bdfinst/agentic-dev-team

Dernière activité source enregistrée: 3 octobre 2026 à 13:46

Catalogue SkillsMP mis à jour: 29 octobre 2026 à 18:30

skills collectés: 115

Étoiles GitHub: 295
Forks GitHub: 36

Installer avec un assistant IA

Copiez ce prompt dans l’assistant IA que vous utilisez.

Follow https://skillsmp.com/skill-install/prompt.md to install Agent Skills from https://github.com/bdfinst/agentic-dev-team.

README du dépôt

Fichier source du README : README.md

Lire le README source

Afficher le README complet

# Agentic Dev Team [![Plugin tests](https://github.com/bdfinst/agentic-dev-team/actions/workflows/plugin-tests.yml/badge.svg?branch=main)](https://github.com/bdfinst/agentic-dev-team/actions/workflows/plugin-tests.yml) [![Docs checks](https://github.com/bdfinst/agentic-dev-team/actions/workflows/link-check.yml/badge.svg?branch=main)](https://github.com/bdfinst/agentic-dev-team/actions/workflows/link-check.yml) [![Docs deploy](https://github.com/bdfinst/agentic-dev-team/actions/workflows/docs.yml/badge.svg?branch=main)](https://github.com/bdfinst/agentic-dev-team/actions/workflows/docs.yml) 📖 **[Documentation](https://devteam.bryanfinster.com/)** Three Claude Code plugins for engineering workflows. Install one or all. - **`dev-team`** gives Claude Code a full persona-driven development team. It includes an Orchestrator that routes tasks, specialist agents (engineer, QA, architect, reviewers…), skills that encode reusable knowledge, and the four-command feature workflow `/specs → /plan → /build → /pr`. - **`security-assessment`** is the security companion. It adds a tool-first `/security-assessment` pipeline (SAST + AI judgment + false-positive filtering + executive report), a `/cross-repo-analysis` command for multi-repo attack chains, and an adversarial ML red-team harness (`/redteam-model`) for self-owned model endpoints. - **`marketplace-dev`** is the plugin-author's toolkit. It scaffolds new plugins and marketplaces (`/scaffold-plugin`, `/scaffold-marketplace`, `/init-plugin-eval`). It audits any plugin for structural compliance (`/plugin-audit`). It advises on the markdown-vs-script agent decision (`/agent-type-advisor`). It also ships the migrated agent/skill authoring toolkit (`/agent-create`, `/agent-add`, `/agent-remove`). `dev-team` is the foundation. It owns the shared data contract (`codebase-recon`, `ACCEPTED-RISKS.md`, unified finding format) that `security-assessment` builds on. Install `dev-team` first, and add `security-assessment` when you need it. `marketplace-dev` is independent. It has no hard dependency on `dev-team`, so you can install it on its own to build or maintain plugins. ## Plugins | Plugin | What it does | Key commands | Required tools | Optional tools | | --- | --- | --- | --- | --- | | **[dev-team](plugins/dev-team/README.md)** | Persona-driven development team, reviewer swarm, TDD-gated build loop | `/specs`, `/plan`, `/build`, `/pr`, `/code-review`, `/triage` | `jq`, `gh` | `semgrep`, `playwright`, `hadolint`/`trivy`/`grype`; auto-detected formatters and test/type/lint runners | | **[security-assessment](plugins/security-assessment/README.md)** | Tool-first security assessment + red-team pipeline | `/security-assessment`, `/cross-repo-analysis`, `/redteam-model`, `/export-pdf` | `dev-team`, Python ≥ 3.10, tier-1 SAST (`semgrep`, `gitleaks`, `trivy`, `hadolint`, `actionlint`) | `grype`, PDF-export deps | | **[marketplace-dev](plugins/marketplace-dev/README.md)** | Scaffold, audit, and maintain Claude Code plugins and marketplaces | `/scaffold-plugin`, `/scaffold-marketplace`, `/plugin-audit`, `/agent-type-advisor`, `/agent-create` | `jq` | `git` | Plugin names link to each plugin's README, where the full tool list and per-tool install commands live. This table assumes you have Claude Code. **First time here?