bdfinst/agentic-dev-team

آخر نشاط مصدر مسجل: ٣ أكتوبر ٢٠٢٦ في ١٣:٤٦

آخر تحديث لفهرس SkillsMP: ٢ نوفمبر ٢٠٢٦ في ١٨:٠٢

skills مجمعة: ١١٥

نجوم GitHub: ٢٩٩
تفرعات GitHub: ٣٦

التثبيت بمساعدة مساعد ذكي

انسخ هذا الطلب إلى المساعد الذكي الذي تستخدمه.

Follow https://skillsmp.com/skill-install/prompt.md to install Agent Skills from https://github.com/bdfinst/agentic-dev-team.

ملف README للمستودع

مصدر ملف README للمستودع: README.md

قراءة الملف الأصلي

عرض ملف README كاملًا

# Agentic Dev Team [![Plugin tests](https://github.com/bdfinst/agentic-dev-team/actions/workflows/plugin-tests.yml/badge.svg?branch=main)](https://github.com/bdfinst/agentic-dev-team/actions/workflows/plugin-tests.yml) [![Docs checks](https://github.com/bdfinst/agentic-dev-team/actions/workflows/link-check.yml/badge.svg?branch=main)](https://github.com/bdfinst/agentic-dev-team/actions/workflows/link-check.yml) [![Docs deploy](https://github.com/bdfinst/agentic-dev-team/actions/workflows/docs.yml/badge.svg?branch=main)](https://github.com/bdfinst/agentic-dev-team/actions/workflows/docs.yml) 📖 **[Documentation](https://devteam.bryanfinster.com/)** Three Claude Code plugins for engineering workflows. Install one or all. - **`dev-team`** gives Claude Code a full persona-driven development team. It includes an Orchestrator that routes tasks, specialist agents (engineer, QA, architect, reviewers…), skills that encode reusable knowledge, and the four-command feature workflow `/specs → /plan → /build → /pr`. - **`security-assessment`** is the security companion. It adds a tool-first `/security-assessment` pipeline (SAST + AI judgment + false-positive filtering + executive report), a `/cross-repo-analysis` command for multi-repo attack chains, and an adversarial ML red-team harness (`/redteam-model`) for self-owned model endpoints. - **`marketplace-dev`** is the plugin-author's toolkit. It scaffolds new plugins and marketplaces (`/scaffold-plugin`, `/scaffold-marketplace`, `/init-plugin-eval`). It audits any plugin for structural compliance (`/plugin-audit`). It advises on the markdown-vs-script agent decision (`/agent-type-advisor`). It also ships the migrated agent/skill authoring toolkit (`/agent-create`, `/agent-add`, `/agent-remove`). `dev-team` is the foundation. It owns the shared data contract (`codebase-recon`, `ACCEPTED-RISKS.md`, unified finding format) that `security-assessment` builds on. Install `dev-team` first, and add `security-assessment` when you need it. `marketplace-dev` is independent. It has no hard dependency on `dev-team`, so you can install it on its own to build or maintain plugins. ## Plugins | Plugin | What it does | Key commands | Required tools | Optional tools | | --- | --- | --- | --- | --- | | **[dev-team](plugins/dev-team/README.md)** | Persona-driven development team, reviewer swarm, TDD-gated build loop | `/specs`, `/plan`, `/build`, `/pr`, `/code-review`, `/triage` | `jq`, `gh` | `semgrep`, `playwright`, `hadolint`/`trivy`/`grype`; auto-detected formatters and test/type/lint runners | | **[security-assessment](plugins/security-assessment/README.md)** | Tool-first security assessment + red-team pipeline | `/security-assessment`, `/cross-repo-analysis`, `/redteam-model`, `/export-pdf` | `dev-team`, Python ≥ 3.10, tier-1 SAST (`semgrep`, `gitleaks`, `trivy`, `hadolint`, `actionlint`) | `grype`, PDF-export deps | | **[marketplace-dev](plugins/marketplace-dev/README.md)** | Scaffold, audit, and maintain Claude Code plugins and marketplaces | `/scaffold-plugin`, `/scaffold-marketplace`, `/plugin-audit`, `/agent-type-advisor`, `/agent-create` | `jq` | `git` | Plugin names link to each plugin's README, where the full tool list and per-tool install commands live. This table assumes you have Claude Code. **First time here?