# Build Loop

> >

- **Type:** Skill
- **Install:** `agentstack add skill-lakreame-build-loop-build-loop`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [lakreame](https://agentstack.voostack.com/s/lakreame)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [lakreame](https://github.com/lakreame)
- **Source:** https://github.com/lakreame/build-loop

## Install

```sh
agentstack add skill-lakreame-build-loop-build-loop
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Agentic Project Builder

Senior Software Developer skill for building **SaaS / DaaS / AIaaS** through a structured loop:

```
Prompt → Plan → Execute → Verify → Iterate
```

One external sub-skill is loaded when relevant:
- **`engineering:code-review`** — structured code review, loaded inline during Verify

Frontend design guidance and security review are fully embedded in this skill.

---

## Token Efficiency — Caveman Integration

Load `references/caveman.md` at session start and apply it for the full session.
Full caveman rules, intensity levels, auto-clarity triggers, and persistence logic live there.

Default intensity: **full**. Switch mid-session with `/caveman lite|full|ultra` if needed.

Agentic-loop overrides (take precedence over base caveman rules):
- Phase headers `[PLAN]` `[EXEC]` `[VERIFY]` `[ITERATE]` → always kept verbatim
- Code files, CLI commands, schema → **always full, never caveman-compressed**
- User-facing questions and confirmations → **short prose, not fragments**
- Security warnings and irreversible actions → **full prose** (caveman auto-clarity rule applies)
- External sub-skill calls noted inline: `[SUB: code-review]`

---

## Loop Protocol

### Phase 0 — PROMPT (Session Init)

Collect:
1. **Goal** — one sentence
2. **Type** — SaaS / DaaS / AIaaS (or hybrid)
3. **Stack** — from the Stack Menu below
4. **Scope** — MVP or full product?

Load the relevant project type reference(s) immediately:
- SaaS → `references/saas-pattern.md`
- DaaS → `references/daas-pattern.md`
- AIaaS → `references/aiaas-pattern.md`

Output confirmed **Project Brief** (caveman-compressed):

```
GOAL: [one-line]
TYPE: [SaaS|DaaS|AIaaS|hybrid]
STACK: [selected components]
SCOPE: [MVP|Full]
LOOP: 0
```

---

### Phase 1 — PLAN

The single next concrete step only — not the whole project.

Output (caveman-compressed):

```
[PLAN] Loop N
STEP: [verb + object, ≤10 words]
TASKS:
  1. [subtask]
  2. [subtask]
  3. [subtask]
DONE WHEN: [testable criterion]
STACK: [components this step]
UI? [YES|NO]
SECURITY? [YES|NO]
```

`UI? YES` → load `frontend-design` sub-skill in Execute.
`SECURITY? YES` → run security checklist in Verify.

Security triggers automatically when the step touches: auth, user data, payments, API keys,
file uploads, AI inference inputs/outputs, Docker configs, or CI secrets.

Keep tasks to **3–7 items**. No rabbit holes.

---

### Phase 2 — EXECUTE

Carry out every planned task. Always produce full, runnable output — no stubs, no `// TODO`.

**Outputs:**
- Code files (full relative path as comment header)
- Config files (Dockerfiles, docker-compose, `.env.example`, CI YAML)
- Schema (SQL migrations, EF Core models)
- CLI commands (copy-pasteable with context)
- Folder scaffolding if starting fresh

**Frontend Design (when `UI? YES`) — load `references/frontend-design.md` before writing any UI**

Applies to: `react-ts`, `blazor`, `flutter`, `winui`. Follow the full process in that file:
- Ground the design in the subject's world before touching code
- Run the two-pass process: token system first (palette, type, layout, signature), then critique against the brief before building
- Avoid the three AI-generated defaults (cream+serif+terracotta, dark+acid-green, broadsheet hairlines) unless the brief explicitly calls for them
- Apply restraint: one bold signature element, everything else disciplined
- Write copy as design material — active voice, user-side language, consistent vocabulary across the flow
- Stack-specific: map the confirmed token system to `ThemeData` (Flutter) or `ResourceDictionary` (WinUI) — never ship the framework's default accent colour

**Stack conventions:**
- Flutter / WinUI → `references/flutter-winui-pattern.md`
- SaaS / DaaS / AIaaS → `references/[type]-pattern.md`

**Playwright screenshots (when `UI? YES` and `playwright` is in the stack)**

Follow `references/testing-ci-pattern.md` → Screenshots section: every new screen or component
gets at least one explicit screenshot saved to `test-results/screenshots/`, and components built
via `frontend-design.md` get a `toHaveScreenshot` baseline so future loops can't silently
regress the confirmed design. Verify phase checks for this — see below.

---

### Phase 3 — VERIFY

Check every task against `DONE WHEN`.
Always run the inline code-review checklist.
Run the security checklist when `SECURITY? YES` (or auto-triggered — see Phase 1).

---

#### Inline Code Review (every loop — `engineering:code-review`)

Apply the following checks to all code produced this loop:

- [ ] No N+1 queries or unbounded loops
- [ ] Null / empty / overflow edge cases handled
- [ ] Errors propagated — no silent swallows
- [ ] Type safety enforced end-to-end
- [ ] No hardcoded secrets or credentials anywhere in output
- [ ] If `UI? YES` + `playwright` in stack: new screens have an explicit screenshot, not just on-failure capture

Flag any failures as `CODE-REVIEW: ISSUES` and carry them forward to Iterate.

---

#### Security Review (when `SECURITY? YES`)

Load `references/security-review.md` and follow its full process:
severity scale, quick checklist, layer routing, and verify output format are all in that file.
Load the relevant layer file(s) it points to for deeper per-layer checks.

---

#### Verify Output (caveman-compressed):