** Start with `dev-team`. Add `security-assessment` only when you run full `/security-assessment` pipelines against target repos. Add `marketplace-dev` when you build or maintain plugins. ## Getting started New here? The **[Getting Started guide](GETTING-STARTED.md)** is the full walkthrough. It covers installing each plugin, configuring a project, the day-to-day workflow, and the diagnostic commands. Quick install of the core plugin: ```bash claude plugin marketplace add bdfinst/agentic-dev-team claude plugin install dev-team@bfinster ``` Then run `/setup` in your project. The [Getting Started guide](GETTING-STARTED.md) covers the optional plugins (`security-assessment`, `marketplace-dev`), self-hosted git hosts, install scopes, and the `/upgrade` flow. ## Dev team workflow Four commands drive feature development from idea to pull request: ```text /specs → /plan → /build → /pr ``` | Step | Command | What it does | |----------------|----------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **1. Specify** | `/specs` | Describe the change and its goals — Intent, Architecture notes, Acceptance Criteria. A consistency gate must pass before you move on. Skip for bug fixes, refactors, or trivial changes. | | **2. Plan** | `/plan` | Decompose the feature into vertical slices, author each slice's Gherkin scenarios, and lay out the TDD steps that satisfy them. Up to five plan-review personas (Acceptance Test, Design, UX, Strategic, Parallelization critics), scaled to the plan tier, challenge the plan before the human sees it. The human approves before any code is written. | | **3. Build** | `/build` | Execute the approved plan slice by slice. Each step follows RED-GREEN-REFACTOR with inline review checkpoints (spec-compliance first, then quality agents). It produces verification evidence. | | **4. Ship** | `/pr` | Run quality gates (tests, typecheck, lint, code review) and open a pull request. | Each step produces artifacts that the next step consumes. The spec describes *what* and *why*. The plan turns the spec into per-slice behavioral contracts (Gherkin) and *how*. Human review gates sit between transitions. ![Workflow: specs → plan → build → pr](plugins/dev-team/docs/diagrams/workflow-linear.svg) For bug fixes or simple tasks, skip `/specs` and start at `/plan`, or go straight to implementation. ### Supporting commands The table below lists representative supporting commands. For the full catalog with options and descriptions, see the skills page of each plugin: **[dev-team skills](plugins/dev-team/docs/skills.md)** · **[security-assessment skills](plugins/security-assessment/docs/skills.md)** · **[marketplace-dev skills](plugins/marketplace-dev/docs/skills.md)**. | Command | Plugin | When to use | | --- | --- | --- | | `/code-review` | dev-team | Run review agents, auto-fix actionable issues, re-run until clean (up to 5 iterations) | | `/continue` | dev-team | Resume an in-progress build or plan across sessions | | `/test-improve` | dev-team | Consolidated analyze-then-improve test orchestrator. Ten phases (0-9) with human gates. Lightweight by default. Opt into Gherkin / mutation / refactor-for-testability on demand | | `/browse` | dev-team | Visual QA via Playwright | | `/benchmark` | dev-team | Runtime performance metrics (Core Web Vitals, resource sizes) against baselines | | `/careful` / `/freeze` / `/guard` | dev-team | Safety modes for production-critical sessions | | `/triage` | dev-team | Investigate a bug and file a GitHub issue with a TDD fix plan | | `/security-assessment` | security-assessment | Full pipeline: recon → tools → agents → FP-reduction → exec report | | `/redteam-model` | security-assessment | Adversarial ML red-team probes against a self-owned model endpoint | | `/plugin-audit` | marketplace-dev | Structural compliance check for any Claude Code plugin | | `/scaffold-plugin` | marketplace-dev | Create a new plugin skeleton that passes audit with zero findings | ### Automated pre-commit review `/code-review` automatically gates every `git commit`. A `PreToolUse` hook detects commit attempts and blocks them until a passing review exists for the exact set of staged files. **Flow**: attempt commit → hook blocks → Claude runs `/code-review` → if pass/warn, Claude writes a `.review-passed` gate file → next commit attempt succeeds. **Bypass**: `git commit --no-verify` skips the review gate. ## Security assessment pipeline `/security-assessment <path>` runs a six-phase pipeline against one or more target repos. Deterministic tools do the detection. LLM agents handle the judgment stages. | Phase | Runs | Output | | --- | --- | --- | | **0. Recon** | `codebase-recon` agent | `memory/recon-<slug>.