** Start with `dev-team`. Add `security-assessment` only when you run full `/security-assessment` pipelines against target repos. Add `marketplace-dev` when you build or maintain plugins. ## Getting started New here? The **[Getting Started guide](GETTING-STARTED.md)** is the full walkthrough. It covers installing each plugin, configuring a project, the day-to-day workflow, and the diagnostic commands. Quick install of the core plugin: ```bash claude plugin marketplace add bdfinst/agentic-dev-team claude plugin install dev-team@bfinster ``` Then run `/setup` in your project. The [Getting Started guide](GETTING-STARTED.md) covers the optional plugins (`security-assessment`, `marketplace-dev`), self-hosted git hosts, install scopes, and the `/upgrade` flow. ## Dev team workflow Four commands drive feature development from idea to pull request: ```text /specs → /plan → /build → /pr ``` | Step | Command | What it does | |----------------|----------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **1. Specify** | `/specs` | Describe the change and its goals — Intent, Architecture notes, Acceptance Criteria. A consistency gate must pass before you move on. Skip for bug fixes, refactors, or trivial changes. | | **2. Plan** | `/plan` | Decompose the feature into vertical slices, author each slice's Gherkin scenarios, and lay out the TDD steps that satisfy them. Up to five plan-review personas (Acceptance Test, Design, UX, Strategic, Parallelization critics), scaled to the plan tier, challenge the plan before the human sees it. The human approves before any code is written. | | **3. Build** | `/build` | Execute the approved plan slice by slice. Each step follows RED-GREEN-REFACTOR with inline review checkpoints (spec-compliance first, then quality agents). It produces verification evidence. | | **4. Ship** | `/pr` | Run quality gates (tests, typecheck, lint, code review) and open a pull request. | Each step produces artifacts that the next step consumes. The spec describes *what* and *why*. The plan turns the spec into per-slice behavioral contracts (Gherkin) and *how*. Human review gates sit between transitions. ![Workflow: specs → plan → build → pr](plugins/dev-team/docs/diagrams/workflow-linear.svg) For bug fixes or simple tasks, skip `/specs` and start at `/plan`, or go straight to implementation. ### Supporting commands The table below lists representative supporting commands. For the full catalog with options and descriptions, see the skills page of each plugin: **[dev-team skills](plugins/dev-team/docs/skills.md)** · **[security-assessment skills](plugins/security-assessment/docs/skills.md)** · **[marketplace-dev skills](plugins/marketplace-dev/docs/skills.md)**. | Command | Plugin | When to use | | --- | --- | --- | | `/code-review` | dev-team | Run review agents, auto-fix actionable issues, re-run until clean (up to 5 iterations) | | `/continue` | dev-team | Resume an in-progress build or plan across sessions | | `/test-improve` | dev-team | Consolidated analyze-then-improve test orchestrator. Ten phases (0-9) with human gates. Lightweight by default. Opt into Gherkin / mutation / refactor-for-testability on demand | | `/browse` | dev-team | Visual QA via Playwright | | `/benchmark` | dev-team | Runtime performance metrics (Core Web Vitals, resource sizes) against baselines | | `/careful` / `/freeze` / `/guard` | dev-team | Safety modes for production-critical sessions | | `/triage` | dev-team | Investigate a bug and file a GitHub issue with a TDD fix plan | | `/security-assessment` | security-assessment | Full pipeline: recon → tools → agents → FP-reduction → exec report | | `/redteam-model` | security-assessment | Adversarial ML red-team probes against a self-owned model endpoint | | `/plugin-audit` | marketplace-dev | Structural compliance check for any Claude Code plugin | | `/scaffold-plugin` | marketplace-dev | Create a new plugin skeleton that passes audit with zero findings | ### Automated pre-commit review `/code-review` automatically gates every `git commit`. A `PreToolUse` hook detects commit attempts and blocks them until a passing review exists for the exact set of staged files. **Flow**: attempt commit → hook blocks → Claude runs `/code-review` → if pass/warn, Claude writes a `.review-passed` gate file → next commit attempt succeeds. **Bypass**: `git commit --no-verify` skips the review gate. ## Security assessment pipeline `/security-assessment <path>` runs a six-phase pipeline against one or more target repos. Deterministic tools do the detection. LLM agents handle the judgment stages. | Phase | Runs | Output | | --- | --- | --- | | **0. Recon** | `codebase-recon` agent | `memory/recon-<slug>.