cc-plugins

Create or update the project security baseline, profile, suppressions file, and gitignore entries for security scans

Fix or guide remediation for a specific security finding from the latest scan report

Run a security assessment using deterministic static analysis tools with LLM-powered triage

Inspect and optionally install security scanning tools for the security plugin

Query ctx memory and inject results into context

Show ctx memory status (node counts, types, tiers, tokens)

MANDATORY persistent memory system for decisions, facts, patterns, and observations.

Create a multi-phase epic plan with TDD structure for large features

Save current plan state and prepare for fresh context restart

This skill should be used for commit strategy, branch naming, conventional commits, PR workflow, and merge decisions in devloop

Learn how to use devloop - interactive guide to commands, workflow, and best practices

Execute an epic plan phase-by-phase, inline by default with opt-in worker spawns per task annotation

This skill should be used for configuring devloop project settings via .devloop/local.md, git workflow preferences, commit settings, review options

Create a devloop workflow plan with autonomous exploration and task breakdown

Execute plan tasks autonomously until completion

Execute plan tasks via fresh-context subagents (swarm mode)

Audit devloop against Claude Code updates to identify integration opportunities. Use after Claude Code releases, monthly maintenance, or when exploring new features.

This skill should be used when building, creating, or modifying any CLI tool or command-line application in any language or framework. The convention is language-agnostic. Reference implementations for Go (Cobra), Python (Click), Rust (Clap), Node (Commander) included but the pattern applies to any CLI framework (argparse, Thor, Picocli, Commander, etc.). Provides the --agent-help convention: structured, token-minimal help output that LLM agents can parse efficiently. Use when adding help text, designing CLI command structure, creating a new command-line tool, adding subcommands, implementing --help, or making CLI tools usable by AI agents.

This skill should be used when creating, reading, or updating devloop plans in .devloop/plan.md, task tracking, progress logs, phase management, PR feedback

Start development workflow - lightweight entry point

Archive a completed plan to .devloop/archive/

Devloop commit and PR creation with validation for completed plan work

Configure the devloop statusline for Claude Code

Lint and audit a Claude Code plugin, skill, or hook for correctness, token efficiency, and quality. Runs static analysis against verified Claude Code internals, then delegates to skill-creator for description optimization and eval benchmarking. Use when reviewing plugin changes, writing new hooks/skills, debugging a hook that silently does nothing, or before merging to main.

This skill should be used for integrating PR review comments back into devloop plan, parsing review feedback, addressing reviewer concerns

This skill should be used when the user asks to "clean up memory", "sync ctx and memory", "review memory", "deduplicate nodes", "fix memory conflicts", "ctx cleanup", "memory maintenance", "reconcile memory systems", or mentions stale nodes, memory bloat, or keeping ctx and MEMORY.md in sync.

Install, upgrade, or verify ctx persistent memory system

Install, build, and configure the Forge agent job runner. Verify the binary, start the daemon, and validate everything works.

How to use Forge to submit headless agent jobs, check status, and retrieve output via MCP tools. Use when the user wants to delegate work to a background agent, run a task on another LLM, or interact with forge.

Generate professional-quality diagrams as raw SVG. Use when the diagram-router selects SVG, or when the user needs pixel-precise control, custom visuals, threat models, comparisons, Venn diagrams, or any diagram type that other formats cannot handle well. SVG is the most expressive format -- unlimited visual possibilities, browser-native rendering.

Automatically select the best diagram format (SVG, Mermaid, Excalidraw, D2) and diagram type based on user intent. Use when the user asks to create, draw, visualize, or diagram something and has not specified a format. Routes to the appropriate format-specific skill.

Generate diagrams with a hand-drawn whiteboard aesthetic by writing .excalidraw files directly. Use when the user wants informal sketches, whiteboard-style visuals, or diagrams they can open and edit in Excalidraw. Saves a local .excalidraw file -- viewing/rendering is handled separately.

Generate diagrams using D2 (Terrastruct) -- a modern, clean diagram scripting language with excellent auto-layout. Use when the diagram-router selects D2, or when the user wants clean architecture diagrams, nested containers, or prefers D2's aesthetic. Requires the d2 CLI binary.

Shared design principles for all diagram formats -- color theory, composition, typography, accessibility, and quality standards. Referenced by format-specific skills (svg, mermaid, excalidraw, d2). Use when generating any visual diagram to ensure professional quality.

Generate diagrams using Mermaid syntax -- the most LLM-friendly text-based diagram format. Use when the diagram-router selects Mermaid, or when diagrams will live in GitHub/GitLab markdown, documentation, or when quick generation with broad diagram type coverage is needed. Renders natively on major platforms.

View the most recent security scan results without re-running the scan

Quick inline code review for devloop plan changes or PR diffs

Interview-driven blog post creator that writes in your voice and strips AI tells

List GitHub issues for the current repository

Create a GitHub issue (or local issue with --local)