Modernize for 2026 models, workflows, and skill set - #80
Conversation
ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (54)
🚧 Files skipped from review as they are similar to previous changes (37)
📝 WalkthroughWalkthroughThe PR refreshes Pro Workflow’s plugin metadata, cross-agent installation guidance, catalog counts, model-routing documentation, orchestration references, context guides, and skill definitions. It adds new skills and marks many existing skills as user-invocable. ChangesDistribution and onboarding
Model routing and effort guidance
Context and operating references
Orchestration and feature references
Skill governance and catalog
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
skills/deslop/SKILL.md (1)
73-80: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winUnify the skill-file output contract.
The new contract requires reporting whether the skill is ready to promote, but the following
## Outputsection omits that field and defines a different summary format. Merge these into one explicit schema so promotion readiness cannot be dropped.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/deslop/SKILL.md` around lines 73 - 80, Update the Output section of the skill instructions to use one explicit schema that includes flagged issues with locations, edits applied, the cleanup summary, and whether the skill is ready to promote. Remove the conflicting summary-only format so promotion readiness is always reported.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@references/cross-agent-workflows.md`:
- Around line 84-91: Remove the duplicate consecutive npx skills add
rohitg00/pro-workflow command from the Other Agents (via skills add) example,
leaving a single installation command.
In `@references/new-features.md`:
- Around line 81-88: Update the checkpoint description in the Usage section to
characterize checkpoints as local, session-based snapshots rather than Git-based
checkpoints. Remove the claim that code state is saved through Git, and clarify
that /rewind restores session/code state without implying commit or Bash-edit
tracking.
- Around line 106-108: Update the Remote Control usage example in the feature
list by replacing the undocumented `--remote` flag with the documented
`--remote-control` or `--rc` flag, while preserving the surrounding steps.
- Around line 152-176: Update the matcher values in the PostToolUse and
PreToolUse examples to use the bare tool names Edit and Bash. Move the Bash
command-specific safety checks from matcher into its hook prompt or handler,
while preserving the existing security-review behavior.
In `@rules/skill-conventions.mdc`:
- Around line 19-23: Resolve the auto-invocation contract consistently across
the skill conventions, references/context-engineering.md guidance, and the
validator: choose either omitting user-invocable or explicitly setting it to
false for agent-only skills, then update all documentation examples and
validation logic to enforce that same representation. Preserve the requirement
that auto-triggered skills are not user-invocable.
In `@skills/design-engineering/SKILL.md`:
- Around line 58-65: Resolve the conflicting duration guidance in the animation
timing table and the “Keep UI animations under 300ms” rule: either limit modal
and drawer durations to under 300ms or explicitly state that the 300ms maximum
excludes their documented 200–500ms range, while keeping the guidance internally
consistent.
In `@skills/domain-modeling/SKILL.md`:
- Around line 33-41: Define a shared, idempotent artifact-write contract across
the domain-modeling and plan-interrogate skills. In
skills/domain-modeling/SKILL.md lines 33-41, specify merge/update behavior for
CONTEXT.md and collision-safe numbering for decision records; in
skills/plan-interrogate/SKILL.md lines 43-62, apply the same
create/update/append, merge, and duplicate-prevention rules to the ledger,
CONTEXT.md, and decision records.
In `@skills/skill-router/SKILL.md`:
- Around line 3-11: The skill-router catalog and its stated counts are
inconsistent: it claims 41 skills and 23 commands, but lists 40 skills and no
commands. Reconcile the entries with the repository’s actual skills and commands
by adding missing catalog sections or correcting the documented scope and
counts, ensuring the router remains complete and accurate.
---
Outside diff comments:
In `@skills/deslop/SKILL.md`:
- Around line 73-80: Update the Output section of the skill instructions to use
one explicit schema that includes flagged issues with locations, edits applied,
the cleanup summary, and whether the skill is ready to promote. Remove the
conflicting summary-only format so promotion readiness is always reported.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 8005db60-d6d8-459b-841a-f460ede280c6
⛔ Files ignored due to path filters (2)
assets/architecture.svgis excluded by!**/*.svgassets/banner.svgis excluded by!**/*.svg
📒 Files selected for processing (55)
.claude-plugin/marketplace.json.claude-plugin/plugin.jsonREADME.mdagents/cost-analyst.mdconfig.jsondocs/index.htmldocs/infographic.htmlreferences/agent-teams.mdreferences/claude-code-resources.mdreferences/cli-cheatsheet.mdreferences/context-engineering.mdreferences/context-loading.mdreferences/cross-agent-workflows.mdreferences/daily-habits.mdreferences/decision-framework.mdreferences/models-2026.mdreferences/modern-workflows-2026.mdreferences/new-features.mdreferences/orchestration-patterns.mdreferences/settings-guide.mdrules/skill-conventions.mdcskills/agent-teams/SKILL.mdskills/auto-setup/SKILL.mdskills/batch-orchestration/SKILL.mdskills/compact-guard/SKILL.mdskills/context-engineering/SKILL.mdskills/context-optimizer/SKILL.mdskills/cost-tracker/SKILL.mdskills/design-engineering/SKILL.mdskills/deslop/SKILL.mdskills/domain-modeling/SKILL.mdskills/file-watcher/SKILL.mdskills/improve-architecture/SKILL.mdskills/insights/SKILL.mdskills/learn-rule/SKILL.mdskills/llm-council/SKILL.mdskills/mcp-audit/SKILL.mdskills/orchestrate/SKILL.mdskills/parallel-worktrees/SKILL.mdskills/permission-tuner/SKILL.mdskills/plan-interrogate/SKILL.mdskills/pro-workflow/SKILL.mdskills/safe-mode/SKILL.mdskills/session-handoff/SKILL.mdskills/skill-optimizer/SKILL.mdskills/skill-router/SKILL.mdskills/smart-commit/SKILL.mdskills/sprint-status/SKILL.mdskills/survey-generator/SKILL.mdskills/tdd/SKILL.mdskills/wiki-builder/SKILL.mdskills/wiki-research-loop/SKILL.mdskills/wiki-viewer/SKILL.mdskills/wrap-up/SKILL.mdskills/writing-guidelines/SKILL.md
💤 Files with no reviewable changes (2)
- docs/infographic.html
- docs/index.html
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 8
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
skills/deslop/SKILL.md (1)
73-80: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winUnify the skill-file output contract.
The new contract requires reporting whether the skill is ready to promote, but the following
## Outputsection omits that field and defines a different summary format. Merge these into one explicit schema so promotion readiness cannot be dropped.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/deslop/SKILL.md` around lines 73 - 80, Update the Output section of the skill instructions to use one explicit schema that includes flagged issues with locations, edits applied, the cleanup summary, and whether the skill is ready to promote. Remove the conflicting summary-only format so promotion readiness is always reported.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@references/cross-agent-workflows.md`:
- Around line 84-91: Remove the duplicate consecutive npx skills add
rohitg00/pro-workflow command from the Other Agents (via skills add) example,
leaving a single installation command.
In `@references/new-features.md`:
- Around line 81-88: Update the checkpoint description in the Usage section to
characterize checkpoints as local, session-based snapshots rather than Git-based
checkpoints. Remove the claim that code state is saved through Git, and clarify
that /rewind restores session/code state without implying commit or Bash-edit
tracking.
- Around line 106-108: Update the Remote Control usage example in the feature
list by replacing the undocumented `--remote` flag with the documented
`--remote-control` or `--rc` flag, while preserving the surrounding steps.
- Around line 152-176: Update the matcher values in the PostToolUse and
PreToolUse examples to use the bare tool names Edit and Bash. Move the Bash
command-specific safety checks from matcher into its hook prompt or handler,
while preserving the existing security-review behavior.
In `@rules/skill-conventions.mdc`:
- Around line 19-23: Resolve the auto-invocation contract consistently across
the skill conventions, references/context-engineering.md guidance, and the
validator: choose either omitting user-invocable or explicitly setting it to
false for agent-only skills, then update all documentation examples and
validation logic to enforce that same representation. Preserve the requirement
that auto-triggered skills are not user-invocable.
In `@skills/design-engineering/SKILL.md`:
- Around line 58-65: Resolve the conflicting duration guidance in the animation
timing table and the “Keep UI animations under 300ms” rule: either limit modal
and drawer durations to under 300ms or explicitly state that the 300ms maximum
excludes their documented 200–500ms range, while keeping the guidance internally
consistent.
In `@skills/domain-modeling/SKILL.md`:
- Around line 33-41: Define a shared, idempotent artifact-write contract across
the domain-modeling and plan-interrogate skills. In
skills/domain-modeling/SKILL.md lines 33-41, specify merge/update behavior for
CONTEXT.md and collision-safe numbering for decision records; in
skills/plan-interrogate/SKILL.md lines 43-62, apply the same
create/update/append, merge, and duplicate-prevention rules to the ledger,
CONTEXT.md, and decision records.
In `@skills/skill-router/SKILL.md`:
- Around line 3-11: The skill-router catalog and its stated counts are
inconsistent: it claims 41 skills and 23 commands, but lists 40 skills and no
commands. Reconcile the entries with the repository’s actual skills and commands
by adding missing catalog sections or correcting the documented scope and
counts, ensuring the router remains complete and accurate.
---
Outside diff comments:
In `@skills/deslop/SKILL.md`:
- Around line 73-80: Update the Output section of the skill instructions to use
one explicit schema that includes flagged issues with locations, edits applied,
the cleanup summary, and whether the skill is ready to promote. Remove the
conflicting summary-only format so promotion readiness is always reported.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 8005db60-d6d8-459b-841a-f460ede280c6
⛔ Files ignored due to path filters (2)
assets/architecture.svgis excluded by!**/*.svgassets/banner.svgis excluded by!**/*.svg
📒 Files selected for processing (55)
.claude-plugin/marketplace.json.claude-plugin/plugin.jsonREADME.mdagents/cost-analyst.mdconfig.jsondocs/index.htmldocs/infographic.htmlreferences/agent-teams.mdreferences/claude-code-resources.mdreferences/cli-cheatsheet.mdreferences/context-engineering.mdreferences/context-loading.mdreferences/cross-agent-workflows.mdreferences/daily-habits.mdreferences/decision-framework.mdreferences/models-2026.mdreferences/modern-workflows-2026.mdreferences/new-features.mdreferences/orchestration-patterns.mdreferences/settings-guide.mdrules/skill-conventions.mdcskills/agent-teams/SKILL.mdskills/auto-setup/SKILL.mdskills/batch-orchestration/SKILL.mdskills/compact-guard/SKILL.mdskills/context-engineering/SKILL.mdskills/context-optimizer/SKILL.mdskills/cost-tracker/SKILL.mdskills/design-engineering/SKILL.mdskills/deslop/SKILL.mdskills/domain-modeling/SKILL.mdskills/file-watcher/SKILL.mdskills/improve-architecture/SKILL.mdskills/insights/SKILL.mdskills/learn-rule/SKILL.mdskills/llm-council/SKILL.mdskills/mcp-audit/SKILL.mdskills/orchestrate/SKILL.mdskills/parallel-worktrees/SKILL.mdskills/permission-tuner/SKILL.mdskills/plan-interrogate/SKILL.mdskills/pro-workflow/SKILL.mdskills/safe-mode/SKILL.mdskills/session-handoff/SKILL.mdskills/skill-optimizer/SKILL.mdskills/skill-router/SKILL.mdskills/smart-commit/SKILL.mdskills/sprint-status/SKILL.mdskills/survey-generator/SKILL.mdskills/tdd/SKILL.mdskills/wiki-builder/SKILL.mdskills/wiki-research-loop/SKILL.mdskills/wiki-viewer/SKILL.mdskills/wrap-up/SKILL.mdskills/writing-guidelines/SKILL.md
💤 Files with no reviewable changes (2)
- docs/infographic.html
- docs/index.html
🛑 Comments failed to post (8)
references/cross-agent-workflows.md (1)
84-91: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Remove duplicate installation command.
