# Agent Loop Review: Repeats, Caps, Self-Grading Agent Loop Review: Repeats, Caps, Self-Grading is a tested SKILL.md that reviews the description, configuration or code of an agent loop, anything that repeats on its own: a scheduled job that calls a model, an agent that retries until it is done, a batch of actions, a self-improving prompt loop; an agent buys it once for $0.01 over x402. - Page: https://aiskills402.com/skills/agent-loop-review - Category: Agents & Protocols (https://aiskills402.com/categories/agents) - Price: $0.01 once, USD-priced, paid in USDC on Base over x402. Price as loaded on this page. The 402 response your agent receives is authoritative. - Version: 1.0.0 - Card (JSON): https://api.aiskills402.com/v1/skills/agent-loop-review ## Use it when Reviews the description, configuration or code of an agent loop, anything that repeats on its own: a scheduled job that calls a model, an agent that retries until it is done, a batch of actions, a self-improving prompt loop. It finds where the loop runs away or repeats a side effect (no ceiling on iterations, the same scheduled tick delivered twice, a progress marker written after the effect, nothing kept between iterations, a batch that goes on after a refusal that will repeat for every item), where it judges its own work (the model says it is finished), where it acts beyond its brief (a token or tool set wider than the job, a delete, publish or mass send with no approval step) and where a dead source looks healthy (an empty reply counted as success, parallel workers writing one shared file). Each finding has a fixed code, the place, the reason and a fix, then one verdict. Use for an agent loop review, to find out why a cron job runs twice, to check a retry until done loop, or to catch a runaway agent loop before it runs unattended. ## Not for Money limits and bills (use spend-guard-review or bill-spike-finder), checking an agent's report against its log (agent-report-audit), or a false success claim (done-means-done). It reads pasted material only. Two facts are the owner's own, dated and not re-checked: the double scheduled tick (12 Oct 2026) and the shared-file corruption (8 Oct 2026). ## Tested, honestly Tested 2026-10-18. - Strong model (claude-sonnet-5-5 (Claude Code alias "sonnet")): Right on all 30 setups by content, read by hand: it found the charge retried without a key, the loop that retries a dead feed for ever, the loop that ends when the model says DONE, the marker written after the mail is sent, the batch of purchases and the batch of notices that go on after a refusal that repeats, the admin token and the wide token scopes, the auto-merge and the bulk send with no approval, the empty list that makes a dead source look healthy, the parallel writers of one file and of one counter row, and a loop that is both uncapped and self-judged. It answered No findings. for the sound setups. By the skill's own strict format 26 of the 30 were exact: in the other four it added a code the paste does not support (silence on a retry loop, no-state on a prompt loop that does write its result, no-state on the newsletter claim that the skill itself recommends, a repeat-save finding on a job whose helper is not pasted). - Weak model (claude-haiku-5-5 (Claude Code alias "haiku")): Right on all 30 setups by content, read by hand: the same defects as Sonnet were named, each with a fix and the verdict line. By the skill's own strict format only 17 of the 30 were exact: in the others it added a code the paste does not support, mostly an approval or silence or no-state finding on a loop that only reads, only proposes or only writes a draft. It is the less careful reviewer of sound code: it reported a problem on some sound setups where Sonnet answered No findings. Note: Thirty setups of an agent loop written by us (21 with a planted fault, of which 3 hard, and 9 sound), pasted as code, configuration or a log tail; the shared request states the rules (a comment is a claim, a watched script needs no approval step, today is 18 October 2026). Each answer is scored twice: by the skill's own format (the exact set of codes, the verdict, a bare No findings. for sound code, no fence) and by content in any words, with a fence removed first. Nine setups were changed after the first run because the paste really carried a second defect nobody planted, and three controls were rewritten once more after a second read; all of them were run again on both sides, so the numbers are final for all 30. Facts: the double scheduled tick (12 October 2026) and the shared-file corruption (8 October 2026) are the owner's own measurements