iterative-plan-review

iterative-plan-review is a skill for Claude Code from testdouble/han. It costs 137 tokens per session (8,327 once invoked), scanned B, original, MIT.

A review tool that repeatedly checks an existing implementation plan against the codebase and improves it in place. It records findings and review rounds in linked companion files.

In plain words
What is it for?
Use it to refine, tighten, and stress-test a technical plan before developers start building.
Why use it?
It helps find missing details, weak assumptions, and inconsistencies before implementation begins.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter. Also seen: reads .claude/ paths; mentions CLAUDE.md.

Runs only inside its plugin — its command needs a path that Claude Code sets for a plugin’s own hooks and for nothing else. Install the plugin, not this.

Part of the han-planning plugin — 5 skills, 1 agent shipped together

Install

Getting it into your agent

This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.

Claude Code
/plugin marketplace add testdouble/han
Claude Code
/plugin install han-planning

Made for: Claude Code.

Or install han-planning, the plugin that ships this one along with the rest of its 5 skills, 1 agent.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for iterative-plan-review

README.md
[![agentmods](https://agentmods.dev/badge/skills/testdouble/han/iterative-plan-review.svg)](https://agentmods.dev/skills/testdouble/han/iterative-plan-review)
Your own site
<a href="https://agentmods.dev/skills/testdouble/han/iterative-plan-review"><img src="https://agentmods.dev/badge/skills/testdouble/han/iterative-plan-review.svg" alt="Measured on agentmods" height="20"></a>
Per session 137 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 8,327 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00137 $0.08327
Opus 5 $0.00068 $0.04163
Sonnet 5 $0.00027 $0.01665
Haiku 4.5 $0.00014 $0.00833

Measured 2d ago against content hash 5a4188b2437a, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade B, and why

iterative-plan-review scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

The scan reads SKILL.md. This mod also ships 1 executable file (scripts/check-cross-references.sh), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

Find the plan file from the user's argument. If no path was provided, use `Glob` to find `~/.claude/plans/*.md` — Glob
han-planning/skills/iterative-plan-review/SKILL.md · 467 lines

How it starts

The opening of the file, as written. The whole thing — 467 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Project Context

  • CLAUDE.md: !find . -maxdepth 1 -name "CLAUDE.md" -type f
  • project-discovery.md: !find . -maxdepth 3 -name "project-discovery.md" -type f
  • personal config directory: !bash "${CLAUDE_PLUGIN_ROOT}/scripts/han-config-dir.sh" 2>/dev/null || echo "$HOME/.claude"
  • project .han/config.md: !cat .han/config.md 2>/dev/null || echo ""

As your first action, use the Read tool on .han/config.md inside the personal config directory path above. A read that returns no file is no personal configuration: continue silently. When that file or the project .han/config.md probe supplies content, apply it per config-rule.md, which governs precedence between the two files, relative-path resolution, and what to do with a file that reads but cannot be used.

