# Plan First

> Plan-mode enforcement — required before edits affecting 3+ files, cross-domain work, or security-sensitive changes

- Skill: `andrem-sec/plan-first` (Agent Skill)
- Install (CLI): `npx skillmds@latest add andrem-sec/plan-first`
- Raw SKILL.md: https://api.skillmd.com/api/skills/andrem-sec/plan-first/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: andrem-sec (https://skillmd.com/u/andrem-sec)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/andrem-sec/plan-first

---


# Plan-First Skill

Enforce plan-mode discipline before implementation.

## What Claude Gets Wrong Without This Skill

Without plan-first, Claude begins editing immediately on complex tasks. Mid-task, it discovers dependencies it did not account for, requiring backtracking. On security-sensitive tasks, it makes changes whose scope only becomes visible after the fact. The cost of planning is always lower than the cost of unwinding a wrong approach.

## When Plan Mode Is Required

| Condition | Plan Mode |
|-----------|-----------|
| 1-2 files, single domain | Optional |
| 3+ files | Required |
| Cross-domain | Required |
| Security-sensitive | Required |
| Schema / database changes | Required |
| Irreversible operations | Required |

## Plan Format

```
## Plan: [task name]

### Scope
Files affected: [N] — [list]
Domains: [list]
Risk: LOW / MEDIUM / HIGH

### Steps
1. [action] — [file(s)]
2. [action] — [file(s)]
   → Parallel: [action] — [file(s)]
3. [action] — [file(s)]
   ↳ Checkpoint: verify [X] before proceeding

### Risks
[Risk] at Step [N] — requires [confirmation / rollback plan]

### Confirmation
Proceed? (yes / modify / no)
```

## Checkpoint Rule

No more than 5 sequential steps without a verification checkpoint. At each:
- Run tests or build
- State expected outcome
- Decision: PIVOT / REFINE / PROCEED

Parallel steps that share no dependencies do not count toward the 5-step limit.

## Anti-Patterns

Do not begin editing before the user says yes. "I'll start with step 1 while you review" is not compliant.

Do not present a plan so vague it cannot be critiqued. "Refactor the service" is not a step.

Do not include parallel steps that actually share file dependencies — race conditions are real even in sequential Claude sessions.

## Mandatory Checklist

1. Verify file count was assessed before deciding on plan mode
2. Verify all 3 triggers were checked (files, domains, security)
3. Verify each step names specific files, not "the relevant files"
4. Verify parallel steps genuinely have no shared file dependencies
5. Verify a checkpoint appears after every 5 sequential steps
6. Verify the user explicitly confirmed before any editing began