incremental-implementation

An agent skill by addyosmani, from addyosmani/agent-skills. Tags: debugging, developer-tools.

What it does

Delivers changes incrementally in thin, verifiable slices. Use when implementing any feature or change that touches more than one file, or when picking up the next task from a plan. Use when rolling a change out behind a feature flag, when you're about to write a large amount of code at once, or when a task feels too big to land in one step.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add addyosmani/agent-skills --skill incremental-implementation

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/addyosmani/agent-skills
cp -r agent-skills/skills/incremental-implementation ~/.claude/skills/incremental-implementation

Safety box score

Grade B, low risk: 11 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This is a documentation-only workflow skill that tells the agent to implement changes in small slices, run tests/builds, and commit after each slice. It does not ship code or scripts, but it does increase the likelihood of command execution inside the target repo, and one checklist example uses `npx`, which may reach out to npm if the tool is not already installed locally.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	It explicitly tells the agent to run repository commands such as `npm test`, `./gradlew test`, `pytest`, and `npx tsc --noEmit` after each increment.
Network access	1 (low)	There is no direct remote access, but the checklist includes `npx tsc --noEmit`, which can fetch from npm when TypeScript is not installed locally.
Filesystem reach	1 (low)	The skill assumes the agent will edit project files and create commits, but it does not mention paths outside the working tree or home directory.
Secrets & credentials	0 (none)	The skill does not ask for tokens, passwords, `.env` files, browser sessions, or other credentials.
Privilege & persistence	0 (none)	It does not request sudo, global installs, services, scheduled tasks, or shell/OS configuration changes.
Instruction hijack surface	0 (none)	There is no prompt-injection content, hidden text, or instruction to ignore higher-priority rules.
Irreversible actions	0 (none)	It requires commits and verification, but does not deploy, publish, send messages, pay, book, or delete anything external.
Transparency	0 (none)	The skill is plain markdown only; there are no binaries, embedded installers, or unreadable blobs.

Before installing

Confirm the repo's test/build commands do not run deploys or write outside the workspace.
If you want to avoid package downloads, replace `npx ...` with a locally installed tool in your environment.
Make sure your branch/CI workflow is compatible with committing after each slice.

Rated 2026-10-16 by an automated review of 1 file from the skill's repository.

Source

Repository: addyosmani/agent-skills (all skills from this repository)
Path: skills/incremental-implementation/SKILL.md
Branch: main
Updated: 2026-09-19

c-review — Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities.
code-improver — Runs an autonomous review-and-fix improvement loop over any code target — a skill, plugin, module, or directory — using a reviewer the user names.
dwarf-expert — Analyzes DWARF debug information in compiled binaries.
modern-cpp — Guides C++ code toward modern idioms (C++20/23/26). Use when writing new C++ code, modernizing legacy patterns, or working on security-critical C++.
pr-improver — Runs an autonomous review-and-fix improvement loop over the current branch's changes until a PR review comes back clean.
rust-review — Performs comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS.