflow/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/brendanshields-managing-workflow.md Signed manifest GET /api/skills/brendanshields-managing-workflow/manifest Signed lockfile GET /api/skills/brendanshields-managing-workflow/lockfile

Test it

Using "managing-workflow". Start a new feature for password reset emails.

Expected outcome:

Creates a scoped feature record, asks for missing requirements, drafts user stories, and prepares review-ready specification artifacts.

Using "managing-workflow". Continue the active checkout redesign work.

Expected outcome:

Loads the current feature status, identifies the next phase, and recommends the next required action before implementation.

Using "managing-workflow". This feature is done. Close it out.

Expected outcome:

Checks remaining tasks, updates completion status, logs activity, and offers to archive the completed feature.

Security Audit

High Risk

v8 • 7/5/2026 Open versioned report

Most external-command alerts are false positives from Markdown backticks, Bash examples, or JavaScript template literals. The real risk is unvalidated path arguments in helper scripts. They can read, write, append to, or move workflow files; no network exfiltration or prompt injection was found.

Files scanned

917

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

scripts/archive-feature.js:8-17 scripts/archive-feature.js:63-75 scripts/update-status.js:7-19 scripts/log-activity.js:7-69 scripts/validate-phase.js:9-56

Unvalidated Workflow Paths Can Modify Files Outside .spec

Helper scripts accept CLI paths or feature identifiers and use them in read, write, and rename operations without normalizing or enforcing the project .spec boundary. A crafted path could update, append to, or move files outside the intended workflow artifacts.

The scripts take path-like values from process.argv and then call fs.readFile, fs.writeFile, or fs.rename without path normalization or containment checks. This is direct evidence of a path-boundary weakness, though exploitation depends on who controls script arguments.

Capability review items (11)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/archive-feature.js:75

Node.js fs operations

await fs.rename(featureDir, targetPath);

The script renames a feature directory derived from caller input into the archive. A traversal featureId could move a directory outside the intended workflow area.

High

scripts/log-activity.js:69

Node.js fs operations

await fs.writeFile(metricsPath, newContent);

metricsPath is taken directly from process.argv and written without path containment. A crafted path could append workflow text to an unintended file.

High

scripts/update-status.js:19

Node.js fs operations

await fs.writeFile(filePath, updatedContent);

filePath is taken directly from process.argv and written without path containment. This can modify unintended files if an unsafe path is supplied.

Medium

scripts/archive-feature.js:45

Node.js fs operations

let content = await fs.readFile(specPath, 'utf-8');

The script reads a spec path derived from the caller-controlled featureId. If featureId escapes the .spec/features boundary, this can read an unintended file.

Medium

scripts/archive-feature.js:63

Node.js fs operations

await fs.writeFile(specPath, content);

The script writes back to a spec path derived from the caller-controlled featureId. Missing path normalization makes unintended file modification possible.

Medium

scripts/log-activity.js:28

Node.js fs operations

const content = await fs.readFile(metricsPath, 'utf-8');

metricsPath is taken directly from process.argv and read without path containment. The intended use is metrics.md, but the script does not enforce that boundary.

Medium

scripts/update-status.js:15

Node.js fs operations

const content = await fs.readFile(filePath, 'utf-8');

filePath is taken directly from process.argv and read without path containment. The intended target is spec.md, but the script accepts any readable path.

Medium

scripts/validate-phase.js:39

Node.js fs operations

const content = await fs.readFile(specPath, 'utf-8');

The validation script reads a spec path derived from caller-supplied featureDir. It appears read-only, but no boundary check prevents validating files outside the workflow directory.

Medium

scripts/validate-phase.js:56

Node.js fs operations

const content = await fs.readFile(tasksPath, 'utf-8');

The validation script reads tasks.md under caller-supplied featureDir. It appears read-only, but no containment check restricts the path to .spec features.

Low

scripts/archive-feature.js:21

Node.js fs stat operations

await fs.access(featureDir);

featureId comes from process.argv and is joined into a filesystem path before this access check. Without containment validation, a traversal value could probe paths outside the intended feature directory.

Low

scripts/log-activity.js:20

Node.js fs stat operations

await fs.access(metricsPath);

metricsPath is taken directly from process.argv and checked without path containment. This can probe arbitrary local paths if a caller supplies an unsafe path.