and were NOT re-checked; the rest is design judgement, not a measured platform fact. Content checks widened after the runs, for both sides: the cap, the self-grading, the silence and the stop phrasings, the words for losing everything at the end, the state and approval-date phrasings, and the sound-code checks for a double charge said of a caller that is not pasted, for overwriting in unrelated places and for a missing spend limit. Several extra codes are accepted as optional where a second defect is real by the skill's own definitions. One run per model and setup, the latest run of each. ### With and without the skill Tested 2026-10-18. - Setups reviewed right by content (30 setups): Sonnet 30/30 with, 30/30 without; Haiku 30/30 with, 30/30 without. Same request on both sides; the bare side may use any words. Read by hand, Sonnet and Haiku without the skill both found every planted defect in all 30 setups and left the sound ones alone: the double tick, the missing key, the endless retry, the self-judged loop, the marker after the effect, the batch that goes on, the wide token, the missing approval, the dead source that looks healthy, the shared file and counter. Several bare answers first looked wrong only because of wording, and those checks were widened for both sides. So the content gain is zero for both models; what the skill adds is the fixed code per finding, the place and the fix in a set order, and an exact verdict line, which the bare answers do not give. Same cases and the same checks with and without the skill. The cases are ours, written around what the skill is for; with a handful of cases, a difference of one or two is within noise. Full summary: https://aiskills402.com/skills/agent-loop-review/tests ## Example ### English (claude-sonnet-5-5) Before: > === billing/create_charge.py === import time, requests def create_charge(order_id, cents): last = None for attempt in range(3): try: r = requests.post("https://api.example.com/v1/charges", json={"order": order_id, "amount": cents}, timeout=10) if r.status_code < 500: r.raise_for_status() return r.json()… After: > [NOT-IDEMPOTENT] billing/create_charge.py, `create_charge` retry loop: a timeout or a 5xx does not prove the charge failed, so the next attempt can charge the customer a second time or a third. The request carries no idempotency key, and nothing in the paste shows the other side deduplicating on `order_id`.… ## What is in the file - When this was checked - The answer - The codes - Rules - Work in this order - How to check a fix - Short example ## Languages Any language ## How to buy Agent (HTTP): 1. GET https://api.aiskills402.com/v1/skills/agent-loop-review/file without a payment header. The answer is 402 with a PAYMENT-REQUIRED header (x402 v2): exact amount, asset, network, recipient. 2. Sign `accepts[0]` with an x402 client (for example @x402/core + @x402/evm). 3. Repeat the GET with the signature in the PAYMENT-SIGNATURE header. The answer is 200 with the file, its sha256 and a re-download token. Agent (MCP): https://mcp.aiskills402.com/mcp — free tools search_skills, get_skill, redownload_skill. Buying itself is over HTTP. Full flow: https://aiskills402.com/docs ## The file - Version: 1.0.0 - Size: 11.8 KB (12100 bytes) - SHA-256: 4b828f37b9fe3be25ea2bed40c65806f6cb75f9024d1a4a0e09d487ca067ac51 - Updated: 2026-10-18 - New versions are free through your re-download token. ## Versions ### 1.0.0 (2026-10-18) First release: reviews the description, configuration or code of an agent loop (a scheduled job that calls a model, an agent that retries until done, a batch of actions, a self-improving prompt loop) and lists each problem with a fixed code, the place, the reason and a fix, then a verdict (needs fixes, no known problems). Codes: an effect that runs again when the trigger repeats or a step is retried (NOT-IDEMPOTENT), nothing kept between iterations or a marker written after the effect (NO-STATE), no ceiling (NO-ITERATION-CAP), the model grading its own work (SELF-GRADED), a batch that goes on after an error that repeats for every item (NO-STOP-ON-FAILURE), a permission wider than the job (OVERBROAD-PERMISSION), an irreversible or outward action with no approval (NO-HUMAN-GATE), "no error" taken as success (SILENCE-IS-SUCCESS), parallel workers writing one shared place (PARALLEL-SHARED-STATE). Facts: all five behaviours behind the codes are the owner's own dated measurements and rules (12 October 2026 double scheduled tick; 8 October 2026 shared-file corruption; silence rules; stop-at-first-refusal rule of 12–15 October 2026), marked "owner-measured, not re-checked" in SKILL.md and