Claude Code's Plan-Skeptic Sub Agent Identifies Security Gaps in Generated Plans
How Claude Code's Plan-Skeptic Sub Agent Works
A developer with 10+ years of web agency experience discovered that Claude Code includes a plan-skeptic sub agent that can be triggered to review AI-generated development plans. When the developer rejected a plan due to security concerns, Claude Code automatically ran both the security-sheriff and plan-skeptic sub agents.
The plan-skeptic sub agent not only caught the security issues the developer had flagged, but identified additional problems that weren't initially noticed. The revised plan was significantly better after this review process.
Practical Workflow Integration
The developer now deliberately rejects plans and prompts Claude Code with: run the plan-skeptic sub agent to identify any gaps or issues before approving any generated plans. This approach has become part of their regular workflow when using Claude Code for development tasks.
The security-sheriff sub agent was previously known to the developer, but the plan-skeptic sub agent was new. Both agents work together to improve plan quality, with plan-skeptic specifically focused on identifying gaps and issues in the overall plan structure and approach.
This discovery came from reviewing a Claude Code-generated plan that felt off from a security perspective, based on the developer's experience building production applications. The gut feeling about potential security issues led to the rejection that triggered both sub agents.
📖 Read the full source: r/ClaudeAI
👀 See Also
Structured Claude Skill for B2B SaaS Growth Workflows
A developer has open-sourced a Claude Skill that structures B2B SaaS growth knowledge into playbooks and case studies to improve Claude's output quality. The repository includes 5 SaaS case studies, a 4-stage growth flywheel, and 6 structured playbooks.
ARP: Stateless WebSocket Relay for Autonomous Agent Communication
ARP (Agent Relay Protocol) is a stateless WebSocket relay for autonomous agent communication featuring Ed25519 identity, HPKE encryption per RFC 9180, binary TLV framing, and 33 bytes overhead per message. No accounts or registration required—just generate a keypair and connect.
Four ClawHub Skills for Real-Time Search Data in AI Agents
Four ClawHub skills provide structured search capabilities for AI agents: Google (web, news, images, maps), Amazon (product search across 12 marketplaces), Walmart (product search with delivery filters), and YouTube (video search with transcripts). Install via clawhub install commands with one API key.
LLM Agent Builds Complete Godot 4 Dungeon Crawler Using Visual Feedback
A developer connected an LLM agent to Godot 4 using an MCP tool and gave it a single prompt to build a dungeon crawler FPS. The agent created a complete prototype with 3 rooms, lighting, combat, enemies, and progression by running the game, taking screenshots, and fixing visual issues.