loom-plan-writer

loom-plan-writer is a skill for Claude Code from cosmix/loom. It costs 14 tokens per session (25,022 once invoked), scanned A, original, MIT.

Loom execution-plan writing creates dependency-aware plans for work carried out in separate Git worktrees, which are independent working copies of a repository.

In plain words
What is it for?
Use it to write Loom plans with an initial knowledge check, parallel work stages, and a final integration check. It produces the plan without implementing the changes.
Why use it?
It helps turn code changes into verified stages and prevents a plan from relying on unconfirmed assumptions about the code.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter. Also seen: reads .claude/ paths; mentions CLAUDE.md; mentions subagents.

Good fit Use it to write Loom plans with an initial knowledge check, parallel work stages, and a final integration check. It produces the plan without implementing the changes.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/cosmix/loom/loom-plan-writer
View source ↗ cosmix/loom
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add cosmix/loom --skill loom-plan-writer
Clone the repo
git clone --depth 1 https://github.com/cosmix/loom

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for loom-plan-writer

README.md
[![agentmods](https://agentmods.dev/badge/skills/cosmix/loom/loom-plan-writer.svg)](https://agentmods.dev/skills/cosmix/loom/loom-plan-writer)
Your own site
<a href="https://agentmods.dev/skills/cosmix/loom/loom-plan-writer"><img src="https://agentmods.dev/badge/skills/cosmix/loom/loom-plan-writer.svg" alt="Measured on agentmods" height="20"></a>
Per session 14 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 25,022 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 8 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • high Memory Poisoning · line 148
    Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
    Fix: Protect agent memory and state from modification by untrusted content. Use read-only memory for critical instructions and validate all state changes.
  • high Prompt Injection · line 214
    Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
    Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
  • high Prompt Injection · line 772
    Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
    Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
  • high Privilege Escalation · line 838
    Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
    Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
  • medium Rogue Agent · line 8
    Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
    Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
  • medium Excessive Agency · line 390
    Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
    Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
  • medium Rogue Agent · line 608
    Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
    Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
  • medium Rogue Agent · line 830
    Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
    Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00014 $0.25022
Opus 5 $0.00007 $0.12511
Sonnet 5 $0.00003 $0.05004
Haiku 4.5 $0.00001 $0.02502

Measured today against content hash 9fccc7684763, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

loom-plan-writer scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

| `acceptance` | Build/test/lint AND observable behavior | `"cargo test"`, `"myapp new-cmd --help"`, `"curl -f localhost:8080/health"` |
skills/loom-plan-writer/SKILL.md · 1,174 lines

How it starts

The opening of the file, as written. The whole thing — 1,174 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Loom Plan Writer

THE REQUIRED SKILL FOR CREATING LOOM EXECUTION PLANS. Invoke it whenever an agent needs to author a plan for loom orchestration.

A loom plan is a DAG of stages that loom runs in isolated git worktrees. It maximizes throughput with two levels of parallelism — subagents within a stage (FIRST priority) and concurrent worktree stages (SECOND) — and it is only as good as its CLAIMS about the code are TRUE and its verification actually PROVES them.

This skill assumes CLAUDE.md is in context (it always is under loom). Where CLAUDE.md already governs something — subagent preambles (Rule 5), hierarchies (Rule 6), memory routing (Rule 12/18), branch discipline — this skill points at it rather than restating it.

Two rules dominate everything below:

  1. Ground every claim before you write it (Section 1) — the #1 cause of bad plans.
  2. The plan file is your deliverable. After writing it, STOP (Section 11) — never implement.

1. Ground Every Claim (READ THE SEAM)

⚠️ A plan is a set of CLAIMS about code: "this function does X," "this enum's consumers are Y," "this field is safe to add," "this command type-checks." Every claim is WRONG until the code confirms it. The design spine is usually sound — defects hide in UNREAD seams. A file the plan NAMES is a promise to read; a described file is an unread file.

Before any stage description, acceptance, artifacts, wiring, or wiring_tests asserts anything about a seam, OPEN that seam and read it to the bottom. Never assert from memory, a sibling repo, a plausible filename, or "it usually works this way." The repo's own incident/runbook docs are PRIMARY — read the one the user has open before encoding an external system's behavior from memory.