The
npx skills addcommand is repeated on consecutive lines.♻️ Proposed fix
### Other Agents (via skills add) ```bash -npx skills add rohitg00/pro-workflow npx skills add rohitg00/pro-workflow</details> <!-- suggestion_start --> <details> <summary>📝 Committable suggestion</summary> > ‼️ **IMPORTANT** > Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements. ```suggestion ### Other Agents (via skills add)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@references/cross-agent-workflows.md` around lines 84 - 91, Remove the duplicate consecutive npx skills add rohitg00/pro-workflow command from the Other Agents (via skills add) example, leaving a single installation command.references/new-features.md (3)
81-88: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail # Locate the referenced file and show the relevant section with line numbers. git ls-files references/new-features.md echo "----" cat -n references/new-features.md | sed -n '70,100p' echo "---- nearby mentions ----" rg -n "checkpoint|rewind|git-based|Git-based|Bash|Esc Esc|/rewind" references/new-features.mdRepository: rohitg00/pro-workflow
Length of output: 1923
🏁 Script executed:
#!/bin/bash set -euo pipefail # Look for any other docs that define checkpoints or mention whether they are Git-backed. rg -n "checkpoint|rewind|Git-based|git-based|snapshot" -g '*.md' .Repository: rohitg00/pro-workflow
Length of output: 2508
🌐 Web query:
Claude Code checkpointing docs local snapshots git-based /rewind Esc Esc💡 Result:
Claude Code features a built-in checkpointing system designed to manage session state by tracking file edits and conversation history [1][2]. It is not inherently git-based, though official documentation emphasizes that it serves as a local "undo" mechanism that complements, rather than replaces, proper version control systems like Git [1]. Checkpointing Functionality: - Automatic Snapshots: Claude Code automatically captures the state of your code and conversation before each user prompt [1][3][4]. - Scope: The system tracks file modifications made specifically through Claude's built-in file editing tools (Write, Edit, and NotebookEdit) [1][5][6]. It does not track modifications made via bash commands or external processes [1][5][6]. - Retention: Claude Code retains snapshots for the 100 most recent checkpoints in a session [1]. These checkpoints are saved with the conversation and are cleaned up automatically after 30 days (configurable via settings) [1][7]. Using /rewind and Esc Esc: - Accessing the Menu: You can open the rewind menu by typing the /rewind command or by pressing Esc twice when the prompt input field is empty [2][3][4]. If the input field contains text, Esc twice clears the input instead [2]. - Available Actions: The rewind menu allows you to perform several operations relative to a selected checkpoint [2][3]: - Restore code and conversation: Reverts both files and conversation history to that state [2][3]. - Restore conversation: Rewinds history while keeping the current code state [2]. - Restore code: Reverts file changes while keeping the current conversation [2]. - Summarize: Compresses conversation history from or up to a selected point to free up context window space [2][3]. Git-Based Alternatives: While Claude Code's native checkpointing is local and session-based, the community has developed Git-based hooks and wrappers [8][9][10]. These tools use hooks in.claude/settings.json to trigger Git commands (such as commits, stashes, or tags) automatically before or after tool use, providing a more permanent or branch-based safety net that persists outside of the local session storage [8][9][11][10]. These are independent of the core Claude Code checkpointing system [1].
Citations:
- 1: https://code.claude.com/docs/en/checkpointing
- 2: https://claude-code.mintlify.app/en/checkpointing
- 3: https://claudcod.com/blog/claude-code-rewind/
- 4: https://arte.itlibra.com/en/articles/claude-code-checkpointing-rewind
- 5: https://code.claude.com/docs/en/agent-sdk/file-checkpointing
- 6: https://code.claude.com/docs/en/agent-sdk/file-checkpointing.md
- 7: https://code.claude.com/docs/en/sessions.md
- 8: https://github.com/Ixe1/claude-code-checkpointing-hook
- 9: https://github.com/mayanksingh09/claude-code-flow/blob/main/docs/GIT_CHECKPOINT_HOOKS.md
- 10: https://github.com/carlrannaberg/claudekit/blob/main/docs/guides/checkpoint.md
- 11: anthropics/claude-code#6947
Describe checkpoints as local session snapshots, not Git checkpoints.
“Git-based” is inaccurate here: Claude Code checkpoints are local/session-based and do not track Bash edits.
/rewindrestores session/code state, not commits.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@references/new-features.md` around lines 81 - 88, Update the checkpoint description in the Usage section to characterize checkpoints as local, session-based snapshots rather than Git-based checkpoints. Remove the claim that code state is saved through Git, and clarify that /rewind restores session/code state without implying commit or Bash-edit tracking.Source: MCP tools
106-108: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail # Inspect the referenced lines in the repository file. file="references/new-features.md" if [ -f "$file" ]; then nl -ba "$file" | sed -n '98,115p' else echo "Missing file: $file" fiRepository: rohitg00/pro-workflow
Length of output: 199
🌐 Web query:
site:code.claude.com docs remote control claude --remote-control --rc --remote💡 Result:
Remote Control is a feature in Claude Code that allows you to continue and drive a local terminal session from other devices, such as the Claude mobile app or a web browser via claude.ai/code [1][2]. It requires a valid claude.ai subscription [3][4]. You can invoke Remote Control in the following ways: 1. CLI Server Mode: Use
claude remote-controlto start a session in server mode, where the CLI acts solely as a backend and does not provide a local interactive session [5][6]. 2. Interactive Session Mode: Start an interactive session with Remote Control enabled by using the--remote-controlor--rcflag (e.g.,claude --remote-control) [1][5]. This allows you to type commands locally while the session is simultaneously available for remote access [1]. 3. In-Session Activation: If you are already running an interactive Claude Code session, you can enable Remote Control by typing the/remote-controlcommand (or/rc) [1][3]. To configure Remote Control, you can run/configwithin a Claude Code session to adjust settings likeremoteControlAtStartup, which toggles whether Remote Control connects automatically when an interactive session begins [7]. Additionally, you can specify session names using the--nameflag in server mode or by passing a name as an argument to the interactive flags or the/remote-controlcommand [5][4]. For security and administrative control, you can block this feature using thedisableRemoteControlsetting [7]. Note that Remote Control sessions require the host machine to be signed in with a claude.ai account; API keys are not supported for this feature [8].Citations:
- 1: https://code.claude.com/docs/en/remote-control
- 2: https://code.claude.com/docs/en/platforms.md
- 3: https://code.claude.com/docs/en/commands.md
- 4: https://code.claude.com/docs/en/remote-control?_rsc=4Vrbm42DZc3Y7r9j
- 5: https://code.claude.com/docs/en/cli
- 6: https://code.claude.com/docs/en/cli-reference
- 7: https://code.claude.com/docs/en/settings
- 8: https://code.claude.com/docs/en/permission-modes
🏁 Script executed:
#!/bin/bash set -euo pipefail file="references/new-features.md" if [ -f "$file" ]; then sed -n '100,112p' "$file" | cat -n else echo "Missing file: $file" fiRepository: rohitg00/pro-workflow
Length of output: 499
🏁 Script executed:
#!/bin/bash set -euo pipefail # Double-check the exact CLI wording from the docs page text for the relevant flags. python3 - <<'PY' import urllib.request, re url = "https://code.claude.com/docs/en/remote-control" try: html = urllib.request.urlopen(url, timeout=20).read().decode("utf-8", "ignore") for pat in [r'--remote-control', r'--rc', r'--remote\b', r'claude remote-control']: print(pat, bool(re.search(pat, html))) except Exception as e: print("ERR", e) PYRepository: rohitg00/pro-workflow
Length of output: 297
Use the documented Remote Control flag at
references/new-features.md:8.--remoteshould be--remote-control(or--rc) here.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@references/new-features.md` around lines 106 - 108, Update the Remote Control usage example in the feature list by replacing the undocumented `--remote` flag with the documented `--remote-control` or `--rc` flag, while preserving the surrounding steps.Source: MCP tools
152-176: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
sed -n '140,190p' references/new-features.mdRepository: rohitg00/pro-workflow
Length of output: 1218
🏁 Script executed:
rg -n "PreToolUse|PostToolUse|matcher|agent|ARGUMENTS|hooks" -S references/new-features.md .github docs README.mdRepository: rohitg00/pro-workflow
Length of output: 8022
🌐 Web query:
site:code.claude.com docs hooks matcher tool event names Edit Bash $ARGUMENTS agent field💡 Result:
In Claude Code, hooks are used to intercept events and trigger actions like commands, HTTP requests, MCP tool calls, prompts, or agentic verification tasks [1][2]. The matcher and agent fields function as follows: Matcher Field The matcher field is a string pattern used to filter which events trigger a hook [3][4]. It is tested against a specific field associated with the event [2]. - For tool-based events (e.g., PreToolUse, PostToolUse), the matcher targets the tool name (e.g., "Bash", "Edit|Write") [2][4]. - For other events, it matches against relevant context, such as notification types or session startup triggers [2]. - Matcher patterns for hooks use the bare tool name rather than the parenthesized permission rule format (e.g., "Bash" instead of "Bash(git *)") [5]. - Hooks without a matcher run for every event of that type [3][4]. Agent Hook Type When a hook's type is set to "agent", it launches a subagent to perform complex verification tasks that require multiple steps, such as inspecting files or running sequences of commands [1][2]. - Unlike "prompt" hooks, which make a single LLM call, agent hooks allow the model to read files, search code, and utilize other tools [2]. - Agent hooks follow the same "ok"/"reason" response format as prompt hooks but offer a longer default timeout (60 seconds) and support up to 50 tool-use turns [2]. Bash and $ARGUMENTS The $ARGUMENTS placeholder is used in "prompt" and "agent" hook types to pass the hook's JSON input into the LLM's context [6][2]. For Bash tools, because matchers only filter by tool name, more specific filtering—such as by exact command arguments or file paths—is performed by inspecting the tool_input field (often via command-line tools like jq) within the hook's callback [7][4]. Advanced filtering can also be applied using an "if" condition with permission rule syntax (e.g., "Bash(git *)") on individual hook handlers [6].
