nsheaps/iterate-until-good
plugins/sdlc-utils/skills/iterate-until-good/SKILL.md
Evaluates code on a PR or branch across many categories, scores each, and iterates (local review+fix loop) until all categories score > 85%. Uses the scm-utils review skills for the review portion of each iteration.
$ install --global
skillsauthnpx skillsauth add nsheaps/ai-mktpl iterate-until-goodInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 22, 2026, 4:16 PM52.2s1 file scanned
SKILL.md
- name:
- iterate-until-good
- description:
- >
- argument-hint:
- [the requested iteration target, like a branch, PR, repo, notion doc, etc]
Iterate Until Good
A local review-and-fix loop. For the user's requested target (branch, PR, repo, etc), run a review across all categories, fix issues, and repeat until every category scores > 85%. Any category below 70% is a hard block.
Cross-reference: The review portion of each iteration uses the granular review skills in
scm-utils(review-code, review-diff, review-commits, review-commit-messages, review-pr-contents). CI-based review follows the same iterative pattern but usesscm-utils:code-reviewfor the review bot workflow.
CRITICAL: This skill improvement depends on your iteration after you utilize it. If any part of this can be improved, please submit a Pull Request to this skill on https://github.com/nsheaps/ai-mktpl. If you choose to contribute, please use a background agent to perform the updates. Future AI agents and humans thank you!
Review Categories
Evaluate across these dimensions, scoring each 0-100:
| Category | What to check | | ----------------- | ------------------------------------------------- | | Simplicity | Is the code as simple as it can be? | | Correctness | Does it do what the spec says? | | Flexibility | Can it adapt to reasonable future changes? | | Usability | Is the API/interface intuitive? | | Security | Are there vulnerabilities or unsafe patterns? | | Pattern adherence | Does it follow existing codebase conventions? | | Documentation | Are public APIs and non-obvious logic documented? | | Quality assurance | General engineering practices and best practices |
Also factor in: PR title/body, commit messages, commit history, and the commit history relation to its base branch.
Iteration Process
Step 1: Review
Launch a run_in_background:true Task sub-agent for each category. Each agent should:
- Score the category 0-100 with a short paragraph explaining the score
- Include references (codebase, external docs, PRs, etc.) to support claims
- Write their report to
.claude/pr-reviews/$org/$repo/$prNumber/$epoch/$category/REPORT.md - Optionally leave inline comments for the PR and supporting docs
Step 2: Synthesize
When all agents complete, review each report and create one overall report:
- Format scores in a table with emoji indicators:
🚨< 70%,⚠️< 85%,✅>= 85% - If any category has
⚠️, maximum overall score is 94% - For P2 (nice-to-have) items use
🔕, for info-only useℹ️ - If overall > 95%, keep the final report to just the table
Step 3: Fix
Address all findings below threshold. Use scm-utils:fix-review-findings for guidance.
Step 4: Re-review
Repeat from Step 1 until all categories pass.
Output Modes
Agentic mode (empowered to post reviews): Leave inline comments as individual comment-only reviews, then a final review with <details>/<summary> and shields.io badges for scoring.
Interactive CLI: Provide links to files on GitHub or locally.
Score Thresholds
| Score | Status | Action | | ------ | ------ | --------------------------- | | >= 85% | Pass | Ready to merge | | 70-84% | Warn | Should address before merge | | < 70% | Block | Must address before merge |
External References
- Google Engineering Practices: Code Review
- Conventional Comments
Related Skills
nsheaps/github-app-session-env
tools
VerifiedTrustedCommunity
Manually reproduce what the github-app plugin's SessionStart hook does to make a GitHub App installation token usable in the current session — materialize the PEM, generate the token, isolate GH_CONFIG_DIR, write the runtime env file, and wire CLAUDE_ENV_FILE so every Bash call sees GH_TOKEN/GITHUB_TOKEN. Use when the hook did not run, the token is missing from the environment, or a shell/teammate needs the token wired up by hand. <example>GH_TOKEN isn't set even though github-app is configured</example> <example>the github-app SessionStart hook didn't run, set up the token manually</example> <example>wire the github app token into CLAUDE_ENV_FILE</example> <example>gh keeps falling back to the wrong account, isolate GH_CONFIG_DIR</example>
3SKILL.mdUpdated Jun 9, 2026
nsheaps/github-app-git-identity
tools
VerifiedTrustedCommunity
Manually configure the GitHub App bot git identity the way the github-app plugin's SessionStart hook does — resolve the app slug and bot user ID, build the <slug>[bot] name and noreply email, set GIT_AUTHOR_*/GIT_COMMITTER_* env vars, and write an isolated GIT_CONFIG_GLOBAL with the gh auth git-credential helper. Use when commits are attributed to the wrong account, "Author identity unknown" appears, or git identity must be set up by hand. <example>my commits are showing up as the handler, not the bot</example> <example>git says Author identity unknown after the github-app hook ran</example> <example>configure the github app bot git identity manually</example> <example>set up the gh credential helper for git push</example>
3SKILL.mdUpdated Jun 9, 2026
nsheaps/spec-management
tools
VerifiedTrustedCommunity
Manages spec files for requirements capture and validation
3SKILL.mdUpdated Jun 7, 2026
nsheaps/plugins/bash-command-rejection/skills/bash-chaining-alternatives
tools
VerifiedTrustedCommunity
# Bash Chaining Alternatives This skill teaches you how to work around the bash command chaining restriction enforced by this plugin. ## Why Chaining is Blocked The `bash-command-rejection` plugin blocks these operators: | Operator | Name | Why Blocked | | -------- | ---------- | ----------------------------------------------------------------------------------- | | `&&` | AND chain | Runs cmd2 only if cmd1 su
3SKILL.mdUpdated Jun 7, 2026