VERIFY-BEFORE-WRITE CHECKLIST — run for every stage:

□ Every file the stage NAMES, I have OPENED (not inferred from its name).
□ Every symbol the stage CHANGES, I grepped for every importer/consumer across
  the WHOLE repo (BOTH packages in a monorepo) — and followed each edge ONE ring
  out (callers/renderers I did not already think of).
□ Every behavior the stage ASSERTS (a guard enforces X, an error code is
  terminal, a field is safe, a command type-checks) — I read the implementation
  that provides it, including catch-alls and branch ORDER.
□ Every value/behavior the design LEANS ON, I read the line that PRODUCES it (not
  the type/schema/getter that DESCRIBES it) AND confirmed it holds in EACH
  environment that runs the code (prod vs dev, build-time vs unit-test vs e2e,
  container env set, same-origin vs cross-origin). "The symbol is defined" ≠ "it
  holds the right value in the runtime that executes THIS code."
□ Every RULE the plan states about ONE site ("reset this global here," "keep env
  clean for this boot path") — I grepped its structural SIBLINGS (same-shape
  modules, every importer) and applied it to ALL in the same pass, not as a
  one-off note.
□ Every message / limit / line / count / status code / external behavior /
  package dependency is READ from its source, never recalled.
□ No claim rests on memory, a sibling repo, or a plausible name.
□ Every claim about a SIBLING PLAN's surface (upstream symbol, consumer seam,
  file owner) passed the Cross-Plan Contract Protocol — verified against
  committed code or the sibling's stage YAML, never its prose.

Read the full file on GitHub · 1,174 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today Changed · +1 lines 9fccc7684763
  2. 2d ago Changed c84303b7baa8
  3. 4d ago Changed · +143 lines · -31 tokens per session 17111e4c137b
  4. 8d ago First seen · 1,030 lines · 45 tokens per session scan A 8d7a0511e6ac

Subscribe to this mod's changes

loom-plan-writer is a skill published in the GitHub repository cosmix/loom (54 stars, last pushed yesterday), licensed MIT. It adds 14 tokens to every session and 25,022 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

skill-upstream-pr

Improve an open-source GitHub skill and open a friendly suggestion PR upstream: fork, run skill-auto-improver, attach asm eval before/after metrics. Don't use for local-only skills, authoring from scratch, bulk repos, or registry publish.

luongnv89/asm · 56 tokens

meanest-editor

Roast a pitch or press release with the eye of a veteran PR director. Honest, sharp, constructive — never cruel for its own sake.

elvisun/newsjack · 33 tokens

headline-generator

Generate headline candidates from a story's raw facts: news-style headlines, press-release headlines, and pitch subject lines. A pure generation skill — it finds the charge in the facts, then runs ten proven moves (consequence, picture, number-as-hero, two-beat turn, naming, reader's-own-story, open question, voice…

elvisun/newsjack · 88 tokens

ai-visibility-writing

Audit, question, suggest, or fact-preservingly revise a press release, blog post, contributed article, or expert explainer so AI answer systems can more easily retrieve, understand, quote, and cite its useful information. Use when someone asks for AI visibility, AI search, answer-engine, AEO, GEO, AI Overview, or…

elvisun/newsjack · 137 tokens

docs-updater

Provides automated documentation updates by analyzing git changes between the current branch and the last release tag. Performs git diff analysis to identify modifications, then updates README.md, CHANGELOG.md following Keep a Changelog standard, and discovers documentation folders for contextual updates. Use when…

giuseppe-trisciuoglio/developer-kit · 96 tokens

github-issue-workflow

Provides a structured 8-phase workflow for resolving GitHub issues in Claude Code. Covers fetching issue details, analyzing requirements, implementing solutions, verifying correctness, performing code review, committing changes, and creating pull requests. Use when user asks to resolve, implement, work on, fix, or…

giuseppe-trisciuoglio/developer-kit · 79 tokens