Claude Code's Plan-Skeptic Sub Agent Identifies Security Gaps in Generated Plans
How Claude Code's Plan-Skeptic Sub Agent Works
A developer with 10+ years of web agency experience discovered that Claude Code includes a plan-skeptic sub agent that can be triggered to review AI-generated development plans. When the developer rejected a plan due to security concerns, Claude Code automatically ran both the security-sheriff and plan-skeptic sub agents.
The plan-skeptic sub agent not only caught the security issues the developer had flagged, but identified additional problems that weren't initially noticed. The revised plan was significantly better after this review process.
Practical Workflow Integration
The developer now deliberately rejects plans and prompts Claude Code with: run the plan-skeptic sub agent to identify any gaps or issues before approving any generated plans. This approach has become part of their regular workflow when using Claude Code for development tasks.
The security-sheriff sub agent was previously known to the developer, but the plan-skeptic sub agent was new. Both agents work together to improve plan quality, with plan-skeptic specifically focused on identifying gaps and issues in the overall plan structure and approach.
This discovery came from reviewing a Claude Code-generated plan that felt off from a security perspective, based on the developer's experience building production applications. The gut feeling about potential security issues led to the rejection that triggered both sub agents.
📖 Read the full source: r/ClaudeAI
👀 See Also
CipherClaw: Using a Security Persona to Audit Code with Claude
A developer used CipherClaw, a CLAUDE.md persona called TALON, to make Claude Code think like a security architect. Running it on a Next.js app revealed 17 security findings including critical vulnerabilities like unauthenticated endpoints returning admin data and hardcoded auth tokens.
Troubleshooting Email and Google Drive Access for AI Agents
Setting up email and Google Drive access for AI bots on AWS can trigger account blocks. Here's a solution using Gmail and Workspace domains.
Doc Harness: A Claude Code Skill for Maintaining Project State Across Sessions
Doc Harness is a Claude Code skill that creates a lightweight documentation system with five structured files to help AI agents maintain project context across sessions. It addresses issues like context resets, forgotten rules, and the need to re-explain projects to new agents.
Context Routing Layer Reduces Claude Code Token Usage by Tracking Accessed Files
A developer saved approximately $80 per month on Claude Code usage by adding a context routing layer that prevents the AI from re-reading the same repository files on follow-up turns. The tool tracks what files have already been accessed to reduce redundant token consumption.