8Dionysus/aoa-dry-run-first
skills/risk/aoa-dry-run-first/SKILL.md
--- name: aoa-dry-run-first scope: risk status: canonical summary: Prefer simulation, inspection, or preview paths before real execution, and require one explicit confirmation seam before any mutating step runs. invocation_mode: explicit-only technique_dependencies: - AOA-T-0004 - AOA-T-0028 --- # aoa-dry-run-first ## Intent Use this skill to run a preview-first workflow that stops at inspection until one concrete mutation is ready, then asks for a visible confirmation before the real act
$ install --global
skillsauthnpx skillsauth add 8Dionysus/aoa-skills aoa-dry-run-firstInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 12, 2026, 4:39 AM252.8s11 files scanned
SKILL.md
- name:
- aoa-dry-run-first
- scope:
- risk
- status:
- canonical
- summary:
- Prefer simulation, inspection, or preview paths before real execution, and require one explicit confirmation seam before any mutating step runs.
- invocation_mode:
- explicit-only
aoa-dry-run-first
Intent
Use this skill to run a preview-first workflow that stops at inspection until one concrete mutation is ready, then asks for a visible confirmation before the real action proceeds.
Trigger boundary
Use this skill when:
- the task can be simulated, previewed, or inspected before real execution
- the action may delete, restore, migrate, reconfigure, or otherwise alter a live surface
- the cost of a mistaken execution is meaningfully higher than the cost of a preview step
- the task needs a clear seam between dry-run evidence and the one confirmed mutating action
Do not use this skill when:
- no meaningful dry-run or preview path exists and the task is already clearly bounded and harmless
- the task is purely analytical and does not approach execution at all
- the central question is whether execution is authorized at all rather than how to preview it; use
aoa-approval-gate-check - the task is only about preparing a sanitized artifact for sharing; use
aoa-sanitized-share
Inputs
- requested action
- available preview or dry-run mechanisms
- touched surfaces
- known limits of the preview path
Outputs
- dry-run or preview recommendation
- bounded preview result or plan
- note on what the preview does and does not prove
- explicit confirmation request for the mutating step when the preview is complete
- recommendation for next step
Procedure
- identify whether a preview, simulation, inspect-only, or dry-run path exists
- prefer the safest bounded preview path before real execution
- make explicit what the preview covers and what it cannot guarantee
- stop at inspection until the mutating step is concrete enough to name
- require one explicit confirmation before any state-changing action runs
- avoid treating dry-run output as proof of total safety
- recommend the next step only after the preview and confirmation seam have both been interpreted
Contracts
- dry-run should reduce uncertainty before execution
- preview results should not be overstated
- lack of a dry-run path should be named as a risk, not hidden
- real execution should not be smuggled into a preview step
- confirmation must name the concrete mutation, not just generic permission
- the mutating step stays singular and bounded after the gate
Risks and anti-patterns
- treating a preview as complete validation
- skipping preview because the real change looks small
- using a fake or weak preview path that does not touch the real risk surface
- blurring inspect-only and execute behavior
- turning the confirmation seam into a vague caution prompt
- chaining extra mutations after the confirmed step without a fresh gate
Verification
- confirm a preview or dry-run path was considered first
- confirm the preview scope was named honestly
- confirm unresolved risk after preview was not hidden
- confirm the preview step did not silently perform the real action
- confirm the explicit confirmation names the exact mutating step
- confirm the recommended next step matches the preview confidence
- confirm the workflow stops after the confirmed mutation instead of widening into a loop
Technique traceability
Manifest-backed techniques:
- AOA-T-0004 from
8Dionysus/aoa-techniquesatcd276f040d55d490bd015b8698c7a5d594b9f875using pathtechniques/execution/intent-chain/intent-plan-dry-run-contract-chain/TECHNIQUE.mdand sections: Intent, When to use, Outputs, Core procedure, Validation - AOA-T-0028 from
8Dionysus/aoa-techniquesatcd276f040d55d490bd015b8698c7a5d594b9f875using pathtechniques/execution/agent-workflows-core/confirmation-gated-mutating-action/TECHNIQUE.mdand sections: Intent, When to use, Outputs, Core procedure, Validation
Adaptation points
Future project overlays may add:
- local preview commands
- dry-run limitations
- restore or recovery expectations
- project-specific inspect-only patterns
Related Skills
8Dionysus/aoa-decision
testing
VerifiedTrustedCommunity
--- name: aoa-decision scope: core status: evaluated summary: Route AoA decision-lane work through the workspace decision graph first, then hand off to the smallest find, create, or correct subskill while keeping repo-local decision files authoritative. invocation_mode: explicit-preferred technique_dependencies: - AOA-T-0033 - AOA-T-0002 --- # aoa-decision ## Intent Use this skill as the front door for AoA `docs/decisions/` work. It decides whether the task is to find, create, or correct
4SKILL.mdUpdated Jun 5, 2026
8Dionysus/aoa-decision-find
testing
VerifiedTrustedCommunity
--- name: aoa-decision-find scope: core status: evaluated summary: Find AoA decision records through the workspace graph, then verify claims against repo-local source notes and generated decision indexes. invocation_mode: explicit-preferred technique_dependencies: - AOA-T-0002 --- # aoa-decision-find ## Intent Use this skill to find decision rationale quickly across AoA repositories while keeping final claims grounded in the owning repository's authored decision note. ## Trigger boundary
4SKILL.mdUpdated Jun 5, 2026
8Dionysus/aoa-decision-create
tools
VerifiedTrustedCommunity
--- name: aoa-decision-create scope: core status: evaluated summary: Create a new AoA decision record in the owning repository by using graph context for placement and repo-local decision law for the actual source note and indexes. invocation_mode: explicit-preferred technique_dependencies: - AOA-T-0033 - AOA-T-0002 --- # aoa-decision-create ## Intent Use this skill when a real structural, workflow, tooling, source/export, or authority decision needs a durable repo-local `docs/decisions/`
4SKILL.mdUpdated Jun 5, 2026
8Dionysus/aoa-decision-correct
development
VerifiedTrustedCommunity
--- name: aoa-decision-correct scope: core status: evaluated summary: Correct, supersede, or reindex AoA decision records by editing source notes first, rebuilding repo-local indexes, and refreshing the workspace decision graph. invocation_mode: explicit-preferred technique_dependencies: - AOA-T-0001 - AOA-T-0033 - AOA-T-0002 --- # aoa-decision-correct ## Intent Use this skill to repair an existing decision record, its index metadata, supersession links, source-surface list, or generate
4SKILL.mdUpdated Jun 5, 2026