Citations:
- 1: https://code.claude.com/docs/en/plugins-reference.md
- 2: https://code.claude.com/docs/en/hooks-guide
- 3: https://code.claude.com/docs/en/agent-sdk/hooks.md
- 4: https://code.claude.com/docs/en/agent-sdk/hooks
- 5: https://code.claude.com/docs/en/tools-reference.md
- 6: https://code.claude.com/docs/en/hooks.md
- 7: https://code.claude.com/docs/en/plugins.md
🌐 Web query:
Claude Code hooks matcher "tool == 'Edit'" "tool_input.command matches" agent field💡 Result:
In Claude Code, the matcher field is used as a coarse filter to trigger hooks based on the tool name—not the tool input—for events such as PreToolUse and PostToolUse [1][2][3]. To match the 'Edit' tool, you use "Edit" (or "Edit|Write" to include other tools) in the matcher field [4][5][6]. The matcher is case-sensitive, and for tool events, it exclusively evaluates against the tool name [1][5][7]. To filter based on the 'Edit' tool's input—such as matching a specific command or file pattern—you must use the "if" field on the individual hook handler [1][2][6]. The "if" field supports permission-rule syntax to inspect tool name and arguments together [1][2]. For example, to run a hook only when an 'Edit' tool is used on a TypeScript file, you would configure your settings as follows: { "hooks": { "PostToolUse": [ { "matcher": "Edit", "hooks": [ { "if": "Edit(*.ts)", "type": "command", "command": "your-script.sh" } ] } ] } } The "if" field allows for granular control (e.g., "Bash(git )" or "Edit(.ts)") that the top-level matcher cannot provide [1][6]. If your goal is to inspect the specific command executed (for instance, inside a Bash tool call), you would typically read the tool_input field from the JSON payload provided on stdin within your script, rather than attempting to match the command directly in the matcher field [8][3].
Citations:
- 1: https://code.claude.com/docs/en/hooks
- 2: https://code.claude.com/docs/en/hooks.md
- 3: https://scalably.io/blog/claude-code-hooks-guide
- 4: https://code.claude.com/docs/en/hooks-guide
- 5: https://toolchew.com/en/deepdive-claude-code-hooks-power/
- 6: https://fpaul.dev/writing/claude-code-hooks-guide/
- 7: https://skiln.co/blog/claude-code-hooks-guide-examples
- 8: https://agentpatterns.ai/tools/claude/hooks-lifecycle/
🏁 Script executed:
python3 - <<'PY' from pathlib import Path p = Path('references/new-features.md') text = p.read_text() for start,end in [(145,180)]: for i, line in enumerate(text.splitlines(), 1): if start <= i <= end: print(f"{i:4d}: {line}") PYRepository: rohitg00/pro-workflow
Length of output: 1076
🏁 Script executed:
sed -n '145,190p' references/new-features.mdRepository: rohitg00/pro-workflow
Length of output: 1099
Fix the hook matcher examples.
matchershould be the tool/event name (Edit,Bash), not expressions liketool == 'Edit'ortool_input.command matches 'rm'; for the Bash case, use a bareBashmatcher and move command-specific checks into the hook prompt or handler.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@references/new-features.md` around lines 152 - 176, Update the matcher values in the PostToolUse and PreToolUse examples to use the bare tool names Edit and Bash. Move the Bash command-specific safety checks from matcher into its hook prompt or handler, while preserving the existing security-review behavior.Source: MCP tools
rules/skill-conventions.mdc (1)
19-23: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Resolve the conflicting auto-invocation contract.
This rule requires auto-triggered skills to omit
user-invocable, whilereferences/context-engineering.md:110-116instructs authors to setuser-invocable: falsefor agent-only skills. Choose one representation and update the conventions, references, and validator consistently.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@rules/skill-conventions.mdc` around lines 19 - 23, Resolve the auto-invocation contract consistently across the skill conventions, references/context-engineering.md guidance, and the validator: choose either omitting user-invocable or explicitly setting it to false for agent-only skills, then update all documentation examples and validation logic to enforce that same representation. Preserve the requirement that auto-triggered skills are not user-invocable.skills/design-engineering/SKILL.md (1)
58-65: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Resolve the contradictory animation-duration limits.
The table permits modal/drawer animations up to 500ms, while Line 65 says all UI animations must stay under 300ms. Qualify the 300ms rule with the modal/drawer exception or make the table conform to the global limit.
🧰 Tools
🪛 LanguageTool
[grammar] ~65-~65: Ensure spelling is correct
Context: ...| 200-500ms | Keep UI animations under 300ms. Perceived speed is real: a faster spin...(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/design-engineering/SKILL.md` around lines 58 - 65, Resolve the conflicting duration guidance in the animation timing table and the “Keep UI animations under 300ms” rule: either limit modal and drawer durations to under 300ms or explicitly state that the 300ms maximum excludes their documented 200–500ms range, while keeping the guidance internally consistent.skills/domain-modeling/SKILL.md (1)
33-41: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Define one shared, idempotent artifact-write contract.
Both skills generate overlapping project artifacts without specifying create/update/append behavior, merge rules, or rerun idempotency. This is especially risky for the shared
CONTEXT.md, where one skill can overwrite or duplicate the other’s output.
skills/domain-modeling/SKILL.md#L33-L41: define update/merge behavior forCONTEXT.mdand collision-safe decision-record numbering.skills/plan-interrogate/SKILL.md#L43-L62: apply the same artifact-write and duplicate-prevention rules to the ledger,CONTEXT.md, and decision records.📍 Affects 2 files
skills/domain-modeling/SKILL.md#L33-L41(this comment)skills/plan-interrogate/SKILL.md#L43-L62🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/domain-modeling/SKILL.md` around lines 33 - 41, Define a shared, idempotent artifact-write contract across the domain-modeling and plan-interrogate skills. In skills/domain-modeling/SKILL.md lines 33-41, specify merge/update behavior for CONTEXT.md and collision-safe numbering for decision records; in skills/plan-interrogate/SKILL.md lines 43-62, apply the same create/update/append, merge, and duplicate-prevention rules to the ledger, CONTEXT.md, and decision records.skills/skill-router/SKILL.md (1)
3-11: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Reconcile the router catalog and counts before merge.
This file claims to index 41 skills and 23 commands, but the supplied entries contain 40 skills and no command section. Add the missing catalog entries or correct the scope/counts so the router remains a complete, trustworthy index.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/skill-router/SKILL.md` around lines 3 - 11, The skill-router catalog and its stated counts are inconsistent: it claims 41 skills and 23 commands, but lists 40 skills and no commands. Reconcile the entries with the repository’s actual skills and commands by adding missing catalog sections or correcting the documented scope and counts, ensuring the router remains complete and accurate.
d928936 to
ef2fcaa
Compare
There was a problem hiding this comment.
Actionable comments posted: 11
🧹 Nitpick comments (1)
skills/pro-workflow/SKILL.md (1)
226-245: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winScope the model table to Claude Code.
This skill is installed for multiple agents, but the
Fable 5/Opus 4.8/Sonnet 5/Haiku 4.5matrix andeffortguidance are Claude Code-specific. Move this under a Claude-only heading and add per-agent fallbacks or mappings for other runtimes.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/pro-workflow/SKILL.md` around lines 226 - 245, Scope the “Current lineup” model matrix and “Effort and adaptive thinking” guidance to a clearly labeled Claude Code section. Add mappings or fallback guidance for the other supported runtimes, and ensure the “Add to CLAUDE.md” content remains explicitly Claude-specific rather than presenting these settings as universal.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@references/claude-code-resources.md`:
- Around line 80-83: Remove the duplicate npx skills add rohitg00/pro-workflow
command from the “With skills add” example in claude-code-resources.md, leaving
one installation command. Check README.md for the same duplicated command and
remove only the redundant occurrence there as well.
In `@references/daily-habits.md`:
- Around line 14-15: Resolve the conflicting compaction policy in the guidance
around “Manual /compact at 50%” and the anti-pattern table: choose a single
compaction timing recommendation and update both sections to state it
consistently, preserving the separate commit guidance.
In `@references/decision-framework.md`:
- Around line 9-16: Update the 1-3 risk example in the scoring table so
dependency updates are not treated as inherently low risk; restrict it to pinned
patch-level updates with a clean lockfile diff, or require scoring based on the
dependency’s blast radius before limiting verification to lint and typecheck.
In `@references/orchestration-patterns.md`:
- Around line 223-231: Update the “Isolation” row in the “When to Use Agent
Teams vs Subagents” table to clarify that Agent Teams use independent sessions
while worktree isolation depends on configuration. Link the worktree guidance
from that wording, and leave the other comparison factors unchanged.
In `@skills/design-engineering/SKILL.md`:
- Around line 29-30: Revise the guidance around keyboard-initiated actions to
remove the blanket prohibition on animation. Preserve the reduced-motion
requirement while allowing concise press, focus, and state-change feedback when
appropriate, using contextual guidance rather than banning keyboard-triggered
animation entirely.
- Around line 41-48: Update the easing guidance in the motion rules to
distinguish direction: use ease-out for entering or appearing UI and allow
ease-in for exiting or dismissing UI. Remove the blanket “Never use ease-in”
statement while preserving the existing guidance for ease-in-out, ease, linear,
and custom curves.
In `@skills/deslop/SKILL.md`:
- Line 3: Update the skill description to limit removal of defensive code to
demonstrably redundant code, explicitly preserving validation, authorization,
boundary checks, and resilience or failure-handling logic unless correcting a
clear bug.
In `@skills/domain-modeling/SKILL.md`:
- Around line 35-38: Clarify the CONTEXT.md glossary instructions to define a
deterministic policy for updating or removing existing terms, including when
pruning unused terms is allowed. Require reruns to report every definition
update or removal so glossary changes are never silent, while preserving
unchanged definitions by default.
- Around line 41-43: Update the decision-record guidance to require
concurrency-safe unique numbering: reserve the next NNNN atomically before
creating the file, or replace it with a collision-resistant identifier and
document its ordering policy. Preserve the existing docs/decisions/NNNN-slug.md
convention where compatible and keep the instruction limited to contested
modeling calls.
In `@skills/permission-tuner/SKILL.md`:
- Line 4: Narrow the auto-approval recommendations in the permission-tuner
skill: keep Edit operations user-confirmed, and replace prefix-based matches
such as Bash(npm test*) and Bash(git diff*) with an explicit, validated
allowlist of safe commands that rejects dangerous arguments and state-changing
scripts.
In `@skills/pro-workflow/SKILL.md`:
- Line 500: Update the onboarding command references in SKILL.md and README.md
to use an explicitly pinned CLI version and repository ref, ensuring
installations are reproducible and changes are reviewable; alternatively,
clearly state that floating installs are intentional.
