ffuf-web-fuzzing
Expert guidance for ffuf web fuzzing during authorized penetration testing. Covers directory discovery, subdomain enumeration,…
Implements file-based planning for complex multi-step tasks. Creates task_plan.md, findings.md, and progress.md as persistent working memory. Use when starting tasks requiring >5 tool calls, multi-phase projects, research, or any work where losing track of goals and progress
$ npx -y skills add trailofbits/skills-curated --skill planning-with-files --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
/planning-with-filesContext preview
The summary Claude sees to decide when to auto-load this skill.
Implements file-based planning for complex multi-step tasks. Creates task_plan.md, findings.md, and progress.md as persistent working memory. Use when starting tasks requiring >5 tool calls, multi-phase projects, research, or any work where losing track of goals and progress
name: planning-with-files description: >- Implements file-based planning for complex multi-step tasks. Creates task_plan.md, findings.md, and progress.md as persistent working memory. Use when starting tasks requiring >5 tool calls, multi-phase projects, research, or any work where losing track of goals and progress would be costly. allowed-tools: - Read - Write - Edit - Glob - Grep
Use persistent markdown files as working memory on disk.
1. **Create planning files** -- use `/plan` or create manually from [templates](references/templates.md) 2. **Create `task_plan.md`** with goal, phases, and key questions 3. **Create `findings.md`** for research and decisions 4. **Create `progress.md`** for session logging 5. **Re-read the plan before decisions** -- refreshes goals in attention 6. **Update after each phase** -- mark status, log errors
Context Window = RAM (volatile, limited) Filesystem = Disk (persistent, unlimited) Anything important gets written to disk.
After many tool calls, the original goal drifts out of the attention window. Reading `task_plan.md` brings it back. This is the single most important pattern in file-based planning.
| File | Purpose | When to Update | |------|---------|----------------| | `task_plan.md` | Phases, progress, decisions | After each phase completes | | `findings.md` | Research, discoveries, decisions | After ANY discovery | | `progress.md` | Session log, test results | Throughout the session |
All three files go in the **project root**, not the plugin directory.
Never start a complex task without `task_plan.md`. This is non-negotiable. The plan is your persistent memory.
After every 2 search, browse, or read operations, immediately save key findings to `findings.md`. Multimodal content (images, browser results, PDF contents) does not persist in context -- capture it as text before it is lost.
Before any major decision, re-read `task_plan.md`. This pushes goals and context back into the recent attention window, counteracting the "lost in the middle" effect that occurs after ~50 tool calls.
[Original goal -- far away in context, forgotten] ...many tool calls... [Recently read task_plan.md -- gets ATTENTION] → Now make the decision with goals fresh in context
After completing any phase:
Every error goes in `task_plan.md`. Include the attempt number and resolution. This builds knowledge and prevents repeating failures.
## Errors Encountered | Error | Attempt | Resolution | |-------|---------|------------| | FileNotFoundError | 1 | Created default config | | API timeout | 2 | Added retry logic |
If an action failed, the next action must be different. Track what you tried and mutate the approach.
if action_failed:
next_action != same_actionATTEMPT 1: Diagnose & Fix -> Read error carefully -> Identify root cause -> Apply targeted fix ATTEMPT 2: Alternative Approach -> Same error? Try a different method -> Different tool? Different library? -> NEVER repeat the exact same failing action ATTEMPT 3: Broader Rethink -> Question assumptions -> Search for solutions -> Consider updating the plan AFTER 3 FAILURES: Escalate to User -> Explain what you tried (with attempt log) -> Share the specific error -> Ask for guidance
| Situation | Action | Reason | |-----------|--------|--------| | Just wrote a file | Don't read it | Content still in context | | Viewed image/PDF | Write findings NOW | Multimodal content doesn't persist | | Browser returned data | Write to file | Screenshots don't persist | | Starting new phase | Read plan/findings | Re-orient if context is stale | | Error occurred | Read relevant file | Need current state to fix | | Resuming after gap | Read all planning files | Recover full state |
If you can answer these from your planning files, context is solid:
| Question | Answer Source | |----------|--------------| | Where am I? | Current phase in `task_plan.md` | | Where am I going? | Remaining phases | | What's the goal? | Goal statement in plan | | What have I learned? | `findings.md` | | What have I done? | `progress.md` |
| Don't | Do Instead | |-------|------------| | State goals once and forget | Re-read plan before decisions | | Hide errors and retry silently | Log every error to plan file | | Stuff everything in context | Store large content in files | | Start executing immediately | Create plan file FIRST | | Repeat failed actions | Track attempts, mutate approach | | Create files in plugin directory | Create files in project root |
three planning files
principles behind this approach
recovery patterns
Trail of Bits' reviewed and approved Claude Code plugins. Every skill and marketplace here has been vetted for quality and safety.
Expert guidance for ffuf web fuzzing during authorized penetration testing. Covers directory discovery, subdomain enumeration,…
Reverse engineers binaries using Ghidra's headless analyzer. Use when decompiling executables, extracting functions, strings,…
Remove signs of AI-generated writing from text. Use when editing or reviewing text to make it sound more natural and…
Researches a topic from the last 30 days on Reddit, X, and the web. Surfaces real community discussions with engagement metrics…
Deploy applications and infrastructure to Cloudflare using Workers, Pages, and related platform
Use when the agent is building or iterating on a web game (HTML/JS) and needs a reliable