```
[VERIFY] Loop N
DONE? [YES|NO|PARTIAL]
COMPLETED: [what was delivered]
CODE-REVIEW: [PASS | ISSUES: ]
SECURITY: [PASS | SKIPPED | CRITICAL:  | HIGH:  | WARN: ]
GAPS: [what is missing]
NEXT: [continue→loop N+1 | present→user | blocked→ask]
```

- `DONE=YES + PASS` → present to user, ask: **continue or stop?**
- `DONE=NO/PARTIAL` → Iterate
- `SECURITY=CRITICAL` → fix before iterating. Never ship a critical.

---

### Phase 4 — ITERATE

Feed gaps forward. Increment loop counter.

```
[ITERATE] → Loop N+1
CARRYING: [gaps + open code-review / security findings]
```

Restart at Phase 1.

---

## Stack Menu

**Frontend**
- `react-ts` — React + TypeScript (Vite, Tailwind, shadcn/ui) → `references/frontend-design.md`
- `blazor` — Blazor (.NET 8, MudBlazor or Radzen) → `references/frontend-design.md`
- `flutter` — Flutter / Dart (mobile + desktop) → `references/frontend-design.md` + `references/flutter-winui-pattern.md`
- `winui` — WinUI 3 (Windows App SDK, C#) → `references/frontend-design.md` + `references/flutter-winui-pattern.md`

**Backend**
- `node` — Node.js (Fastify, TypeScript, Zod)
- `dotnet` — C# .NET 8 (Minimal API or Controllers, Scalar docs)
- `python` — Python (FastAPI, Pydantic, async-first) → `references/python-pattern.md`

**Database**
- `postgres` — PostgreSQL (Docker-composed, Flyway or EF Core migrations)

**AI / ML**
- `huggingface` — HuggingFace Transformers (hosted or local)
- `yolov8` — YOLOv8 (Ultralytics, Python REST wrapper)
- `alpaca` — Alpaca / LLaMA (fine-tuning, LoRA, llama.cpp)

**Infrastructure**
- `docker` — Docker (multi-stage builds, docker-compose)
- `vercel` — Vercel (Next.js or static React, preview deploys)

**Integrations**
- `stripe` — Stripe (webhook handler + subscription) → SECURITY? YES
- `playwright` — Playwright (e2e scaffold + matrix CI) → `references/testing-ci-pattern.md`
- `github` — GitHub Actions (CI/CD, branch protection)
- `openapi` — OpenAPI + Scalar (spec-first, auto docs)

---

## Reference Files

| File | Load when |
|------|-----------|
| `references/saas-pattern.md` | TYPE includes SaaS |
| `references/daas-pattern.md` | TYPE includes DaaS |
| `references/aiaas-pattern.md` | TYPE includes AIaaS |
| `references/flutter-winui-pattern.md` | Stack includes `flutter` or `winui` |
| `references/testing-ci-pattern.md` | Stack includes `playwright`, or any GitHub Actions CI step |
| `references/python-pattern.md` | Stack includes `python` |
| `references/caveman.md` | Session start — always load |
| `references/security-review.md` | `SECURITY? YES` in any Verify phase |
| `references/frontend-design.md` | `UI? YES` in any Plan phase |
| `references/backend-security.md` | Security step touches backend / DB / Stripe / AI |
| `references/frontend-security.md` | Security step touches any UI layer |
| `references/infra-security.md` | Security step touches Docker / GitHub / Vercel |

---

## Loop Rules

1. **One step at a time** — never plan beyond the next concrete deliverable
2. **Verify before iterating** — no blind loops
3. **UI triggers design** — always read `references/frontend-design.md` before any visual layer
4. **Always inline code-review** — every Verify runs the review checklist
5. **Never ship a CRITICAL** — block iteration until resolved
6. **Ask before context switch** — confirm before resetting goal mid-loop
7. **Caveman planning, full code** — compressed phases, complete runnable output
8. **Stack discipline** — never introduce unlisted tools without asking
9. **Loop cap** — after 10 loops, surface a progress summary and ask user to confirm direction

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [lakreame](https://github.com/lakreame)
- **Source:** [lakreame/build-loop](https://github.com/lakreame/build-loop)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-lakreame-build-loop-build-loop
- Seller: https://agentstack.voostack.com/s/lakreame
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.