---
Nitpick comments:
In `@skills/pro-workflow/SKILL.md`:
- Around line 226-245: Scope the “Current lineup” model matrix and “Effort and
adaptive thinking” guidance to a clearly labeled Claude Code section. Add
mappings or fallback guidance for the other supported runtimes, and ensure the
“Add to CLAUDE.md” content remains explicitly Claude-specific rather than
presenting these settings as universal.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 7d6c31b3-6420-4adf-b191-7e5e6370333a
⛔ Files ignored due to path filters (2)
assets/architecture.svgis excluded by!**/*.svgassets/banner.svgis excluded by!**/*.svg
📒 Files selected for processing (54)
.claude-plugin/marketplace.json.claude-plugin/plugin.jsonREADME.mdagents/cost-analyst.mdconfig.jsondocs/infographic.htmlreferences/agent-teams.mdreferences/claude-code-resources.mdreferences/cli-cheatsheet.mdreferences/context-engineering.mdreferences/context-loading.mdreferences/cross-agent-workflows.mdreferences/daily-habits.mdreferences/decision-framework.mdreferences/models-2026.mdreferences/modern-workflows-2026.mdreferences/new-features.mdreferences/orchestration-patterns.mdreferences/settings-guide.mdrules/skill-conventions.mdcskills/agent-teams/SKILL.mdskills/auto-setup/SKILL.mdskills/batch-orchestration/SKILL.mdskills/compact-guard/SKILL.mdskills/context-engineering/SKILL.mdskills/context-optimizer/SKILL.mdskills/cost-tracker/SKILL.mdskills/design-engineering/SKILL.mdskills/deslop/SKILL.mdskills/domain-modeling/SKILL.mdskills/file-watcher/SKILL.mdskills/improve-architecture/SKILL.mdskills/insights/SKILL.mdskills/learn-rule/SKILL.mdskills/llm-council/SKILL.mdskills/mcp-audit/SKILL.mdskills/orchestrate/SKILL.mdskills/parallel-worktrees/SKILL.mdskills/permission-tuner/SKILL.mdskills/plan-interrogate/SKILL.mdskills/pro-workflow/SKILL.mdskills/safe-mode/SKILL.mdskills/session-handoff/SKILL.mdskills/skill-optimizer/SKILL.mdskills/skill-router/SKILL.mdskills/smart-commit/SKILL.mdskills/sprint-status/SKILL.mdskills/survey-generator/SKILL.mdskills/tdd/SKILL.mdskills/wiki-builder/SKILL.mdskills/wiki-research-loop/SKILL.mdskills/wiki-viewer/SKILL.mdskills/wrap-up/SKILL.mdskills/writing-guidelines/SKILL.md
🚧 Files skipped from review as they are similar to previous changes (34)
- skills/orchestrate/SKILL.md
- skills/compact-guard/SKILL.md
- skills/agent-teams/SKILL.md
- skills/wiki-viewer/SKILL.md
- skills/smart-commit/SKILL.md
- skills/skill-optimizer/SKILL.md
- skills/batch-orchestration/SKILL.md
- skills/sprint-status/SKILL.md
- skills/wiki-builder/SKILL.md
- rules/skill-conventions.mdc
- skills/mcp-audit/SKILL.md
- skills/writing-guidelines/SKILL.md
- skills/survey-generator/SKILL.md
- skills/parallel-worktrees/SKILL.md
- skills/plan-interrogate/SKILL.md
- skills/improve-architecture/SKILL.md
- skills/wrap-up/SKILL.md
- agents/cost-analyst.md
- skills/context-optimizer/SKILL.md
- .claude-plugin/marketplace.json
- skills/skill-router/SKILL.md
- skills/session-handoff/SKILL.md
- skills/cost-tracker/SKILL.md
- config.json
- skills/context-engineering/SKILL.md
- references/models-2026.md
- references/cross-agent-workflows.md
- skills/learn-rule/SKILL.md
- references/new-features.md
- references/modern-workflows-2026.md
- references/cli-cheatsheet.md
- references/context-engineering.md
- references/context-loading.md
- README.md
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 11
🧹 Nitpick comments (1)
skills/pro-workflow/SKILL.md (1)
226-245: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winScope the model table to Claude Code.
This skill is installed for multiple agents, but the
Fable 5/Opus 4.8/Sonnet 5/Haiku 4.5matrix andeffortguidance are Claude Code-specific. Move this under a Claude-only heading and add per-agent fallbacks or mappings for other runtimes.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/pro-workflow/SKILL.md` around lines 226 - 245, Scope the “Current lineup” model matrix and “Effort and adaptive thinking” guidance to a clearly labeled Claude Code section. Add mappings or fallback guidance for the other supported runtimes, and ensure the “Add to CLAUDE.md” content remains explicitly Claude-specific rather than presenting these settings as universal.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@references/claude-code-resources.md`:
- Around line 80-83: Remove the duplicate npx skills add rohitg00/pro-workflow
command from the “With skills add” example in claude-code-resources.md, leaving
one installation command. Check README.md for the same duplicated command and
remove only the redundant occurrence there as well.
In `@references/daily-habits.md`:
- Around line 14-15: Resolve the conflicting compaction policy in the guidance
around “Manual /compact at 50%” and the anti-pattern table: choose a single
compaction timing recommendation and update both sections to state it
consistently, preserving the separate commit guidance.
In `@references/decision-framework.md`:
- Around line 9-16: Update the 1-3 risk example in the scoring table so
dependency updates are not treated as inherently low risk; restrict it to pinned
patch-level updates with a clean lockfile diff, or require scoring based on the
dependency’s blast radius before limiting verification to lint and typecheck.
In `@references/orchestration-patterns.md`:
- Around line 223-231: Update the “Isolation” row in the “When to Use Agent
Teams vs Subagents” table to clarify that Agent Teams use independent sessions
while worktree isolation depends on configuration. Link the worktree guidance
from that wording, and leave the other comparison factors unchanged.
In `@skills/design-engineering/SKILL.md`:
- Around line 29-30: Revise the guidance around keyboard-initiated actions to
remove the blanket prohibition on animation. Preserve the reduced-motion
requirement while allowing concise press, focus, and state-change feedback when
appropriate, using contextual guidance rather than banning keyboard-triggered
animation entirely.
- Around line 41-48: Update the easing guidance in the motion rules to
distinguish direction: use ease-out for entering or appearing UI and allow
ease-in for exiting or dismissing UI. Remove the blanket “Never use ease-in”
statement while preserving the existing guidance for ease-in-out, ease, linear,
and custom curves.
In `@skills/deslop/SKILL.md`:
- Line 3: Update the skill description to limit removal of defensive code to
demonstrably redundant code, explicitly preserving validation, authorization,
boundary checks, and resilience or failure-handling logic unless correcting a
clear bug.
In `@skills/domain-modeling/SKILL.md`:
- Around line 35-38: Clarify the CONTEXT.md glossary instructions to define a
deterministic policy for updating or removing existing terms, including when
pruning unused terms is allowed. Require reruns to report every definition
update or removal so glossary changes are never silent, while preserving
unchanged definitions by default.
- Around line 41-43: Update the decision-record guidance to require
concurrency-safe unique numbering: reserve the next NNNN atomically before
creating the file, or replace it with a collision-resistant identifier and
document its ordering policy. Preserve the existing docs/decisions/NNNN-slug.md
convention where compatible and keep the instruction limited to contested
modeling calls.
In `@skills/permission-tuner/SKILL.md`:
- Line 4: Narrow the auto-approval recommendations in the permission-tuner
skill: keep Edit operations user-confirmed, and replace prefix-based matches
such as Bash(npm test*) and Bash(git diff*) with an explicit, validated
allowlist of safe commands that rejects dangerous arguments and state-changing
scripts.
In `@skills/pro-workflow/SKILL.md`:
- Line 500: Update the onboarding command references in SKILL.md and README.md
to use an explicitly pinned CLI version and repository ref, ensuring
installations are reproducible and changes are reviewable; alternatively,
clearly state that floating installs are intentional.
---
Nitpick comments:
In `@skills/pro-workflow/SKILL.md`:
- Around line 226-245: Scope the “Current lineup” model matrix and “Effort and
adaptive thinking” guidance to a clearly labeled Claude Code section. Add
mappings or fallback guidance for the other supported runtimes, and ensure the
“Add to CLAUDE.md” content remains explicitly Claude-specific rather than
presenting these settings as universal.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 7d6c31b3-6420-4adf-b191-7e5e6370333a
⛔ Files ignored due to path filters (2)
assets/architecture.svgis excluded by!**/*.svgassets/banner.svgis excluded by!**/*.svg
📒 Files selected for processing (54)
.claude-plugin/marketplace.json.claude-plugin/plugin.jsonREADME.mdagents/cost-analyst.mdconfig.jsondocs/infographic.htmlreferences/agent-teams.mdreferences/claude-code-resources.mdreferences/cli-cheatsheet.mdreferences/context-engineering.mdreferences/context-loading.mdreferences/cross-agent-workflows.mdreferences/daily-habits.mdreferences/decision-framework.mdreferences/models-2026.mdreferences/modern-workflows-2026.mdreferences/new-features.mdreferences/orchestration-patterns.mdreferences/settings-guide.mdrules/skill-conventions.mdcskills/agent-teams/SKILL.mdskills/auto-setup/SKILL.mdskills/batch-orchestration/SKILL.mdskills/compact-guard/SKILL.mdskills/context-engineering/SKILL.mdskills/context-optimizer/SKILL.mdskills/cost-tracker/SKILL.mdskills/design-engineering/SKILL.mdskills/deslop/SKILL.mdskills/domain-modeling/SKILL.mdskills/file-watcher/SKILL.mdskills/improve-architecture/SKILL.mdskills/insights/SKILL.mdskills/learn-rule/SKILL.mdskills/llm-council/SKILL.mdskills/mcp-audit/SKILL.mdskills/orchestrate/SKILL.mdskills/parallel-worktrees/SKILL.mdskills/permission-tuner/SKILL.mdskills/plan-interrogate/SKILL.mdskills/pro-workflow/SKILL.mdskills/safe-mode/SKILL.mdskills/session-handoff/SKILL.mdskills/skill-optimizer/SKILL.mdskills/skill-router/SKILL.mdskills/smart-commit/SKILL.mdskills/sprint-status/SKILL.mdskills/survey-generator/SKILL.mdskills/tdd/SKILL.mdskills/wiki-builder/SKILL.mdskills/wiki-research-loop/SKILL.mdskills/wiki-viewer/SKILL.mdskills/wrap-up/SKILL.mdskills/writing-guidelines/SKILL.md
🚧 Files skipped from review as they are similar to previous changes (34)
- skills/orchestrate/SKILL.md
- skills/compact-guard/SKILL.md
- skills/agent-teams/SKILL.md
- skills/wiki-viewer/SKILL.md
- skills/smart-commit/SKILL.md
- skills/skill-optimizer/SKILL.md
- skills/batch-orchestration/SKILL.md
- skills/sprint-status/SKILL.md
- skills/wiki-builder/SKILL.md
- rules/skill-conventions.mdc
- skills/mcp-audit/SKILL.md
- skills/writing-guidelines/SKILL.md
- skills/survey-generator/SKILL.md
- skills/parallel-worktrees/SKILL.md
- skills/plan-interrogate/SKILL.md
- skills/improve-architecture/SKILL.md
- skills/wrap-up/SKILL.md
- agents/cost-analyst.md
- skills/context-optimizer/SKILL.md
- .claude-plugin/marketplace.json
- skills/skill-router/SKILL.md
- skills/session-handoff/SKILL.md
- skills/cost-tracker/SKILL.md
- config.json
- skills/context-engineering/SKILL.md
- references/models-2026.md
- references/cross-agent-workflows.md
- skills/learn-rule/SKILL.md
- references/new-features.md
- references/modern-workflows-2026.md
- references/cli-cheatsheet.md
- references/context-engineering.md
- references/context-loading.md
- README.md
🛑 Comments failed to post (11)
references/claude-code-resources.md (1)
80-83: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Remove duplicate installation command.
