andrem-sec Plan-First Skill
Enforce plan-mode discipline before implementation.
What Claude Gets Wrong Without This Skill
Without plan-first, Claude begins editing immediately on complex tasks. Mid-task, it discovers dependencies it did not account for, requiring backtracking. On security-sensitive tasks, it makes changes whose scope only becomes visible after the fact. The cost of planning is always lower than the cost of unwinding a wrong approach.
When Plan Mode Is Required
| Condition | Plan Mode |
|---|---|
| 1-2 files, single domain | Optional |
| 3+ files | Required |
| Cross-domain | Required |
| Security-sensitive | Required |
| Schema / database changes | Required |
| Irreversible operations | Required |
Plan Format
## Plan: [task name]
### Scope
Files affected: [N] — [list]
Domains: [list]
Risk: LOW / MEDIUM / HIGH
### Steps
1. [action] — [file(s)]
2. [action] — [file(s)]
→ Parallel: [action] — [file(s)]
3. [action] — [file(s)]
↳ Checkpoint: verify [X] before proceeding
### Risks
[Risk] at Step [N] — requires [confirmation / rollback plan]
### Confirmation
Proceed? (yes / modify / no)
Checkpoint Rule
No more than 5 sequential steps without a verification checkpoint. At each:
- Run tests or build
- State expected outcome
- Decision: PIVOT / REFINE / PROCEED
Parallel steps that share no dependencies do not count toward the 5-step limit.
Anti-Patterns
Do not begin editing before the user says yes. "I'll start with step 1 while you review" is not compliant.
Do not present a plan so vague it cannot be critiqued. "Refactor the service" is not a step.
Do not include parallel steps that actually share file dependencies — race conditions are real even in sequential Claude sessions.
Mandatory Checklist
- Verify file count was assessed before deciding on plan mode
- Verify all 3 triggers were checked (files, domains, security)
- Verify each step names specific files, not "the relevant files"
- Verify parallel steps genuinely have no shared file dependencies
- Verify a checkpoint appears after every 5 sequential steps
- Verify the user explicitly confirmed before any editing began