Risk Factors

⚙️ External commands (106)

scripts/archive-feature.js:37 scripts/archive-feature.js:60 scripts/archive-feature.js:65 scripts/archive-feature.js:76 scripts/archive-feature.js:78 scripts/log-activity.js:16 scripts/log-activity.js:24 scripts/log-activity.js:55 scripts/log-activity.js:58 scripts/log-activity.js:62 scripts/log-activity.js:66 scripts/log-activity.js:70 scripts/log-activity.js:73 scripts/update-status.js:16 scripts/update-status.js:17 scripts/update-status.js:20 scripts/update-status.js:22 scripts/validate-phase.js:50 SKILL.md:27-29 SKILL.md:29-32 SKILL.md:32-33 SKILL.md:33-34 SKILL.md:34-35 SKILL.md:35-36 SKILL.md:36-43 SKILL.md:43-47 SKILL.md:47-48 SKILL.md:48-49 SKILL.md:49-50 SKILL.md:50-51 SKILL.md:51 SKILL.md:52 SKILL.md:58-74 SKILL.md:74-80 SKILL.md:80-88 SKILL.md:88-96 SKILL.md:96-106 SKILL.md:106-116 SKILL.md:116-121 SKILL.md:121 SKILL.md:128-129 SKILL.md:129-138 SKILL.md:138-141 SKILL.md:141-143 SKILL.md:143-146 SKILL.md:146-147 SKILL.md:147-149 SKILL.md:149-153 SKILL.md:153-189 SKILL.md:189-193 SKILL.md:193-209 SKILL.md:209-211 SKILL.md:211-219 SKILL.md:219-220 SKILL.md:220-222 SKILL.md:222 SKILL.md:227-230 SKILL.md:230-232 SKILL.md:232-245 SKILL.md:245-247 SKILL.md:247-252 SKILL.md:252-283 SKILL.md:283-290 SKILL.md:290-297 SKILL.md:297-299 SKILL.md:299 SKILL.md:301-303 SKILL.md:303-304 SKILL.md:304-309 SKILL.md:309-330 SKILL.md:330-331 SKILL.md:331-332 SKILL.md:332-333 SKILL.md:333-334 SKILL.md:334-340 SKILL.md:340-351 SKILL.md:351-353 SKILL.md:353-355 SKILL.md:355-364 SKILL.md:364-367 SKILL.md:367-368 SKILL.md:368-372 SKILL.md:372-374 SKILL.md:374-383 SKILL.md:383-395 SKILL.md:395-397 SKILL.md:397-401 SKILL.md:401-408 SKILL.md:408-414 SKILL.md:414-422 SKILL.md:422-430 SKILL.md:430-431 SKILL.md:431-438 SKILL.md:438-447 SKILL.md:447-450 SKILL.md:450-461 SKILL.md:461-464 SKILL.md:464-473 SKILL.md:98-99 SKILL.md:102 SKILL.md:103 SKILL.md:342-343 SKILL.md:346 SKILL.md:347 SKILL.md:96-106 SKILL.md:340-351

📁 Filesystem access (21)

🔑 Env variables (2)

scripts/context-loader.js:10 scripts/context-loader.js:10

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/brendanshields-managing-workflow/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/brendanshields-managing-workflow/security.svg)](https://skillstore.io/skills/brendanshields-managing-workflow?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/brendanshields-managing-workflow?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/brendanshields-managing-workflow/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/brendanshields-managing-workflow.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

BrendanShields. (2026). managing-workflow security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/brendanshields-managing-workflow/audits/8

BibTeX citation

@techreport{brendanshields-brendanshields-managing-workflow-2026,
  author = {BrendanShields},
  title = {managing-workflow security audit report (audit version 8)},
  institution = {Skillstore},
  year = {2026},
  number = {8},
  url = {https://skillstore.io/skills/brendanshields-managing-workflow/audits/8},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "managing-workflow security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
  - name: "BrendanShields"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/brendanshields-managing-workflow/audits/8"
identifiers:
  - type: other
    value: "skillstore:brendanshields-managing-workflow:audit:8"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Start a Feature With Clear Scope

Create a feature specification, acceptance criteria, and tracking files before implementation begins.

Coordinate Review Gates

Move work through specification, planning, tasks, and implementation with explicit approval points.

Resume Long AI Coding Sessions

Load current status from artifacts and continue from the correct workflow phase.

Try These Prompts

Start a New Feature

Use the managing-workflow skill to start a new feature for: [short feature description]. Ask me for any missing scope details.

Create the Technical Plan

Use the managing-workflow skill to review the current spec, resolve any clarification tags, and create a technical plan.

Prepare Implementation Tasks

Use the managing-workflow skill to validate the plan and create implementation tasks with dependencies and priority labels.

Validate and Archive Work

Use the managing-workflow skill to validate completion, update progress, identify repeatable tooling opportunities, and archive the feature if approved.

Best Practices

Review each generated artifact before approving the next phase.
Keep feature names short and path-safe before creating artifacts.
Use the quick templates only for small, low-risk changes.

Avoid

Skipping plan and task artifacts before implementation.
Marking work complete while unchecked tasks remain.
Using vague feature descriptions that cannot produce testable acceptance criteria.