Skip to content
Back to skills

Aidd Core

ASecurity

Core runtime policy for AIDD skills (pack-first, output contract, DocOps).

  • 5 stars
  • 0 votes
  • 0 copies
  • 2 views
  • Added February 9, 2026
documentation

Security analysis

A100/100

Pro scans all 2 files and shows the line behind each finding

Scanned February 12, 2026

npx -y skills add GrinRus/ai_driven_dev --skill aidd-core --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Aidd Core?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Aidd Core
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/grinrus-aidd-core/badge)](https://www.skillsdirectory.com/skills/grinrus-aidd-core)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: aidd-core
description: Core runtime policy for AIDD skills (pack-first, output contract, DocOps).
lang: en
model: inherit
user-invocable: false
---

## Pack-first / read budget
- Read packs and excerpts before full documents.
- Slice-first rule: for markdown sources use block refs (`path#AIDD:SECTION`, `path@handoff:<id>`) via the `md-slice` wrapper before full Read.
- Full-file Read is allowed only when the slice is insufficient; record the reason in `AIDD:READ_LOG`.
- Prefer RLM packs and slices for research evidence.
- Use the read budget: avoid large logs/diffs; link to `aidd/reports/**` instead.

## Output contract (required)
- Status: ...
- Work item key: ...
- Artifacts updated: ...
- Tests: ...
- Blockers/Handoff: ...
- Next actions: ...
- AIDD:READ_LOG: ... (packs/excerpts only)
- AIDD:ACTIONS_LOG: ... (loop stages) / n/a (planning)

Include `Checkbox updated: ...` when the stage or agent expects it.

## DocOps policy v1 (stage-scoped)
- Loop stages (implement/review/qa/status): do not directly Edit/Write `aidd/docs/tasklist/**` or `aidd/reports/context/**`. Use actions/intents and DocOps automation only; do not manually edit or regenerate context packs. `aidd/docs/.active.json` is command-owned; subagents must not edit it.
- Planning stages (idea/research/plan/tasks/spec): direct Edit/Write is allowed for creation or major edits. Structured sections (progress/iterations/next3) are DocOps-managed; leave untouched unless explicitly instructed.

## Progressive disclosure
- Use `skills/aidd-core/scripts/context_expand.sh` to expand `readmap/writemap` with explicit `reason_code` + `reason`.
- Write-boundary expansion requires explicit `--expand-write` and must leave an audit trace under `aidd/reports/actions/<ticket>/<scope_key>/context-expand.audit.jsonl`.

## Actions log
- Loop stages MUST output `AIDD:ACTIONS_LOG: <path>` and keep the file updated.
- Status is read-only: reference the most recent actions log without modifying it.
- Planning stages may use `AIDD:ACTIONS_LOG: n/a`.

## Question format
Use this exact format when you must ask the user:

```
Question N (Blocker|Clarification): ...
Why: ...
Options: A) ... B) ...
Default: ...
```

## Subagent guard
Subagents must never edit `aidd/docs/.active.json`. If it happens or is required, stop and return BLOCKED with the offending path.

Files in this skill

  • SKILL.md2.3 KB
  • scripts/context_expand.sh2.4 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.