Install
$ agentstack add skill-rustyrazorblade-skills-implement ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
implement — build the approved spec, open a PR
You are the PM/lead in the main session. The owner has approved the committed spec for issue #N. Drive the implementation team to completion and open a review-ready PR. The team runs as a background Workflow — invoking this skill is the owner's explicit opt-in to that orchestration (it may spawn several subagents).
Input: an issue number #N. Its worktree is .claude/worktrees/issue--, branch issue--, OpenSpec change ``.
Steps
- Confirm the precondition. The issue must be
status:spec-reviewAND the owner must
have approved. If you can't confirm approval from the conversation, ask before proceeding. Flip the label to in-progress: ``bash gh issue edit --remove-label status:spec-review --add-label status:in-progress ``
- Check the test precondition. The full test suite is the gate. If the suite has **external
prerequisites** (e.g. a docker compose stack, a database, a broker), probe their reachability and decide full-vs-degraded. For example: ``bash # Example probe for a repo whose tests need Docker + a database on :5432. # Adapt the checks to the repo's actual prerequisites. docker info >/dev/null 2>&1 && nc -z 127.0.0.1 5432 2>/dev/null && echo STACK_UP || echo STACK_DOWN ``
- prerequisites reachable → the team runs the full suite as the gate (
stackUp: true). - prerequisites unreachable → consider bringing them up if appropriate; otherwise the team
degrades to a build + prerequisite-independent unit tests and must say so in its report and the PR body (stackUp: false). Never silent. If the suite has no external prerequisites, pass stackUp: true.
- Run the implementation Workflow. Invoke the
Workflowtool with the script bundled in
this plugin and pass args: ``json { "scriptPath": "${CLAUDE_PLUGIN_ROOT}/skills/implement/implement.workflow.js", "args": { "worktree": "/.claude/worktrees/issue--", "repoRoot": "", "change": "", "issue": , "base": "origin/main", "stackUp": true, "buildSystem": "auto" } } ` buildSystem is a hint for the build phase — the project's build tool (cargo, gradle, npm, go, pytest, …) or "auto" to let the build-engineer discover the real runner from the repo. It is NOT an exhaustive switch; the agents detect the actual commands. The script: tdd-developer applies the OpenSpec tasks test-first → a **five-lens review panel** reviews the diff in parallel (spec-conformance + repo rules; the built-in /code-review correctness lens; the built-in /security-review lens, which self-gates to security-relevant surfaces; the test-rigor-reviewer lens for antagonistic/regression-exposing test coverage; the observability-reviewer lens for prod-diagnosability of new paths/failures, which self-gates) → fix loop until **every** lens approves with no blocker/major (bounded) → build-engineer gets the build clean (format/lint/build) → docs polish. It returns a summary (tests ran full/degraded, review verdict, residual findings). See docs/workflow.md` ("Review panel") for the lens semantics.
- Push and open the PR (outward-facing — done here in the main session, narrated):
```bash git -C push -u origin issue-- gh pr create --head issue-- --base main \ --title "" \ --body "Closes #
" ```
- Mark in-review and report.
``bash gh issue edit --remove-label status:in-progress --add-label status:in-review ` Give the owner the PR URL for GitHub review (Seam 2). When they leave comments, the next step is /spec-flow:address ; after they squash-merge, /spec-flow:finalize `.
Rules
- Never merge, never push to
main. This skill only pushes the issue branch and opens a PR. - A degraded test run (full suite's prerequisites unavailable) must be explicit in the PR body.
- If the review panel can't reach
approvewithin the bounded fix loop, stop and surface the
residual findings to the owner rather than opening a green-looking PR.
- All code work happens in the worktree; the main session only orchestrates, pushes, and PRs.
- When you cite an issue/PR number, always pair it with a brief
(description).
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: rustyrazorblade
- Source: rustyrazorblade/skills
- License: Apache-2.0
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.