Skip to content
asking-questions logo

Asking Questions

asking-questions

Guidance for asking clarifying questions when user requests are ambiguous, have multiple valid approaches, or require critical decisions. Use when implementation choices exist that could significantly affect outcomes.

SKILL.md

Full skill instructions

Asking Questions

Purpose

Ask clarifying questions when the answer materially changes what you'll build. This skill helps identify when to ask, how to structure questions effectively, and when to proceed autonomously.

When to Use

Ask questions for:

  1. Ambiguous implementation choices - Multiple valid technical approaches (middleware vs wrapper functions, library selection, architectural patterns)
  2. Missing critical context - Specific information needed (database type, deployment platform, credential management)
  3. Potentially destructive actions - Requests that could be interpreted dangerously ("clean up files" = delete vs archive)
  4. Scope clarification - Vague terms like "refactor," "optimize," or "improve"
  5. Conflicting requirements - Goals that may work against each other ("make it faster" + "add extensive logging")
  6. Technical trade-offs - Solutions with different costs/​benefits depending on priorities

When NOT to Use

Don't ask when:

  • Request is clear and unambiguous - One obvious implementation path
  • You can determine the answer from context - Codebase patterns, project structure, existing conventions
  • Over-clarification - Questions that don't materially affect implementation
  • Standard engineering practices - Established patterns already in the codebase

Question Structure

Template

[Context: What you found/​analyzed]

[Present 2-5 specific options with brief trade-offs]

[Direct question asking for preference]

[Optional: Offer to make reasonable default choice]

Guidelines

  1. Acknowledge understanding first - Show you've analyzed the situation

    • "I found your API endpoints and see you're using Express..."
  2. Present clear options - Offer 2-5 specific choices with brief context

    I can implement this in several ways:
    1. **Global middleware** - Catches all errors centrally (simplest)
    2. **Wrapper functions** - More granular control per endpoint
    3. **Custom error classes** - Typed errors with status codes
    
  3. Ask directly - Clear question that guides decision

    • "Which approach fits your needs?"
  4. Offer autonomy (optional) - For less critical decisions

    • "I can implement option 2 as it's the safest, or let me know if you prefer something else."

Progressive Disclosure

Layer questions instead of asking everything upfront:

Good ✓

  • First: "For real-time updates, should I use WebSockets, Server-Sent Events, or polling?"
  • Then: "For WebSockets, do you want Socket.io (easier) or native (lighter)?"

Bad ✗

  • "For real-time updates should I use WebSockets or SSE or polling and if WebSockets should I use Socket.io or native and should I implement reconnection and what about authentication and..."

Examples

Good ✓

"I see you're using JWT authentication. To add refresh tokens, I can:

  1. httpOnly cookies - More secure, harder to XSS
  2. localStorage - Simpler, works with mobile apps
  3. In-memory only - Most secure, lost on refresh

What works best for your use case?"

Bad ✗

"How should I implement the authentication refresh token storage mechanism considering security implications, XSS vulnerabilities, mobile compatibility, UX impacts, and compliance considerations?"

Too verbose, no clear options, asks everything at once


Good ✓

"You mentioned 'clean up migrations.' Do you want me to archive them to /​old-migrations or delete them entirely? (Note: deletion can break databases that haven't run them yet)"

Bad ✗

"What do you mean by clean up?"

Too vague, doesn't guide the decision

After Receiving an Answer

  1. Acknowledge - Confirm you understood their choice
  2. Proceed immediately - Don't ask if they want you to continue
  3. Apply preferences - If they chose "security first" once, lean that direction for similar future choices

Key Principle

Ask only when the answer materially changes what you'll build. Avoid building the wrong thing, not asking questions for the sake of asking.

More Security skills

supabase logo
Security

supabase

Handles the full Supabase workflow from schema changes to deployment, with built-in security guardrails that catch common traps like RLS...

2.7K 308.9K
View

Comprehensive guides and best practices for Neon Serverless Postgres, covering setup, connection methods, authentication, and platform APIs.

98 216.2K
View

Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.

462 163.8K
View

A skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.

462 127.7K
View

Official skill for integrating Firebase AI Logic (Gemini API) into web applications. Covers setup, multimodal inference, structured output, and security.

462 125.1K
View

Complete Better Auth server and client setup with database adapters, session management, plugins, and security configuration.

222 118.2K
View

Deploy and manage projects on Vercel using token-based authentication. Use when working with Vercel CLI using access tokens rather than interactive login — e.g. "deploy to vercel", "set up vercel", "add environment variables to vercel".

31.9K 116.1K
View
cloudflare logo
Security

cloudflare

Complete Cloudflare platform integration with decision trees for compute, storage, AI, networking, security, and infrastructure-as-code.

3K 110.7K
View

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

253 103K
View
gws-gmail logo
Security

gws-gmail

Send, read, and manage Gmail messages, drafts, labels, and account settings.

31.2K 78.9K
View

Comprehensive website auditing across 230+ rules in 21 categories including SEO, performance, security, and accessibility.

94 72.3K
View
gws-shared logo
Security

gws-shared

Shared authentication, CLI syntax, and output formatting patterns for gws Google Workspace commands.

31.2K 63.4K
View

Security AI tools

StarByFace logo
Security

StarByFace

Discover your celebrity doppelgänger with StarByFace!

Free
View
GeoSpy logo
Security

GeoSpy

GeoSpy: Pricing, Features, FAQs, and Alternatives for AI Teams

Free
View

Detect AI-generated voices to protect against audio fraud.

Paid
View

Ensure Your Content's Originality with AI Plagiarism Checker

Freemium
View
Img Upscaler logo
Security

Img Upscaler

Upscale images by 400% without quality loss

Freemium
View
AICheatCheck logo
Security

AICheatCheck

Accurately Detect AI-Generated Content with TheChecker.AI

Free
View
D
Security

Detect GPT

Chrome extension that detects and flags AI-generated content

Free
View