{json,md}` | | **1. Tool-first detection** | semgrep, gitleaks, trivy, hadolint, actionlint, custom rulesets | unified findings stream | | **1b. Judgment** | `security-review`, `business-logic-domain-review` agents | appended findings | | **1c. Suppression** | `ACCEPTED-RISKS.md` gate (deterministic) | filtered stream + audit log | | **2. False-positive filter** | 5-stage check (reachability, environment, controls, dedup, severity) | decisions log | | **2b. Severity floors** | deterministic domain-class calibration | floor-adjusted scores | | **3. Narrative + compliance** | `tool-finding-narrative-annotator`, compliance-mapping skill | 4-domain narrative + compliance JSON | | **4. Cross-repo** | service-comm parser, shared-cred hash match (multi-target only) | mermaid diagram + SARIF | | **5. Exec report** | `exec-report-generator` agent | publication-ready 7-section markdown | **Zero-install flow**: `scripts/run-assessment-local.sh` runs the same pipeline from the repo checkout without installing the plugin. The script auto-detects the `claude` CLI and degrades to deterministic-only when the CLI is absent. See [the user guide](plugins/security-assessment/docs/user-guide-security-assessment.md) for the full runbook. **Adversarial ML red-team**: `/redteam-model` probes a self-owned model endpoint (localhost / private network by default; public targets require a signed `authorization.md`). Eight probes cover discovery, evasion, data extraction, and report synthesis. --- ## Contributing Developing, testing, or releasing the plugins? See **[CONTRIBUTING.md](CONTRIBUTING.md)**. It covers local-dev setup (including live installs via symlinks), the `/agent-eval` and `/agent-audit` test commands, the security comparative-testing harness, how to add agents and skills, and the release process. **`/code-review` benchmark harness** ([`evals/code-review-benchmark/`](https://github.com/bdfinst/agentic-dev-team/blob/main/evals/code-review-benchmark/README.md)): checks out real, known-defect commits from Defects4J (Java) and BugsJS (JavaScript), runs `/code-review` against the buggy revision, and scores whether its findings cover the real defect. The harness also produces a dedicated Missed Defects report. Adapters and scoring are unit-tested against real fetched dataset samples. A live sweep against the actual corpora requires a local Defects4J/BugsJS install (see the harness README for prerequisites and usage). ## Documentation The full documentation lives at **[devteam.bryanfinster.com](https://devteam.bryanfinster.com/)**, with search and complete navigation. It covers architecture, model routing, the eval system, telemetry, ADRs, and experiment reports. Start here: | Doc | Covers | | --- | --- | | [Getting Started](GETTING-STARTED.md) | Install, the workflow, suggested skills, worked examples | | [Contributing](CONTRIBUTING.md) | Local development, testing, adding agents/skills, releasing | | [Plugin Development Guide](https://github.com/bdfinst/agentic-dev-team/blob/main/CLAUDE.md) | Project North Star, repo structure, working rules | Per-plugin docs: **[dev-team](plugins/dev-team/README.md)** · **[security-assessment](plugins/security-assessment/README.md)** · **[marketplace-dev](plugins/marketplace-dev/README.md)**. Each plugin's README is the entry point to its architecture, commands, and deeper guides. ## CodeGraph This repository uses [CodeGraph](https://github.com/colbymchenry/codegraph) for semantic code intelligence.