The installation command is listed twice. Please also check
README.md, which might contain the same duplication, as indicated by the codebase context snippet.📝 Proposed fix
### With skills add ```bash npx skills add rohitg00/pro-workflow -npx skills add rohitg00/pro-workflow</details> <!-- suggestion_start --> <details> <summary>📝 Committable suggestion</summary> > ‼️ **IMPORTANT** > Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements. ```suggestion ### With skills add🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@references/claude-code-resources.md` around lines 80 - 83, Remove the duplicate npx skills add rohitg00/pro-workflow command from the “With skills add” example in claude-code-resources.md, leaving one installation command. Check README.md for the same duplicated command and remove only the redundant occurrence there as well.references/daily-habits.md (1)
14-15: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Resolve the contradictory compaction guidance.
The document recommends compacting at 50% during work, but the anti-pattern table says not to compact mid-task. Choose one policy and apply it consistently; otherwise users may either compact too early or wait until context degradation.
Also applies to: 114-119
🧰 Tools
🪛 LanguageTool
[style] ~14-~14: The adverb ‘often’ is usually put before the verb ‘commit’.
Context: ...ings ### During Work - Commit early, commit often — as soon as a logical unit is done -...(ADVERB_WORD_ORDER)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@references/daily-habits.md` around lines 14 - 15, Resolve the conflicting compaction policy in the guidance around “Manual /compact at 50%” and the anti-pattern table: choose a single compaction timing recommendation and update both sections to state it consistently, preserving the separate commit guidance.references/decision-framework.md (1)
9-16: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Do not classify dependency updates as inherently low risk.
A dependency update can alter transitive packages, runtime behavior, security posture, or public APIs. Restrict this example to a pinned patch-level update with a clean lockfile diff, or state that risk must be scored from the dependency’s blast radius before limiting verification to lint/typecheck.
🧰 Tools
🪛 LanguageTool
[style] ~14-~14: To elevate your writing, try using a synonym here.
Context: ...pdate a public API | | 9-10 | Critical, hard to reverse | Data migration, security f...(HARD_TO)
[style] ~16-~16: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ... typecheck. At 4-6, add targeted tests. At 7-10, run the full test suite, review e...(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@references/decision-framework.md` around lines 9 - 16, Update the 1-3 risk example in the scoring table so dependency updates are not treated as inherently low risk; restrict it to pinned patch-level updates with a clean lockfile diff, or require scoring based on the dependency’s blast radius before limiting verification to lint and typecheck.references/orchestration-patterns.md (1)
223-231: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail printf '\n== references/orchestration-patterns.md excerpt ==\n' sed -n '210,240p' references/orchestration-patterns.md printf '\n== search for worktree guidance and agent teams wording ==\n' rg -n "always isolated|worktree|Agent Teams|subagents" references . --glob '!**/node_modules/**' printf '\n== candidate docs mentioning worktree/session configuration ==\n' fd -a -t f -i "worktree|agent team|agent-teams|subagent" .Repository: rohitg00/pro-workflow
Length of output: 23778
🏁 Script executed:
#!/bin/bash set -euo pipefail printf '\n== references/agent-teams.md ==\n' sed -n '1,140p' references/agent-teams.md printf '\n== relevant slice from references/orchestration-patterns.md around isolation ==\n' sed -n '130,155p' references/orchestration-patterns.md printf '\n== relevant slice from skills/agent-teams/SKILL.md ==\n' sed -n '1,90p' skills/agent-teams/SKILL.mdRepository: rohitg00/pro-workflow
Length of output: 6848
Clarify the “Isolation” row
Agent Teams are independent sessions, but checkout isolation still depends on worktrees. Use wording like “independent sessions; worktree isolation depends on configuration” and link the worktree guidance.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@references/orchestration-patterns.md` around lines 223 - 231, Update the “Isolation” row in the “When to Use Agent Teams vs Subagents” table to clarify that Agent Teams use independent sessions while worktree isolation depends on configuration. Link the worktree guidance from that wording, and leave the other comparison factors unchanged.skills/design-engineering/SKILL.md (2)
29-30: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Avoid prohibiting all keyboard-triggered animation.
Keyboard activation still benefits from concise press, focus, and state-change feedback. Keep the reduced-motion requirement, but make this guidance contextual rather than banning animation entirely.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/design-engineering/SKILL.md` around lines 29 - 30, Revise the guidance around keyboard-initiated actions to remove the blanket prohibition on animation. Preserve the reduced-motion requirement while allowing concise press, focus, and state-change feedback when appropriate, using contextual guidance rather than banning keyboard-triggered animation entirely.
41-48: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail file='skills/design-engineering/SKILL.md' wc -l "$file" sed -n '1,120p' "$file" | cat -nRepository: rohitg00/pro-workflow
Length of output: 5699
Use direction-specific easing instead of a global
ease-inban
ease-inis appropriate for exit animations; entering motion should useease-out. Reword this guidance so it distinguishes enter vs. exit behavior instead of discouraging the right curve for dismissal motions.🧰 Tools
🪛 LanguageTool
[grammar] ~47-~47: Ensure spelling is correct
Context: ...xactly when the user is watching - so a 300msease-indropdown feels slower than a ...(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)
[grammar] ~47-~47: Ensure spelling is correct
Context: ...sease-indropdown feels slower than a 300msease-outone. The built-in curves are...(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/design-engineering/SKILL.md` around lines 41 - 48, Update the easing guidance in the motion rules to distinguish direction: use ease-out for entering or appearing UI and allow ease-in for exiting or dismissing UI. Remove the blanket “Never use ease-in” statement while preserving the existing guidance for ease-in-out, ease, linear, and custom curves.skills/deslop/SKILL.md (1)
3-3: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Scope “strips defensive code” to demonstrably redundant code.
As written, this can encourage removing security checks and failure handling. Explicitly exclude validation, authorization, boundary checks, and resilience logic unless a clear bug is being fixed.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/deslop/SKILL.md` at line 3, Update the skill description to limit removal of defensive code to demonstrably redundant code, explicitly preserving validation, authorization, boundary checks, and resilience or failure-handling logic unless correcting a clear bug.skills/domain-modeling/SKILL.md (2)
35-38: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Define one deterministic glossary write policy.
“Merge in place; do not overwrite” conflicts with “prune terms that fall out of use.” Specify when an existing definition may be updated or removed, and require reporting those changes so reruns do not silently diverge.
Also applies to: 49-52
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/domain-modeling/SKILL.md` around lines 35 - 38, Clarify the CONTEXT.md glossary instructions to define a deterministic policy for updating or removing existing terms, including when pruning unused terms is allowed. Require reruns to report every definition update or removal so glossary changes are never silent, while preserving unchanged definitions by default.
41-43: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Make decision-record numbering concurrency-safe.
Selecting the next unused
NNNNis not enough when multiple agents run this skill concurrently; both can choose the same filename. Reserve the number atomically or use a collision-resistant identifier with a documented ordering policy.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/domain-modeling/SKILL.md` around lines 41 - 43, Update the decision-record guidance to require concurrency-safe unique numbering: reserve the next NNNN atomically before creating the file, or replace it with a collision-resistant identifier and document its ordering policy. Preserve the existing docs/decisions/NNNN-slug.md convention where compatible and keep the instruction limited to contested modeling calls.skills/permission-tuner/SKILL.md (1)
4-4: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Do not expose these broad auto-approval recommendations without narrowing them.
The skill can classify
Editand patterns such asBash(npm test*)orBash(git diff*)as auto-approvable, although they can modify state, execute arbitrary project scripts, or accept dangerous arguments. Keep write tools user-confirmed and match shell commands against an explicit, validated allowlist rather than prefixes and approval frequency.🧰 Tools
🪛 SkillSpector (2.3.11)
[warning] 95: [EA2] Autonomous Decision Making: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Remediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
(Excessive Agency (EA2))
[warning] 99: [EA2] Autonomous Decision Making: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Remediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
(Excessive Agency (EA2))
[error] 60: [TM1] Tool Parameter Abuse: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Remediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
(Tool Misuse (TM1))
[error] 80: [TM1] Tool Parameter Abuse: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Remediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
(Tool Misuse (TM1))
[error] 57: [TM1] Tool Parameter Abuse: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Remediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
(Tool Misuse (TM1))
[error] 81: [TM1] Tool Parameter Abuse: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Remediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
(Tool Misuse (TM1))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/permission-tuner/SKILL.md` at line 4, Narrow the auto-approval recommendations in the permission-tuner skill: keep Edit operations user-confirmed, and replace prefix-based matches such as Bash(npm test*) and Bash(git diff*) with an explicit, validated allowlist of safe commands that rejects dangerous arguments and state-changing scripts.Source: Linters/SAST tools
skills/pro-workflow/SKILL.md (1)
500-500: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail echo "== file around target lines ==" sed -n '480,520p' skills/pro-workflow/SKILL.md | cat -n echo echo "== locate the install instruction and related references ==" rg -n "skills add|pro-workflow|npx skills add" skills/pro-workflow/SKILL.md echo echo "== show file metadata ==" wc -l skills/pro-workflow/SKILL.mdRepository: rohitg00/pro-workflow
Length of output: 2218
🏁 Script executed:
#!/bin/bash set -euo pipefail echo "== installation section around clone/setup ==" sed -n '300,380p' skills/pro-workflow/SKILL.md | cat -n echo echo "== repository metadata files ==" git ls-files | rg '^(package\.json|pnpm-lock\.yaml|package-lock\.json|yarn.lock|skills/pro-workflow/.*|README\.md)$'Repository: rohitg00/pro-workflow
Length of output: 2740
🏁 Script executed:
#!/bin/bash set -euo pipefail echo "== package metadata ==" cat package.json | sed -n '1,220p' echo echo "== search for install/version guidance ==" rg -n "npx skills add|pin|version|tag|commit|floating|latest|reproduc" -S README.md skills/pro-workflow/SKILL.md package.jsonRepository: rohitg00/pro-workflow
Length of output: 4238
Pin the onboarding command in
skills/pro-workflow/SKILL.md:500andREADME.md:73,397.npx skills add rohitg00/pro-workflowis still floating in both docs, so installs can drift without a reviewable version change. Pin the CLI version and repo ref, or state that floating installs are intentional.🧰 Tools
🪛 SkillSpector (2.3.11)
[warning] 500: [RP1] null: npx commands without a version suffix (e.g.
@1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Remediation: Pin the version: npx
@scope/server@1.2.3(MCP Rug Pull (RP1))
[warning] 145: [RA2] Session Persistence: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Remediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
(Rogue Agent (RA2))
[warning] 414: [RA2] Session Persistence: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Remediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
(Rogue Agent (RA2))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/pro-workflow/SKILL.md` at line 500, Update the onboarding command references in SKILL.md and README.md to use an explicitly pinned CLI version and repository ref, ensuring installations are reproducible and changes are reviewable; alternatively, clearly state that floating installs are intentional.Source: Linters/SAST tools
Skills: - add skill-router (index of all skills/commands, human vs auto tag), tdd, domain-modeling, design-engineering, writing-guidelines, improve-architecture - plan-interrogate now emits CONTEXT.md shared language and decision records - deslop gains a skill-file lint mode - rules/skill-conventions.mdc: invocation intent, add/update/append semantics, buckets, sync; label 25 human-run skills user-invocable References and site: - references/models-2026.md and references/modern-workflows-2026.md - refresh pro-workflow model section to current lineup + effort - move reference guides into references/ - refresh the GitHub Pages infographic (counts, models, install) and make it responsive for all screens Install and hygiene: - standardize cross-agent install on skills add (owner/repo form) - refresh counts to 41 skills / 23 commands / 8 agents
ef2fcaa to
04af711
Compare
There was a problem hiding this comment.