{json,md}` | | **1. Tool-first detection** | semgrep, gitleaks, trivy, hadolint, actionlint, custom rulesets | unified findings stream | | **1b. Judgment** | `security-review`, `business-logic-domain-review` agents | appended findings | | **1c. Suppression** | `ACCEPTED-RISKS.md` gate (deterministic) | filtered stream + audit log | | **2. False-positive filter** | 5-stage check (reachability, environment, controls, dedup, severity) | decisions log | | **2b. Severity floors** | deterministic domain-class calibration | floor-adjusted scores | | **3. Narrative + compliance** | `tool-finding-narrative-annotator`, compliance-mapping skill | 4-domain narrative + compliance JSON | | **4. Cross-repo** | service-comm parser, shared-cred hash match (multi-target only) | mermaid diagram + SARIF | | **5. Exec report** | `exec-report-generator` agent | publication-ready 7-section markdown | **Zero-install flow**: `scripts/run-assessment-local.sh` runs the same pipeline from the repo checkout without installing the plugin. The script auto-detects the `claude` CLI and degrades to deterministic-only when the CLI is absent. See [the user guide](plugins/security-assessment/docs/user-guide-security-assessment.md) for the full runbook. **Adversarial ML red-team**: `/redteam-model` probes a self-owned model endpoint (localhost / private network by default; public targets require a signed `authorization.md`). Eight probes cover discovery, evasion, data extraction, and report synthesis. --- ## Contributing Developing, testing, or releasing the plugins? See **[CONTRIBUTING.md](CONTRIBUTING.md)**. It covers local-dev setup (including live installs via symlinks), the `/agent-eval` and `/agent-audit` test commands, the security comparative-testing harness, how to add agents and skills, and the release process. **`/code-review` benchmark harness** ([`evals/code-review-benchmark/`](https://github.com/bdfinst/agentic-dev-team/blob/main/evals/code-review-benchmark/README.md)): checks out real, known-defect commits from Defects4J (Java) and BugsJS (JavaScript), runs `/code-review` against the buggy revision, and scores whether its findings cover the real defect. The harness also produces a dedicated Missed Defects report. Adapters and scoring are unit-tested against real fetched dataset samples. A live sweep against the actual corpora requires a local Defects4J/BugsJS install (see the harness README for prerequisites and usage). ## Documentation The full documentation lives at **[devteam.bryanfinster.com](https://devteam.bryanfinster.com/)**, with search and complete navigation. It covers architecture, model routing, the eval system, telemetry, ADRs, and experiment reports. Start here: | Doc | Covers | | --- | --- | | [Getting Started](GETTING-STARTED.md) | Install, the workflow, suggested skills, worked examples | | [Contributing](CONTRIBUTING.md) | Local development, testing, adding agents/skills, releasing | | [Plugin Development Guide](https://github.com/bdfinst/agentic-dev-team/blob/main/CLAUDE.md) | Project North Star, repo structure, working rules | Per-plugin docs: **[dev-team](plugins/dev-team/README.md)** · **[security-assessment](plugins/security-assessment/README.md)** · **[marketplace-dev](plugins/marketplace-dev/README.md)**. Each plugin's README is the entry point to its architecture, commands, and deeper guides. ## CodeGraph This repository uses [CodeGraph](https://github.com/colbymchenry/codegraph) for semantic code intelligence.

Chargement du README du dépôt…

Skills dans ce dépôt

Développeurs de logiciels Analystes en assurance qualité des logiciels et testeurs Autres occupations informatiques Analystes en sécurité de l'information

7 catégories métier · 89% classifié

skill

métier

description

mis à jour

adr-tools

non classé

Create and manage Architecture Decision Records using the npryce adr-tools CLI. Use when the user asks to "add an ADR", "record this decision", "create an ADR", "supersede ADR N", "link ADRs", "generate the ADR table of contents", or any request involving the…