جارٍ تحميل ملف README للمستودع…

Skills في هذا المستودع

مطوّرو البرمجيات محللو ضمان جودة البرمجيات والمختبرون المهن الحاسوبية الأخرى محللو أمن المعلومات

٧ فئات مهنية · 89% مصنفة

skill

المهنة

الوصف

آخر تحديث

adr-tools

غير مصنف

Create and manage Architecture Decision Records using the npryce adr-tools CLI. Use when the user asks to "add an ADR", "record this decision", "create an ADR", "supersede ADR N", "link ADRs", "generate the ADR table of contents", or any request involving the…

لغة النص الأصلي: الإنجليزية

2026-10-03

design-doc

غير مصنف

Produce a written design document in docs/specs/ with user approval before planning begins. Use this skill during the Research phase when a feature request, architectural change, or non-trivial task enters the pipeline. Ensures misunderstandings are caught…

لغة النص الأصلي: الإنجليزية

2026-10-03

specs

مطوّرو البرمجيات

Collaborative workflow for producing the three specification artifacts (intent, architecture notes, acceptance criteria) that describe a change and its goals before any implementation begins. Its value is resolving ambiguity with a human before build starts —…

لغة النص الأصلي: الإنجليزية

2026-10-03

ubiquitous-language

غير مصنف

Build or refresh the project's ubiquitous language glossary — one markdown file per business concept at `.plans/domain/<Concept>.md` plus a `_index.md`. Mines grep-based signals (class names, enum values, interface names, domain-event names, BDD scenario…

لغة النص الأصلي: الإنجليزية

2026-10-03

build

غير مصنف

Execute an approved implementation plan in small per-behavior batches. Reads the plan, implements each step one behavior at a time in the Code-First Small Batches cadence with a refactor on every green, runs inline review checkpoints, and produces…

لغة النص الأصلي: الإنجليزية

2026-10-01

code-review

غير مصنف

Run all enabled review agents against target files. Use this whenever the user asks for a code review, wants feedback on their code, says "review my code", "check this before I PR", "what's wrong with this", "run the agents", or has just finished implementing…

لغة النص الأصلي: الإنجليزية

2026-09-30

context-loading-protocol

غير مصنف

Decide which agents and skills to load for a given task. Use at the start of every task to select the minimum viable context load, calculate the token budget, and stay below the 40% utilization ceiling.

لغة النص الأصلي: الإنجليزية

2026-09-30

handoff

غير مصنف

Compress or split off context for another session to pick up. Use to compress conversation history when context utilization approaches 40% (continue mode), or to split off a distinguishable out-of-scope side-task to an independent session (fork mode) — write…

لغة النص الأصلي: الإنجليزية

2026-09-30

source-verification

غير مصنف

Extract and verify factual claims in generated content (docs, diffs, review comments) against this repo's own code and, where needed, external sources. Use before publishing content that asserts specific behavior, version numbers, or API details — anywhere a…

لغة النص الأصلي: الإنجليزية

2026-09-30

setup

غير مصنف

Provision a repo for the dev-team plugin end to end — install the plugin's own prerequisites (jq, python3, per-language mutation tooling — Stryker, pitest, Stryker.NET), then generate dev-team-specific project configuration — project-level CLAUDE.md, the…

لغة النص الأصلي: الإنجليزية

2026-09-30

agent-readiness

غير مصنف

Score how ready the current repository is for AI-assisted development against the Agent-Readiness Scorecard. Use when the user asks "how agent-ready is this repo", "score this repo for agents", "agent readiness", or wants a tiered readiness report. Scores…

لغة النص الأصلي: الإنجليزية

2026-09-30

ship

غير مصنف

Run the full spec-to-merge pipeline as one command: spec, plan, small-batch build, code review, and a PR with auto-merge — pausing at the existing human gates. Idempotent per issue — a re-invocation for work already shipped or in-flight resumes/monitors…

لغة النص الأصلي: الإنجليزية

2026-09-30

agent-eval

غير مصنف

Run eval fixtures against review agents and grade results. Use this after adding or modifying a review agent, to validate detection accuracy, or when the user says "run the evals", "test the agents", "check for regressions", or "how accurate is the agent".

لغة النص الأصلي: الإنجليزية

2026-09-23

property-based-testing

غير مصنف

Generate a runnable property-based test for a target function from its signature/docstring — a round-trip test when an encode/decode pair exists, or an invariant test when the docstring documents a postcondition (e.g. "returns sorted", "is idempotent").…

لغة النص الأصلي: الإنجليزية

2026-09-22

mutation-testing

محللو ضمان جودة البرمجيات والمختبرون

Validate test suite quality by running a real mutation testing tool and triaging surviving mutants. Use after writing tests to verify assertions catch behavioral changes, when evaluating test coverage quality, or as a CI quality gate on critical modules. The…

لغة النص الأصلي: الإنجليزية

2026-09-21

stryker-xunit-v2-shim

محللو ضمان جودة البرمجيات والمختبرون

Build a xunit.v2 Stryker shim so Stryker.NET produces a valid mutation score for a xunit.v3 test project. Stryker.NET cannot observe mutant kills through xunit.v3 (it runs on the Microsoft Testing Platform), so a normal run reports a false near-zero score…

لغة النص الأصلي: الإنجليزية

2026-09-21

farley-score

محللو ضمان جودة البرمجيات والمختبرون

Evaluate test quality using Dave Farley's 8 properties with a weighted Farley Score. Use when reviewing test suites, after writing tests, or when the user says "score my tests", "test quality", "Farley score", or "how good are my tests".

لغة النص الأصلي: الإنجليزية

2026-09-08

test-design

محللو ضمان جودة البرمجيات والمختبرون

Deep test-design review and forward-design advisor. Dispatches test-review (tactical quality) and test-smell-review (xUnit smells, double selection, pyramid placement) in parallel, and runs the test-design-advisor worker to recommend how to test hard-to-test…

لغة النص الأصلي: الإنجليزية

2026-09-08

test-driven-development

محللو ضمان جودة البرمجيات والمختبرون

Advisory reference for the Classic RED-GREEN-REFACTOR TDD discipline with hard gates — not a build cadence toggle. The plugin's single build cadence is Code-First Small Batches (docs/experiments/RECOMMENDATIONS.md Rec 3); /build does not dispatch into this…

لغة النص الأصلي: الإنجليزية

2026-09-08

agent-audit

محللو ضمان جودة البرمجيات والمختبرون

Audit code-review agents, skills, and hooks for structural compliance. Use this when adding or modifying any agent, skill, or hook file, or for a periodic health check of the toolkit. Trigger phrases: "audit the agents", "check compliance", "validate the…

لغة النص الأصلي: الإنجليزية

2026-08-29

quality-gate-pipeline

محللو ضمان جودة البرمجيات والمختبرون

Unified quality gate for agent output — self-validation, verification evidence, and review-correction loops. Consolidates accuracy-validation, verification-before-completion, and task-review-correction into a single three-phase pipeline. Use before delivery,…

لغة النص الأصلي: الإنجليزية

2026-08-29

static-analysis-integration

محللو ضمان جودة البرمجيات والمختبرون

SARIF-first pre-pass stage for /code-review that runs available static analysis tools and normalizes their output to the unified finding envelope defined in security-primitives-contract v1.0.0. Deduplicates findings across tools and passes confirmed issues to…

لغة النص الأصلي: الإنجليزية

2026-08-29

pr

محللو ضمان جودة البرمجيات والمختبرون

Run a pre-PR quality gate (tests, typecheck, lint, code review) and then create a pull request with a structured summary. Use when the user says "create a PR", "open a PR", "submit for review", or "I'm done with this feature".

لغة النص الأصلي: الإنجليزية

2026-08-28

harness-audit

محللو ضمان جودة البرمجيات والمختبرون

Analyze review agent effectiveness, model routing, and orchestration complexity against actual usage data. Produces a report of harness components that may be candidates for simplification or removal. Use periodically to prevent harness staleness as model…

لغة النص الأصلي: الإنجليزية

2026-08-27

session-review

محللو ضمان جودة البرمجيات والمختبرون

Mine real Claude Code session transcripts to suggest plugin improvements that cut token spend, reduce re-work, and improve accuracy. Use when the user asks to "review my sessions", "where am I wasting tokens", "why does this keep re-doing work", or…

لغة النص الأصلي: الإنجليزية

2026-08-27

autoship

المهن الحاسوبية الأخرى

Orchestrate a bounded round of automated issue processing: reclaim orphaned in-progress issues, discover eligible `autoship:ready` issues, and invoke `/ship` sequentially for each — stopping at cost or count caps and surfacing blocked items without halting…

لغة النص الأصلي: الإنجليزية

2026-08-27

long-eval

مطوّرو البرمجيات

Run an eval that takes longer than one cloud-session container lifetime — agent calibration, prompt A/B sweeps, judge-panel scoring — so it survives the frequent container recycles that kill in-process work. Use when the user says "run this long eval", "the…

لغة النص الأصلي: الإنجليزية

2026-08-27

test-improve

محللو ضمان جودة البرمجيات والمختبرون

Consolidated analyze-then-improve test orchestrator. Defaults to lightweight ceremony; opts into heavier capabilities (Gherkin extraction, mutation testing, refactor-for-testability) only when the operator asks. Always baselines coverage (and mutation, when…

لغة النص الأصلي: الإنجليزية

2026-08-26

performance-metrics

مطوّرو البرمجيات

Log task completion data to .claude/metrics/. Use at the end of every task to record tokens, cost, agents used, rework cycles, and hallucination events. Also use for periodic reporting to identify efficiency and quality trends.

لغة النص الأصلي: الإنجليزية

2026-08-24

test-health

محللو ضمان جودة البرمجيات والمختبرون

Project-wide test-strategy audit — derive the suite's shape and shape-vs-architecture fit, map coverage to the Agile Testing Quadrants, roll up coverage + mutation health, flag flaky tests and automation maturity, and produce an ordered improvement plan.…

لغة النص الأصلي: الإنجليزية

2026-08-24

careful

مطوّرو البرمجيات

Toggle careful mode. When active, destructive commands (rm -rf, force-push, DROP TABLE, etc.) are blocked instead of just warned about.

لغة النص الأصلي: الإنجليزية

2026-08-06

claude-setup-review

المهن الحاسوبية الأخرى

Audit this project's Claude Code harness — CLAUDE.md completeness, rule clarity, skill and agent wiring, path accuracy, and agent frontmatter schema compliance. Use when the user says "review my CLAUDE.md", "audit my Claude setup", "is my Claude config…

لغة النص الأصلي: الإنجليزية

2026-08-06

coverage-baseline

محللو ضمان جودة البرمجيات والمختبرون

Multi-workflow coverage baseline worker. Detects the repo's coverage tool from its build manifest, runs it, records the resulting line+branch percentages as the baseline, and posts the number to the parent issue (or local `FEATURE.md`). This number is the…

لغة النص الأصلي: الإنجليزية

2026-08-06

fix

محللو ضمان جودة البرمجيات والمختبرون

Investigate a bug via /triage (or reuse an existing triage record), prove the defect reproduces, then implement the record's TDD Fix Plan one RED/GREEN cycle at a time with a regression check after each cycle, close the record, and delegate to /pr for a…

لغة النص الأصلي: الإنجليزية

2026-08-06

guard

مطوّرو البرمجيات

Activate both careful mode and freeze mode together. Blocks destructive commands and scope-locks editing to the specified pattern. Use for production-critical debugging sessions.

لغة النص الأصلي: الإنجليزية

2026-08-06

repo-review

محللو ضمان جودة البرمجيات والمختبرون

Whole-repository drift review for the review agents that a per-diff /code-review pass cannot meaningfully evaluate — accumulated file/CLAUDE.md size drift, AI-provenance verification debt, harness-config completeness, and cross-file frontend component…

لغة النص الأصلي: الإنجليزية

2026-08-06

freeze

مطوّرو البرمجيات

Scope-lock file editing to a specific glob pattern. Only files matching the pattern can be edited until /unfreeze is called.

لغة النص الأصلي: الإنجليزية

2026-08-05

mutation-night-watch

محللو ضمان جودة البرمجيات والمختبرون

Launch, schedule, and hand off an unattended, LLM-free overnight mutation night-watch run. Use when the user wants a mutation-score baseline waiting each morning without paying LLM cost or blocking a session overnight, says "run mutation testing overnight",…

لغة النص الأصلي: الإنجليزية

2026-08-05

unfreeze

مطوّرو البرمجيات

Lift the scope lock set by /freeze. All files become editable again.

لغة النص الأصلي: الإنجليزية

2026-08-05

help

مطوّرو البرمجيات

List the main dev-team workflows, with an option to show every user-invocable slash command.

لغة النص الأصلي: الإنجليزية

2026-08-05

عرض ٤٠ من أصل ١١٥ skills مجمعة.