Review Approach

  • Source the shared readability standard early. Invoke han-communication:readability-guidance before you edit, and apply it to any plan prose this review rewrites. Hold the named audience: the reader of the plan this review refines. The frame governs how a fact is said, never whether a required fact appears — keep the evidence citations, file:line references, and IDs the plan depends on.
  • Read the full plan before challenging — an assumption that looks wrong in isolation may make sense in context.
  • Ground challenges in codebase evidence: "The API handler at src/api/handler.go:47 returns XML, not JSON" is actionable; "This assumes the API returns JSON" is not.
  • Check overlap against existing code, not just the plan — the most valuable overlap findings are external utilities or patterns the codebase already has.
  • Ask practical ambiguity questions — "Should this handle concurrent access?" is only useful if there's evidence concurrent access actually happens.
  • YAGNI is a first-class review pillar. Apply the evidence-based YAGNI rule from ../../references/yagni-rule.md to every plan item the review touches — every behavior, plan step, abstraction, configuration knob, runbook, observability hook, infrastructure component, test category, ADR clause, or coding-standard line. Items that fail the evidence test or have a strictly simpler version available are first-class findings (Category: YAGNI candidate), not polish. Resolution paths: cite missing evidence and keep, replace with simpler version, or move to the plan's ## Deferred (YAGNI) section with the reopening trigger named. YAGNI candidates are surfaced visibly to the user — never silently dropped, never silently kept. Every plan item is ongoing maintenance and a pattern future agents will copy.
  • Evidence quality is a first-class review pillar. Apply the companion evidence rule from ../../references/evidence-rule.md alongside the YAGNI gate. YAGNI asks whether a plan item has any evidence at all; the evidence rule asks how strong that evidence is. Specifically: name the trust class of each citation a plan item rests on (codebase, web, provided); apply the corroboration gate to web-source claims that drive a recommendation (single-source web claims get marked and cannot stand alone); and label claims with no evidence at any tier as a distinct state rather than treating them as weak evidence. The proximity-to-origin principle is a heuristic, not a strict tier list; do not raise findings purely because a plan item cites docs instead of running code.
  • The review lives in three cross-referenced files. The plan file is the primary artifact edited in place and stays at the root of {plan-dir}/; review-findings.md records every finding and how it was resolved, and review-iteration-history.md records each iteration or round — both companion artifacts live in {plan-dir}/artifacts/ to keep the plan folder uncluttered. The plan gets a standardized ## Review History section at the bottom pointing to the companion files. Inline (F#) markers are NOT added to plan sentences — forward traceability lives in the findings file's Changed in plan: field. (Inline ([T#](...)) markers in spec-aware mode remain — they tag load-bearing mechanic-driven spec sentences and are not finding markers.) The findings and iteration files (siblings inside artifacts/) cross-link through Raised in round: / Findings raised: fields and both record Changed in plan: sections. Any edit to one file requires updating the matching fields in the others.

Read the full file on GitHub · 467 lines

Files

What ships with it

6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 467 lines · 137 tokens per session scan B 5a4188b2437a

Subscribe to this mod's changes

iterative-plan-review is a skill published in the GitHub repository testdouble/han (256 stars, last pushed 5d ago), licensed MIT. It adds 137 tokens to every session and 8,327 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other skills, from other repositories

meta-tags-optimizer

Optimize title tags, meta descriptions, Open Graph, and Twitter cards for maximum click-through rate. Generates multiple A/B test variations with character counting and SERP preview. Use when asked to "optimize title tag", "write meta description", "improve CTR", "Open Graph tags", "fix my meta tags", "social media…

nowork-studio/notfair-plugin · 91 tokens

google-ads-audit

Google Ads account audit and business context setup. Run this first — it gathers business information, analyzes account health, and saves context that all other ads skills reuse. Trigger on "audit my ads", "ads audit", "set up my ads", "onboard", "account overview", "how's my account", "ads health check", "what should…

nowork-studio/notfair-plugin · 114 tokens

sxo

Search Experience Optimization (SXO) — the bridge between SEO and UX/CRO. Audits the full journey from the SERP click to the on-page goal: SERP click-through factors (title/meta/rich results that win the click), then post-click experience signals that keep users and drive conversions — above-the-fold relevance and…

nowork-studio/notfair-plugin · 235 tokens

tidewave-integration

Tidewave MCP runtime tools — debugging, smoke testing, live state inspection, SQL queries, hex docs. Use when evaluating code in a running Phoenix app.

oliver-kriska/claude-elixir-phoenix · 38 tokens

elixir-idioms

OTP/BEAM patterns and Elixir idioms — GenServer, Supervisor, Task, Registry, pattern matching, with chains, pipes. Use when designing processes or debugging BEAM issues.

oliver-kriska/claude-elixir-phoenix · 44 tokens

security

Enforce Elixir/Phoenix security — auth, OAuth, sessions, CSRF, XSS, SQL injection, input validation, secrets. Use when editing auth files, login flows, RBAC, or API keys.

oliver-kriska/claude-elixir-phoenix · 47 tokens