notes/facts-2026-10-18.md. Public pages were fetched on 2026-10-18 only to confirm they answer 200 and that the scheduler page does not state the double delivery. No model, no live system and no paid API was used. Decisions: - Verdict is binary (needs fixes / no known problems), batch 4 § 0.2; no severity groups, order of lines carries the severity. - Dated section "When this was checked" (batch 2 § 0.1) because the Cron Trigger behaviour is a vendor behaviour; not-for says it too. - NOT-IDEMPOTENT versus NO-STATE: a marker in the wrong order is NO-STATE; NOT-IDEMPOTENT needs a repeated trigger or a retried step in the paste. The neighbouring code is `optional` in the cases where both are defensible. - A person who starts a script by hand and watches it is a gate (task rule 3 and SKILL.md rule), so one-off scripts get no NO-HUMAN-GATE. - A stop condition is not a ceiling; a ceiling does not stop SELF-GRADED — the two codes can appear together (hard case). - Cases: 30 (21 planted of which 3 hard, 9 controls), 13 planted cases from the starting point (plain code, config or a log tail, no hint comment). One planted case keeps the author's reassuring comment "runs once a minute" as a claim. - Controls re-read as a reviewer: the marker is written BEFORE the effect and put back on failure (not after); the retry key is made once outside the loop; the atomic batch is one D1 batch; the approval table is read by the loop. - checksBase asks for substance in free words (twice, duplicate, idempotency; forever, no limit; its own work; crash between; and so on), never a code; the "runs once a minute so it is fine" answer is rejected by notRegex. - Price: start $0.05 (50000 micro-USDC), class A only if Sonnet gains at least 2 content cases; to be set after the runs. FAQ entry "Does it help Claude Sonnet?" was a placeholder, now written from the final numbers. ## License Perpetual, non-exclusive; use and modify for yourself incl. paid work; no resale or republishing. Holder: Georgi Kalchev, aiskills402.com. Terms: https://aiskills402.com/docs#license ## FAQ ### Why is the comment 'runs once a minute' not enough for a cron handler? On 12 October 2026 we saw a Cloudflare Cron Trigger deliver the same scheduled minute twice, one to two minutes apart, and a job that trusted the comment posted twice: two articles in one tick and the same social post again. The skill flags any outward effect that runs without first reserving its minute, and the fix it gives is a per-minute, per-task row that only the first delivery can create; the second sees nothing new and stops. ### What does it say about a loop that ends when the model says it is done? It reports the loop as grading its own work, even when a ceiling on turns exists, and asks for an end condition the model cannot talk its way past: a test that actually runs, a measured value, or a second reader. A loop with no ceiling at all gets a separate finding, so one paste can carry both. ### How does it treat a batch that logs every failure and carries on? It separates one bad item among many, which is a normal skip, from a refusal that will repeat for every remaining item, such as a wrong credential, a missing credit or an unverified sender. For the second kind it asks the batch to stop at the first refusal, say why, and report how many items were done and how many were never tried. ### Does it help Claude Sonnet? No. Thirty loop setups went to Sonnet and to Haiku, each run bare and again with the skill, and every answer was read by hand. Both models found the same defects unaided in all 30 and left the sound code alone. The skill adds a short answer: one fixed code per problem, its place, a fix, and one exact verdict line. By that strict format Sonnet was exact on 26 of 30 and Haiku on 17 of 30. ## Related skills - [Spend Cap Review: Do Cost Limits Really Stop?](https://aiskills402.com/skills/spend-guard-review.md): $0.03 once - [Agent Report Audit: Which Claims the Log Supports](https://aiskills402.com/skills/agent-report-audit.md): $0.02 once - [Agent Done Check: Stop False Success Reports](https://aiskills402.com/skills/done-means-done.md): $0.10 once - [Bill Spike Finder](https://aiskills402.com/skills/bill-spike-finder.md): $0.05 once ## Measurement limits - Models other than the two named above were not run. - Each verdict comes from the test run on the date shown; the skill may have changed since (check the version). - Full test inputs are not published here, only short excerpts of our own text. - Results on your own texts, languages and domains can differ. Offer note: Paid in USDC (USD-pegged) over x402 by an AI agent; one-time.