skilld
All skills
bitwarden avatar

/work-breakdown

@faf72be official
by bitwardenbitwarden/ai-plugins155 stars
20

Break down features and requirements into actionable, implementable tasks with clear scope and acceptance criteria. Use when planning implementation, organizing complex work, or creating task lists. Trigger phrases: "break down tasks", "create work plan", "organize implementation", "plan development". This skill works best when preceded by `requirements-elicitation` skill use.

  • 2 files
  • 14.9 KB
  • Updated 7 months ago
  • GitHub

Ask your Agent

Use this Skill: https://skilld.dev/gh/bitwarden/ai-plugins/work-breakdown

This session only. Nothing lands on disk.

examplesoauth-authentication.md

≈2.3k tokens on demand. Your agent reads this file only when SKILL.md points to it.

Example: OAuth Authentication Feature

Context: Implement OAuth authentication with Google and GitHub providers for Bitwarden

Phase 1: Architecture & Design

Task 1.1: Design OAuth authentication flow

  • Description: Create sequence diagrams for OAuth login, token refresh, and logout flows
  • Team/Role: Backend architecture team
  • Estimated Duration: 3-4 hours
  • Dependencies: None
  • Deliverables:
    • Authentication flow diagrams (Mermaid format)
    • State management design
    • Error handling strategy
  • Acceptance Criteria:
    • Covers Google and GitHub OAuth flows
    • Includes token refresh and expiration handling
    • Addresses security principle P05 (Controlled Access to Vault Data)

Task 1.2: Design database schema for OAuth users and sessions

  • Description: Define database schema for storing OAuth provider information, user mappings, and session tokens
  • Team/Role: Backend architecture team
  • Estimated Duration: 2-3 hours
  • Dependencies: None
  • Deliverables:
    • Schema definition (SQL)
    • Index specifications
    • Migration script outline
  • Acceptance Criteria:
    • Normalized schema, no redundant data
    • Protected Data encrypted at rest (P02)
    • Supports multiple OAuth providers per user

Task 1.3: Security threat modeling for OAuth integration

  • Description: Conduct threat modeling session to identify OAuth-specific security risks
  • Team/Role: Security team (can use Skill(threat-modeling) if available)
  • Estimated Duration: 3-4 hours
  • Dependencies: Task 1.1 complete (need flow diagrams)
  • Deliverables:
    • Security definition document
    • Threat catalog with STRIDE analysis
    • Mitigation requirements
  • Acceptance Criteria:
    • Addresses token storage security
    • Covers CSRF, token replay, and session hijacking threats
    • Defines secure channel requirements (P01 Zero Knowledge maintained)

Phase 2: Implementation

Task 2.1: Implement OAuth client library integration

  • Description: Integrate OAuth client libraries for Google and GitHub, implement authorization code flow
  • Team/Role: Backend implementation team
  • Estimated Duration: 6-8 hours
  • Dependencies: Task 1.1, Task 1.3 (need flow design and security requirements)
  • Deliverables:
    • OAuth client wrapper classes
    • Configuration management for client IDs/secrets
    • Authorization request and callback handlers
  • Acceptance Criteria:
    • Can initiate OAuth flow with Google and GitHub
    • Handles authorization callbacks correctly
    • Implements PKCE for additional security

Task 2.2: Implement user session management

  • Description: Create session middleware to manage OAuth tokens, refresh logic, and user authentication state
  • Team/Role: Backend implementation team
  • Estimated Duration: 4-6 hours
  • Dependencies: Task 1.2, Task 2.1 (need schema and OAuth client)
  • Deliverables:
    • Session middleware
    • Token storage and retrieval logic
    • Automatic token refresh implementation
  • Acceptance Criteria:
    • Sessions persist across requests
    • Tokens refresh automatically before expiration
    • Encrypted token storage (P02)

Task 2.3: Implement authentication middleware

  • Description: Create middleware to protect routes requiring authentication, verify OAuth tokens
  • Team/Role: Backend implementation team
  • Estimated Duration: 3-4 hours
  • Dependencies: Task 2.2 (need session management)
  • Deliverables:
    • Authentication middleware
    • Route protection decorators
    • Unauthorized access handling
  • Acceptance Criteria:
    • Protected routes require valid OAuth authentication
    • Returns 401 for unauthenticated requests
    • Returns 403 for unauthorized access attempts

Task 2.4: Create OAuth login UI components

  • Description: Build UI components for OAuth provider selection and login flow
  • Team/Role: Frontend implementation team
  • Estimated Duration: 4-5 hours
  • Dependencies: Task 2.1 (need backend OAuth endpoints)
  • Deliverables:
    • Login page with provider buttons
    • OAuth callback handling UI
    • Error messaging UI
  • Acceptance Criteria:
    • Displays Google and GitHub login options
    • Handles OAuth redirects properly
    • Shows clear error messages for failed authentication

Task 2.5: Implement user account linking

  • Description: Allow existing users to link OAuth providers to their accounts
  • Team/Role: Backend implementation team
  • Estimated Duration: 5-6 hours
  • Dependencies: Task 2.2, Task 2.3 (need session and auth middleware)
  • Deliverables:
    • Account linking endpoints
    • Provider management UI backend
    • Unlinking functionality
  • Acceptance Criteria:
    • Users can link multiple OAuth providers
    • Can unlink providers (if not sole login method)
    • Existing vault data remains accessible

Phase 3: Testing

Task 3.1: Write OAuth integration unit tests

  • Description: Create comprehensive unit tests for OAuth client, session management, and authentication middleware
  • Team/Role: QA team / Backend team
  • Estimated Duration: 5-6 hours
  • Dependencies: Phase 2 implementation tasks complete
  • Deliverables:
    • Unit test suite with >85% code coverage
    • Mock OAuth provider responses
    • Token lifecycle tests
  • Acceptance Criteria:
    • All OAuth flows tested (login, refresh, logout)
    • Error scenarios covered (invalid tokens, expired tokens, provider errors)
    • Security checks validated (CSRF, token encryption)

Task 3.2: Create OAuth integration end-to-end tests

  • Description: Build automated E2E tests using test OAuth providers
  • Team/Role: QA team
  • Estimated Duration: 6-8 hours
  • Dependencies: Task 3.1, Phase 2 complete
  • Deliverables:
    • E2E test suite for OAuth flows
    • Test OAuth provider configurations
    • Cross-browser test coverage
  • Acceptance Criteria:
    • Complete login/logout flows tested
    • Account linking flows tested
    • Error handling verified
    • Tests run on Chrome, Firefox, Safari

Task 3.3: Manual cross-platform testing

  • Description: Manually test OAuth on all Bitwarden clients (web, desktop, mobile)
  • Team/Role: QA team
  • Estimated Duration: 4-5 hours
  • Dependencies: Phase 2 complete, Task 3.2 (automated tests pass)
  • Deliverables:
    • Test execution report
    • Bug tracking for any issues found
    • Platform-specific behavior documentation
  • Acceptance Criteria:
    • OAuth works on web vault, desktop apps (Windows, macOS, Linux), mobile (iOS, Android)
    • User experience consistent across platforms
    • No regressions in existing authentication

Task 3.4: Security testing and penetration testing

  • Description: Conduct security-focused testing of OAuth implementation
  • Team/Role: Security team
  • Estimated Duration: 6-8 hours
  • Dependencies: Task 3.1, Task 3.2 (functional testing complete)
  • Deliverables:
    • Security test report
    • Penetration test findings
    • Mitigation verification
  • Acceptance Criteria:
    • No high or critical security vulnerabilities found
    • All threat model mitigations verified
    • Token storage encryption validated
    • CSRF protections confirmed

Phase 4: Documentation & Deployment

Task 4.1: Write OAuth setup documentation

  • Description: Create user-facing documentation for setting up and using OAuth login
  • Team/Role: Technical writing team
  • Estimated Duration: 3-4 hours
  • Dependencies: Phase 2 implementation complete
  • Deliverables:
    • User guide for OAuth login
    • Provider configuration instructions
    • Troubleshooting guide
  • Acceptance Criteria:
    • Covers Google and GitHub setup steps
    • Includes screenshots of login flow
    • Addresses common issues

Task 4.2: Create API documentation for OAuth endpoints

  • Description: Document all OAuth-related API endpoints for developer reference
  • Team/Role: Backend team / Technical writing
  • Estimated Duration: 2-3 hours
  • Dependencies: Phase 2 implementation complete
  • Deliverables:
    • API endpoint documentation
    • Request/response examples
    • Error code reference
  • Acceptance Criteria:
    • All endpoints documented with examples
    • Authentication requirements specified
    • Rate limits and constraints noted

Task 4.3: Prepare deployment and migration procedures

  • Description: Create deployment scripts, database migrations, and rollout plan
  • Team/Role: DevOps team
  • Estimated Duration: 4-5 hours
  • Dependencies: Phase 2 complete, Task 3.1-3.4 (all testing passed)
  • Deliverables:
    • Database migration scripts
    • Deployment runbook
    • Rollback procedures
  • Acceptance Criteria:
    • Migrations tested on staging environment
    • Zero-downtime deployment plan
    • Rollback tested and verified

Why This Breakdown Works:

  • ✅ Each task is 2-8 hours (right-sized for tracking)
  • ✅ Clear dependencies prevent blocking and enable parallel work
  • ✅ Phases group related work logically
  • ✅ Each task has specific team assignment and acceptance criteria
  • ✅ Can be implemented and tested incrementally
  • ✅ Security considerations integrated throughout
  • ✅ Documentation and deployment explicitly planned

Source: SKILL.md on GitHub

Third-party checks

No third-party reports yet.

Provenance

Signed by skilld at faf72be. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub yesterday.

Activeupdated 7 months ago

Topics

  • work-breakdown
  • project-planning
  • task-management
  • requirements
  • agile
  • scope-definition
  • dependencies
  • acceptance-criteria

README badge

README badge for bitwarden/ai-plugins/work-breakdown

What it does

Breaks down features and requirements into right-sized, implementable tasks organized by phase, with clear dependencies and acceptance criteria. Designed for planning complex work in Bitwarden's multi-platform environment (web, mobile, CLI, browser extensions) and works best after requirements elicitation.

Generated from the current SKILL.md.

Frequently asked

What's the difference between this skill and general project planning?
This skill is tailored to breaking down software features and requirements into right-sized implementation tasks (2-8 hours each) with explicit dependencies, acceptance criteria, and team assignments. It assumes you're planning code work, not general project management.
Does this skill work standalone or does it need other skills?
It works best when preceded by the `requirements-elicitation` skill, which gathers and clarifies the requirements that this skill then breaks into tasks.
What if I don't know the team structure or roles ahead of time?
The skill uses role templates (Backend, Frontend, Security, QA, DevOps) as placeholders. You can adapt these to your actual team structure or leave them generic if roles aren't yet assigned.
How does this handle tasks that can't fit into 2-8 hours?
The skill instructs you to break oversized tasks down further rather than accept them as-is. Tasks larger than one full day should be subdivided into smaller, independently testable units.

Generated from the current SKILL.md. These answers refresh after source changes.