Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add 0xDarkMatter/claude-mods --skill iterategit clone --depth 1 https://github.com/0xDarkMatter/claude-modsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/0xdarkmatter/claude-mods/iterate)<a href="https://agentmods.dev/skills/0xdarkmatter/claude-mods/iterate"><img src="https://agentmods.dev/badge/skills/0xdarkmatter/claude-mods/iterate/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/0xdarkmatter/claude-mods/iterate"><img src="https://agentmods.dev/badge/skills/0xdarkmatter/claude-mods/iterate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 6 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 177 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 183 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 196 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 198 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium MCP Rug Pull · line 290 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 291 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00060 | $0.04455 |
| Opus 5.5 | $0.00024 | $0.01782 |
| Sonnet 5.5 | $0.00012 | $0.00891 |
| Haiku 4.5 | $0.00006 | $0.00445 |
Grade A, and why
iterate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 395 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Iterate - Autonomous Improvement Loop
Inspired by Karpathy's autoresearch: constrain scope, clarify success with one mechanical metric, loop autonomously. The agent modifies code, measures the result, keeps improvements, discards regressions, and repeats - until any stop condition fires or the user interrupts.
The power is in the constraint. One metric. One scope. One loop. Git as memory.
Preflight
Before the loop starts, do the work that makes the loop effective. Don't skip steps - this discipline is what separates a productive overnight run from a flailing one.
1. Collect Config
If provided inline, extract and proceed. If required fields are missing, ask once using AskUserQuestion with all missing fields batched together.
| Field | Required | What it is | Example |
|---|---|---|---|
| Goal | Yes | What you're improving, in plain language | "Increase test coverage to 90%" |
| Scope | Yes | File globs the agent may modify | src/**/*.ts |
| Verify | Yes | Shell command that outputs the metric (a number) | npm test -- --coverage | grep "All files" |
| Direction | Yes | Is higher or lower better? | higher / lower |
| Guard | No | Command that must always pass (prevents regressions) | npm run typecheck |
| Batch | No | Changes per iteration. >1 enables bisect-on-regression. Default 1. |
3 |
| Iterations | No | Hard cap on iteration count. | 30 |
| Until | No | Stop when metric crosses this target value. | 90 |
| Stagnation | No | Stop after N consecutive iterations with no improvement. | 15 |
| Branch | No | Branch isolation. current (default), auto (slug from goal), or explicit name. |
auto |
Stop conditions are OR'd: any combination of Iterations, Until, Stagnation may be set. The loop stops when any one is satisfied. If none are set, the loop is unbounded - it runs until interrupted.
2. Plan
Read all in-scope files. Understand the codebase before touching anything.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +36 lines 4c9109593d37
- 1mo ago First seen · 359 lines · 60 tokens per session scan A b2e4ef021c31
iterate is a skill published in the GitHub repository 0xDarkMatter/claude-mods (78 stars, last pushed 14d ago), licensed MIT. It adds 60 tokens to every session and 4,455 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
visual-regression
Setup visual regression testing with Storybook stories, configuration, and CI/CD workflows. Supports Chromatic, Percy, BackstopJS. Auto-invoke when user says "set up visual regression", "add Chromatic tests", "add screenshot testing", or "set up Percy".
Vizra ADK Evaluation Framework
Test and evaluate AI agents with automated evaluations, assertions, and LLM-as-a-Judge patterns.
accessibility-a11y
WCAG 2.2 compliance, ARIA patterns, keyboard navigation, screen readers, automated testing.
agent-e2e-test-specialist
Specialist subagent: Playwright, Cypress, and visual regression testing specialist. Use only when the user explicitly asks for E2E tests, browser test automation, or visual regression testing. Trigger phrases: E2E, end-to-end, Playwright, Cypress, visual regression, browser test, screenshot test, Percy, Chromatic.
agent-test-generator
Specialist subagent: Generates comprehensive test suites using TDD patterns. Use only when the user explicitly asks for tests, improved coverage, or test-first development.
github-release-management
GitHub release orchestration — automated versioning, testing, deployment, and rollback. Use when cutting a release, tagging a version, drafting release notes, or coordinating a deploy/rollback workflow.