Actionable comments posted: 10
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@references/daily-habits.md`:
- Line 15: Reconcile the conflicting manual /compact guidance in the 50%
recommendation and the mid-task compaction guidance around lines 119-120. Choose
one policy, state it consistently in both locations, and explicitly document the
exception for when the other behavior is appropriate.
In `@references/decision-framework.md`:
- Around line 24-28: Update the precedence guidance in the decision framework so
destructive changes, public API changes, schema changes, and unbounded-scope
changes always require asking first, even when callers are known and the change
otherwise qualifies as contained or auto-fixable. Apply the same precedence
clarification to the related guidance covering lines 44-55, while preserving the
existing contained/unbounded definitions.
- Line 16: Update the completion checklist to enforce risk-specific validation:
require lint and typecheck for scores 1–3, targeted tests for 4–6, and the full
test suite plus review of every changed file for 7–10. Replace the `git diff
--stat` check with `git status --short` or `git diff --name-only`, comparing the
resulting changed-file set against the planned files; apply the same
requirements to the corresponding checklist section around the later risk-gate
entries.
In `@references/orchestration-patterns.md`:
- Around line 240-249: Update the dynamic command substitution guidance around
the !`command` syntax to permit only fixed, allowlisted, read-only commands;
explicitly prohibit secrets and user-controlled interpolation, and require
explicit review for commands that access the network or modify state.
In `@skills/deslop/SKILL.md`:
- Around line 51-74: Update the Skill-file mode workflow in SKILL.md to require
rerunning the slop lint after applying edits, and make the final promotion
decision depend on that verification pass finding no remaining issues. Preserve
the existing reporting of flagged issues, applied edits, and cleanup summary,
but do not report the skill as ready to promote until the post-edit lint
succeeds.
In `@skills/domain-modeling/SKILL.md`:
- Around line 35-44: Update the shared artifact workflow for CONTEXT.md and
decision records to make creation and updates atomic under concurrent agents.
Use locking or an atomic create-with-retry mechanism so CONTEXT.md changes
cannot overwrite each other and decision numbering is rechecked after acquiring
coordination, retrying on collisions. Preserve the existing glossary update and
highest-record numbering behavior.
In `@skills/permission-tuner/SKILL.md`:
- Line 4: Update the permission guidance in SKILL.md to keep Edit operations
prompting every time, removing any contradictory auto-approval for Edit. Narrow
or remove broad Bash(npm ...*) auto-approval rules so repository-defined scripts
are not executed automatically, while preserving only genuinely read-only
permissions.
In `@skills/pro-workflow/SKILL.md`:
- Line 500: Update the install snippet and every other copy-paste `skills`
installation example in SKILL.md to invoke a pinned `skills@<version>` package
rather than unversioned `skills`, while preserving the existing repository and
command behavior.
In `@skills/safe-mode/SKILL.md`:
- Line 4: Update the safe-mode documentation around the user-invocable setting
to clarify that regex scanning is only best-effort and not a complete safety
boundary, or replace it with a stronger command-policy enforcement layer that
covers equivalent destructive command forms. Ensure users are not led to mistake
the matcher for comprehensive enforcement.
- Line 4: Update the safe-mode Write path validation around the lockdown
containment check to support files that do not yet exist: resolve the nearest
existing parent for canonicalization, then validate the requested target path
remains under the lockdown path. Preserve blocking for targets outside lockdown
and allow new files within it.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: e199da12-ad6f-4a81-b398-325e604ee931
⛔ Files ignored due to path filters (2)
assets/architecture.svgis excluded by!**/*.svgassets/banner.svgis excluded by!**/*.svg
📒 Files selected for processing (54)
.claude-plugin/marketplace.json.claude-plugin/plugin.jsonREADME.mdagents/cost-analyst.mdconfig.jsondocs/infographic.htmlreferences/agent-teams.mdreferences/claude-code-resources.mdreferences/cli-cheatsheet.mdreferences/context-engineering.mdreferences/context-loading.mdreferences/cross-agent-workflows.mdreferences/daily-habits.mdreferences/decision-framework.mdreferences/models-2026.mdreferences/modern-workflows-2026.mdreferences/new-features.mdreferences/orchestration-patterns.mdreferences/settings-guide.mdrules/skill-conventions.mdcskills/agent-teams/SKILL.mdskills/auto-setup/SKILL.mdskills/batch-orchestration/SKILL.mdskills/compact-guard/SKILL.mdskills/context-engineering/SKILL.mdskills/context-optimizer/SKILL.mdskills/cost-tracker/SKILL.mdskills/design-engineering/SKILL.mdskills/deslop/SKILL.mdskills/domain-modeling/SKILL.mdskills/file-watcher/SKILL.mdskills/improve-architecture/SKILL.mdskills/insights/SKILL.mdskills/learn-rule/SKILL.mdskills/llm-council/SKILL.mdskills/mcp-audit/SKILL.mdskills/orchestrate/SKILL.mdskills/parallel-worktrees/SKILL.mdskills/permission-tuner/SKILL.mdskills/plan-interrogate/SKILL.mdskills/pro-workflow/SKILL.mdskills/safe-mode/SKILL.mdskills/session-handoff/SKILL.mdskills/skill-optimizer/SKILL.mdskills/skill-router/SKILL.mdskills/smart-commit/SKILL.mdskills/sprint-status/SKILL.mdskills/survey-generator/SKILL.mdskills/tdd/SKILL.mdskills/wiki-builder/SKILL.mdskills/wiki-research-loop/SKILL.mdskills/wiki-viewer/SKILL.mdskills/wrap-up/SKILL.mdskills/writing-guidelines/SKILL.md
🚧 Files skipped from review as they are similar to previous changes (37)
- skills/learn-rule/SKILL.md
- skills/parallel-worktrees/SKILL.md
- skills/cost-tracker/SKILL.md
- references/context-engineering.md
- skills/context-optimizer/SKILL.md
- skills/sprint-status/SKILL.md
- skills/session-handoff/SKILL.md
- references/claude-code-resources.md
- skills/skill-optimizer/SKILL.md
- references/settings-guide.md
- skills/agent-teams/SKILL.md
- skills/context-engineering/SKILL.md
- skills/compact-guard/SKILL.md
- skills/wrap-up/SKILL.md
- skills/wiki-viewer/SKILL.md
- rules/skill-conventions.mdc
- skills/batch-orchestration/SKILL.md
- skills/writing-guidelines/SKILL.md
- skills/plan-interrogate/SKILL.md
- skills/mcp-audit/SKILL.md
- skills/smart-commit/SKILL.md
- skills/survey-generator/SKILL.md
- skills/orchestrate/SKILL.md
- .claude-plugin/marketplace.json
- references/agent-teams.md
- skills/wiki-builder/SKILL.md
- skills/skill-router/SKILL.md
- config.json
- references/cross-agent-workflows.md
- references/modern-workflows-2026.md
- references/new-features.md
- skills/improve-architecture/SKILL.md
- references/cli-cheatsheet.md
- references/models-2026.md
- docs/infographic.html
- references/context-loading.md
- README.md
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 10
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@references/daily-habits.md`:
- Line 15: Reconcile the conflicting manual /compact guidance in the 50%
recommendation and the mid-task compaction guidance around lines 119-120. Choose
one policy, state it consistently in both locations, and explicitly document the
exception for when the other behavior is appropriate.
In `@references/decision-framework.md`:
- Around line 24-28: Update the precedence guidance in the decision framework so
destructive changes, public API changes, schema changes, and unbounded-scope
changes always require asking first, even when callers are known and the change
otherwise qualifies as contained or auto-fixable. Apply the same precedence
clarification to the related guidance covering lines 44-55, while preserving the
existing contained/unbounded definitions.
- Line 16: Update the completion checklist to enforce risk-specific validation:
require lint and typecheck for scores 1–3, targeted tests for 4–6, and the full
test suite plus review of every changed file for 7–10. Replace the `git diff
--stat` check with `git status --short` or `git diff --name-only`, comparing the
resulting changed-file set against the planned files; apply the same
requirements to the corresponding checklist section around the later risk-gate
entries.
In `@references/orchestration-patterns.md`:
- Around line 240-249: Update the dynamic command substitution guidance around
the !`command` syntax to permit only fixed, allowlisted, read-only commands;
explicitly prohibit secrets and user-controlled interpolation, and require
explicit review for commands that access the network or modify state.
In `@skills/deslop/SKILL.md`:
- Around line 51-74: Update the Skill-file mode workflow in SKILL.md to require
rerunning the slop lint after applying edits, and make the final promotion
decision depend on that verification pass finding no remaining issues. Preserve
the existing reporting of flagged issues, applied edits, and cleanup summary,
but do not report the skill as ready to promote until the post-edit lint
succeeds.
In `@skills/domain-modeling/SKILL.md`:
- Around line 35-44: Update the shared artifact workflow for CONTEXT.md and
decision records to make creation and updates atomic under concurrent agents.
Use locking or an atomic create-with-retry mechanism so CONTEXT.md changes
cannot overwrite each other and decision numbering is rechecked after acquiring
coordination, retrying on collisions. Preserve the existing glossary update and
highest-record numbering behavior.
In `@skills/permission-tuner/SKILL.md`:
- Line 4: Update the permission guidance in SKILL.md to keep Edit operations
prompting every time, removing any contradictory auto-approval for Edit. Narrow
or remove broad Bash(npm ...*) auto-approval rules so repository-defined scripts
are not executed automatically, while preserving only genuinely read-only
permissions.
In `@skills/pro-workflow/SKILL.md`:
- Line 500: Update the install snippet and every other copy-paste `skills`
installation example in SKILL.md to invoke a pinned `skills@<version>` package
rather than unversioned `skills`, while preserving the existing repository and
command behavior.
In `@skills/safe-mode/SKILL.md`:
- Line 4: Update the safe-mode documentation around the user-invocable setting
to clarify that regex scanning is only best-effort and not a complete safety
boundary, or replace it with a stronger command-policy enforcement layer that
covers equivalent destructive command forms. Ensure users are not led to mistake
the matcher for comprehensive enforcement.
