ayukyo

Icode Skill — Security skill for Claude Code

Security community

A 6-step coding workflow for Claude Code — Plan → Review → Finalize → Code → Deep Check → Audit.

How to install Icode Skill

This entry records only its repository, not the path inside it, so there is no exact command to give. Open ayukyo/icode-skill and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Icode Skill does

A 6-step coding workflow for Claude Code — Plan → Review → Finalize → Code → Deep Check → Audit. Run all at once or step-by-step, switch models between steps. Claude Code 六步编码工作流：计划 → 审查 → 定稿 → 编码 → 复检 → 终审，一步到位或分步执行，步骤间可切换模型。

Alternatives in Security

Skill Threat Modeling — Code-First Deep Risk Analysis Skill for Claude Code - 8-Phase Workflow with Security design review, STRIDE Thr 207 ★
Sovereign Skills — 20 production-grade skills for AI coding agents — setup, scope, discipline, code review, security, session man 125 ★
Mobile Review — Senior-level deep review of an existing mobile app 107 ★

README

ICode — End-to-End Coding Workflow for Claude Code

**6-step workflow: Plan → Review → Finalize → Code → Deep Check → Audit.** Run all at once, or step-by-step and switch models between steps.

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE) [![Claude Code](https://img.shields.io/badge/Claude%20Code-Skill-8A2BE2.svg)](SKILL.md) [![Version](https://img.shields.io/badge/version-v2.18.0-blue.svg)](SKILL.md) [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](https://github.com/ayukyo/icode-skill/issues)

ICode is a Claude Code Skill that breaks the journey from requirement to delivery into strict, individually invokable steps. It adds a **quality gate, adversarial review, cross-project memory, and crash recovery** on top of vanilla Claude Code — without locking you into a single model or a single pass.

Why ICode?

Concern	Vanilla Claude Code	ICode
Process discipline	Depends on your prompt	Hard 6-step gates + L1–L4 blocking matrix
Review quality	Single-perspective self-review	Independent skeptic sub-agents with adversarial verification (self-delegation forbidden)
Laziness resistance	None	33 hard anti-laziness rules + mandatory Read confirmation lines + file:line evidence
Reusing past decisions	Every ticket starts cold	Cross-project history retrieval with a global index + verdict-based anti-misleading injection (disproved tickets inject the trap, not the ADR)
Project knowledge	None	`/icode doc` generates a global per-project/branch knowledge base, auto-injected at phase zero
Crash recovery	Restart from scratch	`.ico_metadata.json` status + round counters enable resumable runs at any step
Cost control	Everything on the main model	`cheap-research` offloads low-risk candidate/compression/structured-extraction sub-tasks (the ones with real call sites in each step) to cheap models; `/icode fast` ≈ 65% of ful