- Line 4: Update the safe-mode Write path validation around the lockdown
containment check to support files that do not yet exist: resolve the nearest
existing parent for canonicalization, then validate the requested target path
remains under the lockdown path. Preserve blocking for targets outside lockdown
and allow new files within it.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: e199da12-ad6f-4a81-b398-325e604ee931
⛔ Files ignored due to path filters (2)
assets/architecture.svgis excluded by!**/*.svgassets/banner.svgis excluded by!**/*.svg
📒 Files selected for processing (54)
.claude-plugin/marketplace.json.claude-plugin/plugin.jsonREADME.mdagents/cost-analyst.mdconfig.jsondocs/infographic.htmlreferences/agent-teams.mdreferences/claude-code-resources.mdreferences/cli-cheatsheet.mdreferences/context-engineering.mdreferences/context-loading.mdreferences/cross-agent-workflows.mdreferences/daily-habits.mdreferences/decision-framework.mdreferences/models-2026.mdreferences/modern-workflows-2026.mdreferences/new-features.mdreferences/orchestration-patterns.mdreferences/settings-guide.mdrules/skill-conventions.mdcskills/agent-teams/SKILL.mdskills/auto-setup/SKILL.mdskills/batch-orchestration/SKILL.mdskills/compact-guard/SKILL.mdskills/context-engineering/SKILL.mdskills/context-optimizer/SKILL.mdskills/cost-tracker/SKILL.mdskills/design-engineering/SKILL.mdskills/deslop/SKILL.mdskills/domain-modeling/SKILL.mdskills/file-watcher/SKILL.mdskills/improve-architecture/SKILL.mdskills/insights/SKILL.mdskills/learn-rule/SKILL.mdskills/llm-council/SKILL.mdskills/mcp-audit/SKILL.mdskills/orchestrate/SKILL.mdskills/parallel-worktrees/SKILL.mdskills/permission-tuner/SKILL.mdskills/plan-interrogate/SKILL.mdskills/pro-workflow/SKILL.mdskills/safe-mode/SKILL.mdskills/session-handoff/SKILL.mdskills/skill-optimizer/SKILL.mdskills/skill-router/SKILL.mdskills/smart-commit/SKILL.mdskills/sprint-status/SKILL.mdskills/survey-generator/SKILL.mdskills/tdd/SKILL.mdskills/wiki-builder/SKILL.mdskills/wiki-research-loop/SKILL.mdskills/wiki-viewer/SKILL.mdskills/wrap-up/SKILL.mdskills/writing-guidelines/SKILL.md
🚧 Files skipped from review as they are similar to previous changes (37)
- skills/learn-rule/SKILL.md
- skills/parallel-worktrees/SKILL.md
- skills/cost-tracker/SKILL.md
- references/context-engineering.md
- skills/context-optimizer/SKILL.md
- skills/sprint-status/SKILL.md
- skills/session-handoff/SKILL.md
- references/claude-code-resources.md
- skills/skill-optimizer/SKILL.md
- references/settings-guide.md
- skills/agent-teams/SKILL.md
- skills/context-engineering/SKILL.md
- skills/compact-guard/SKILL.md
- skills/wrap-up/SKILL.md
- skills/wiki-viewer/SKILL.md
- rules/skill-conventions.mdc
- skills/batch-orchestration/SKILL.md
- skills/writing-guidelines/SKILL.md
- skills/plan-interrogate/SKILL.md
- skills/mcp-audit/SKILL.md
- skills/smart-commit/SKILL.md
- skills/survey-generator/SKILL.md
- skills/orchestrate/SKILL.md
- .claude-plugin/marketplace.json
- references/agent-teams.md
- skills/wiki-builder/SKILL.md
- skills/skill-router/SKILL.md
- config.json
- references/cross-agent-workflows.md
- references/modern-workflows-2026.md
- references/new-features.md
- skills/improve-architecture/SKILL.md
- references/cli-cheatsheet.md
- references/models-2026.md
- docs/infographic.html
- references/context-loading.md
- README.md
🛑 Comments failed to post (9)
references/daily-habits.md (1)
15-15: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Resolve the conflicting
/compactguidance.Line 15 recommends compacting at 50% during work, while line 119 calls mid-task compaction an anti-pattern and recommends task boundaries. Choose one policy and state the exception explicitly.
Also applies to: 119-120
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@references/daily-habits.md` at line 15, Reconcile the conflicting manual /compact guidance in the 50% recommendation and the mid-task compaction guidance around lines 119-120. Choose one policy, state it consistently in both locations, and explicitly document the exception for when the other behavior is appropriate.references/decision-framework.md (2)
16-16: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Make the completion checklist enforce the risk-based gates.
The risk rules require a full suite and changed-file review for scores 7–10, but the checklist only requires tests “scoped to thoroughness.” Also,
git diff --statreports counts, not whether unexpected files changed. Require the risk-specific test level and comparegit status --short/git diff --name-onlywith the planned file set.Also applies to: 82-88
🧰 Tools
🪛 LanguageTool
[style] ~16-~16: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ... typecheck. At 4-6, add targeted tests. At 7-10, run the full test suite, review e...(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@references/decision-framework.md` at line 16, Update the completion checklist to enforce risk-specific validation: require lint and typecheck for scores 1–3, targeted tests for 4–6, and the full test suite plus review of every changed file for 7–10. Replace the `git diff --stat` check with `git status --short` or `git diff --name-only`, comparing the resulting changed-file set against the planned files; apply the same requirements to the corresponding checklist section around the later risk-gate entries.
24-28: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Define precedence between auto-fix and ask-first rules.
A public API change with known callers can satisfy “contained” and existing test coverage while also matching the “ask first” category. State that destructive, public API, schema, and unbounded-scope rules override the auto-fix rule.
Also applies to: 44-55
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@references/decision-framework.md` around lines 24 - 28, Update the precedence guidance in the decision framework so destructive changes, public API changes, schema changes, and unbounded-scope changes always require asking first, even when callers are known and the change otherwise qualifies as contained or auto-fixable. Apply the same precedence clarification to the related guidance covering lines 44-55, while preserving the existing contained/unbounded definitions.references/orchestration-patterns.md (1)
240-249: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Constrain dynamic command substitution to allowlisted, read-only commands.
The
!command`` syntax executes shell commands at invocation time. Document that only fixed, read-only commands are permitted, prohibit secrets and user-controlled interpolation, and require explicit review for commands that access the network or modify state.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@references/orchestration-patterns.md` around lines 240 - 249, Update the dynamic command substitution guidance around the !`command` syntax to permit only fixed, allowlisted, read-only commands; explicitly prohibit secrets and user-controlled interpolation, and require explicit review for commands that access the network or modify state.skills/deslop/SKILL.md (1)
51-74: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Require a post-edit verification gate before reporting “ready to promote.”
The new contract reports edits and readiness but never requires re-running the lint after edits. Add an explicit final pass and only report promotion readiness when no issues remain.
🧰 Tools
🪛 LanguageTool
[style] ~56-~56: Consider using “outdated” to strengthen your wording.
Context: ...Stale lines** - guidance written for an old version of the skill that no longer m...(OLD_VERSION)
[style] ~64-~64: Consider using “asks” instead.
Context: ...- the method ends before the work does (asks the question but never records the answer, cleans ...(ASK_THE_QUESTION)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/deslop/SKILL.md` around lines 51 - 74, Update the Skill-file mode workflow in SKILL.md to require rerunning the slop lint after applying edits, and make the final promotion decision depend on that verification pass finding no remaining issues. Preserve the existing reporting of flagged issues, applied edits, and cleanup summary, but do not report the skill as ready to promote until the post-edit lint succeeds.skills/domain-modeling/SKILL.md (1)
35-44: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Make shared artifact creation atomic.
Concurrent agents can read the same highest decision number, choose the same
NNNN, or overwrite simultaneousCONTEXT.mdupdates. Use a lock or atomic create-with-retry protocol for both shared outputs.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/domain-modeling/SKILL.md` around lines 35 - 44, Update the shared artifact workflow for CONTEXT.md and decision records to make creation and updates atomic under concurrent agents. Use locking or an atomic create-with-retry mechanism so CONTEXT.md changes cannot overwrite each other and decision numbering is rechecked after acquiring coordination, retrying on collisions. Preserve the existing glossary update and highest-record numbering behavior.skills/permission-tuner/SKILL.md (1)
4-4: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Do not expose contradictory auto-approval guidance.
The skill recommends auto-approving
Editdespite classifying it as “prompt every time,” and broadBash(npm ...*)rules execute repository-defined scripts rather than being read-only. Keep file writes prompting and narrow or remove automatic script-execution rules.🧰 Tools
🪛 SkillSpector (2.3.11)
[warning] 95: [EA2] Autonomous Decision Making: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Remediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
(Excessive Agency (EA2))
[warning] 99: [EA2] Autonomous Decision Making: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Remediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
(Excessive Agency (EA2))
[error] 60: [TM1] Tool Parameter Abuse: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Remediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
(Tool Misuse (TM1))
[error] 80: [TM1] Tool Parameter Abuse: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Remediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
(Tool Misuse (TM1))
[error] 57: [TM1] Tool Parameter Abuse: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Remediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
(Tool Misuse (TM1))
[error] 81: [TM1] Tool Parameter Abuse: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Remediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
(Tool Misuse (TM1))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/permission-tuner/SKILL.md` at line 4, Update the permission guidance in SKILL.md to keep Edit operations prompting every time, removing any contradictory auto-approval for Edit. Narrow or remove broad Bash(npm ...*) auto-approval rules so repository-defined scripts are not executed automatically, while preserving only genuinely read-only permissions.Source: Linters/SAST tools
skills/pro-workflow/SKILL.md (1)
500-500: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
python3 - <<'PY' from pathlib import Path p = Path('skills/pro-workflow/SKILL.md') lines = p.read_text().splitlines() for start in [480, 495, 500, 510]: if start <= len(lines): end = min(len(lines), start+25) print(f"\n--- lines {start}-{end} ---") for i in range(start-1, end): print(f"{i+1}: {lines[i]}") PYRepository: rohitg00/pro-workflow
Length of output: 3978
🏁 Script executed:
rg -n "npx skills add|skills add installs|install(ation)? docs|skills add" -S skills/pro-workflow/SKILL.md .Repository: rohitg00/pro-workflow
Length of output: 3030
🏁 Script executed:
git ls-files | rg '^skills/pro-workflow/SKILL\.md$|^skills/'Repository: rohitg00/pro-workflow
Length of output: 2466
🌐 Web query:
"skills add npx pin version npm package documentation"💡 Result:
To execute a specific version of an npm package using npx, you can append the desired version to the package name using the @ symbol [1][2]. This allows you to run a tool or binary without permanently installing it or modifying your project's dependencies [1][2]. Basic Syntax: npx @ [arguments...] For example, to run a specific version of the ESLint package: npx eslint@7.32.0. Key Considerations: 1. Temporary Execution: npx downloads the specified package version to a temporary cache, executes it, and removes it (or leaves it in the cache for potential reuse), without adding the package to your package.json file [1][2]. 2. Local Precedence: By default, if the package is already installed in your project's local node_modules, npx will use that version [3][1][2]. To override this and force the use of a specific version from the registry, use the syntax above [1]. 3. Version Pinning: While you can specify a version at the time of execution, npx does not provide a built-in mechanism to "pin" or lock that version for future npx runs within a project [4]. Each time you run an npx command, it may re-fetch the latest metadata unless a version is explicitly provided [5]. For projects requiring stable, reproducible builds, defining the tool as a development dependency in your package.json and using a lockfile (package-lock.json) is the recommended approach for pinning the entire dependency graph [4]. 4. Command Execution: If you need to run a package that is not the primary binary or requires multiple packages in the same environment, you can use the --package option [3][6][7]: npx --package=@ [arguments...] This approach provides flexibility for testing different versions of tools, running one-off commands, or working around compatibility issues without long-term project configuration changes [1][2].
Citations:
- 1: https://uptimerobot.com/knowledge-hub/devops/npm-install/
- 2: https://dev.to/orlikova/understanding-npx-1m4
- 3: https://docs.npmjs.com/cli/v11/commands/npx/
- 4: semantic-release/semantic-release#3955
- 5: npm/cli#9244
- 6: https://github.com/npm/npx
- 7: https://github.com/npm/cli/blob/latest/docs/lib/content/commands/npx.md
🌐 Web query:
"npm npx package@version command syntax latest package each invocation"💡 Result:
The npx command, which is an alias for npm exec, allows you to execute binaries from npm packages [1][2]. The command syntax is as follows: npx [options] [@] [args...] npx --package=[@] -- [args...] Key details regarding package versioning and caching: 1. Caching Behavior: npx uses a cache to store packages it downloads [3]. It caches packages based on the specific package specifier (the name and the version/range provided) [4][5]. Because of this, it does not necessarily fetch the latest version on every invocation [6]. If you provide a specific version or a range, npx will attempt to use a cached version matching that specifier [4][5]. 2. Latest Version: To ensure you are always using the latest version, you should specify
@latestexplicitly (e.g., npx package-name@latest) [6][4]. Simply omitting the version specifier may still result in npx using a cached version if the package has been run previously [6]. 3. Cache Isolation: Each unique package specifier (e.g., package, package@latest, and package@1.0.0) is treated as a distinct entry in the npx cache [4]. Consequently, using different ways to refer to the same package version can lead to redundant downloads and multiple cached copies of the same files [4]. 4. Forcing Fresh Downloads: If you encounter issues with stale versions in the cache, you can sometimes work around this by using --ignore-existing or by specifying the precise version [3][6]. However, the most reliable way to force the absolute latest version is to use the@latesttag [6]. In modern npm (v7.0.0 and later), npx was rewritten to use npm exec directly, so documentation for npm exec and npx is largely interchangeable regarding these behaviors [2].Citations:
- 1: https://docs.npmjs.com/cli/v11/commands/npx/
- 2: https://docs.npmjs.com/cli/v8/commands/npx
- 3: https://registry.npmjs.org/npx
- 4: npm/cli#6450
- 5: npm/cli#7838
- 6: npm/cli#6179
🏁 Script executed:
python3 - <<'PY' from pathlib import Path for path, ranges in { 'README.md': [(66,82),(394,404)], 'references/claude-code-resources.md': [(76,86)], 'references/cross-agent-workflows.md': [(82,92)], }.items(): p = Path(path) if not p.exists(): continue lines = p.read_text().splitlines() print(f"\n### {path}") for start,end in ranges: if start <= len(lines): e = min(len(lines), end) print(f"\n--- lines {start}-{e} ---") for i in range(start-1, e): print(f"{i+1}: {lines[i]}") PYRepository: rohitg00/pro-workflow
Length of output: 2413
🏁 Script executed:
python3 - <<'PY' import urllib.request, json, re urls = [ 'https://registry.npmjs.org/skills/latest', 'https://registry.npmjs.org/skills', ] for url in urls: try: with urllib.request.urlopen(url, timeout=20) as r: data = json.load(r) print(url) print('name:', data.get('name')) print('version:', data.get('version') or data.get('dist-tags',{}).get('latest')) print('description:', data.get('description')) print('bin:', data.get('bin')) print('versions count:' if 'versions' in data else 'no versions', len(data.get('versions',{}))) print() except Exception as e: print(url, 'ERR', e) PYRepository: rohitg00/pro-workflow
Length of output: 510
Pin the
skillspackage version in the install snippet.npx skills add rohitg00/pro-workflowleaves readers dependent on whichever registry releasenpxresolves; use a versioned specifier likenpx skills@<version> add rohitg00/pro-workflowand apply the same pin to the other copy-paste install examples.🧰 Tools
🪛 SkillSpector (2.3.11)
[warning] 500: [RP1] null: npx commands without a version suffix (e.g.
@1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Remediation: Pin the version: npx
@scope/server@1.2.3(MCP Rug Pull (RP1))
[warning] 145: [RA2] Session Persistence: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Remediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
(Rogue Agent (RA2))
[warning] 414: [RA2] Session Persistence: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Remediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
(Rogue Agent (RA2))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/pro-workflow/SKILL.md` at line 500, Update the install snippet and every other copy-paste `skills` installation example in SKILL.md to invoke a pinned `skills@<version>` package rather than unversioned `skills`, while preserving the existing repository and command behavior.Source: Linters/SAST tools
skills/safe-mode/SKILL.md (1)
4-4: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Do not treat the regex scan as a complete safety boundary.
The documented matcher can miss equivalent destructive commands such as
bash -c 'rm -rf …',curl … | zsh, command substitutions, orsudo -u root rm …. Either block through a stronger command-policy layer or clearly scope this to best-effort warnings so users do not mistake it for enforcement.🧰 Tools
🪛 SkillSpector (2.3.11)
[warning] 44: [PE2] Sudo/Root Execution: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Remediation: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
(Privilege Escalation (PE2))
[warning] 40: [PE2] Sudo/Root Execution: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Remediation: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
(Privilege Escalation (PE2))
[warning] 118: [PE2] Sudo/Root Execution: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Remediation: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
(Privilege Escalation (PE2))
[error] 33: [TM1] Tool Parameter Abuse: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Remediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
(Tool Misuse (TM1))
[error] 40: [TM1] Tool Parameter Abuse: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Remediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
(Tool Misuse (TM1))
[error] 118: [TM1] Tool Parameter Abuse: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Remediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
(Tool Misuse (TM1))
[error] 36: [TM1] Tool Parameter Abuse: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Remediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
(Tool Misuse (TM1))
[error] 37: [TM1] Tool Parameter Abuse: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Remediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
(Tool Misuse (TM1))
[warning] 40: [TM3] Unsafe Defaults: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Remediation: Override unsafe defaults with secure settings (verify=True, auth required, restrictive permissions). Review and harden all tool configurations.
(Tool Misuse (TM3))
[error] 50: [YR1] YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Remediation: Remove the malware payload or compromised file entirely. Investigate how it entered the skill and audit all other artifacts for additional indicators of compromise.
(YARA Match (YR1))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/safe-mode/SKILL.md` at line 4, Update the safe-mode documentation around the user-invocable setting to clarify that regex scanning is only best-effort and not a complete safety boundary, or replace it with a stronger command-policy enforcement layer that covers equivalent destructive command forms. Ensure users are not led to mistake the matcher for comprehensive enforcement.Source: Linters/SAST tools
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail printf '--- file list ---\n' git ls-files 'skills/safe-mode/*' 'skills/*safe*' | sed 's#^`#-` #' printf '\n--- outline skills/safe-mode/SKILL.md ---\n' wc -l skills/safe-mode/SKILL.md cat -n skills/safe-mode/SKILL.md | sed -n '1,160p' printf '\n--- search for realpathSync and lockdown containment ---\n' rg -n "realpathSync|isInsideLockdown|lockdown|safe-mode" skills . -g '!**/node_modules/**'Repository: rohitg00/pro-workflow
Length of output: 250
🏁 Script executed:
#!/bin/bash set -euo pipefail echo '--- file list ---' git ls-files 'skills/safe-mode/*' 'skills/*safe*' | sed 's#^`#-` #' echo echo '--- skills/safe-mode/SKILL.md ---' wc -l skills/safe-mode/SKILL.md cat -n skills/safe-mode/SKILL.md | sed -n '1,200p' echo echo '--- search for realpathSync and lockdown containment ---' rg -n "realpathSync|isInsideLockdown|lockdown|safe-mode" skills . -g '!**/node_modules/**'Repository: rohitg00/pro-workflow
Length of output: 14531
Allow new files inside lockdown.
skills/safe-mode/SKILL.md:132-136fs.realpathSync(path.resolve(filePath))throws for new files, soWriteis blocked even when the target is under the lockdown path. Resolve the nearest existing parent before the containment check, then validate the requested target path.🧰 Tools
🪛 SkillSpector (2.3.11)
[warning] 44: [PE2] Sudo/Root Execution: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Remediation: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
(Privilege Escalation (PE2))
[warning] 40: [PE2] Sudo/Root Execution: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Remediation: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
(Privilege Escalation (PE2))
[warning] 118: [PE2] Sudo/Root Execution: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Remediation: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
(Privilege Escalation (PE2))
[error] 33: [TM1] Tool Parameter Abuse: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Remediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
(Tool Misuse (TM1))
[error] 40: [TM1] Tool Parameter Abuse: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Remediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
(Tool Misuse (TM1))
[error] 118: [TM1] Tool Parameter Abuse: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Remediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
(Tool Misuse (TM1))
[error] 36: [TM1] Tool Parameter Abuse: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Remediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
(Tool Misuse (TM1))
[error] 37: [TM1] Tool Parameter Abuse: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Remediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
(Tool Misuse (TM1))
[warning] 40: [TM3] Unsafe Defaults: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Remediation: Override unsafe defaults with secure settings (verify=True, auth required, restrictive permissions). Review and harden all tool configurations.
(Tool Misuse (TM3))
[error] 50: [YR1] YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Remediation: Remove the malware payload or compromised file entirely. Investigate how it entered the skill and audit all other artifacts for additional indicators of compromise.
(YARA Match (YR1))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/safe-mode/SKILL.md` at line 4, Update the safe-mode Write path validation around the lockdown containment check to support files that do not yet exist: resolve the nearest existing parent for canonicalization, then validate the requested target path remains under the lockdown path. Preserve blocking for targets outside lockdown and allow new files within it.
1 participant
Modernizes pro-workflow for the current model lineup, the multi-agent workflow shift, and a larger, better-governed skill set.
Skills
skill-router(index of every skill and command, tagged human-run vs auto-triggered),tdd,domain-modeling,design-engineering,writing-guidelines,improve-architecture.plan-interrogatenow emits a shared-languageCONTEXT.mdand decision records, not just answers.deslopgains a skill-file lint mode (stale lines, bloat, dead sentences, duplication, premature stop, weak anchor, missing invocation intent, wrong write op).rules/skill-conventions.mdc: invocation intent, add/update/append write semantics, buckets, and sync obligations. 25 human-run skills labeleduser-invocable: true.References
references/models-2026.md: current tiers (Fable 5, Opus 4.8, Sonnet 5, Haiku 4.5), effort routing, task budgets.references/modern-workflows-2026.md: multi-agent orchestration, Agent Teams, checkpoints, backgrounded commands, ACP and MCP interop, the skills-commands merger.pro-workflowmodel section refreshed to the current lineup and effort routing.references/; web-only artifacts dropped.Install and hygiene
skills add(owner/repo form).Review
JSON valid, all 41 skills carry complete frontmatter, internal links resolve, invocation labels match the router, counts consistent.
Summary by CodeRabbit
skills add; refreshed README metrics, reference guides, and CLI/resource links.