bymax-agent-kit

Bymax workflows for Codex: evidence-based code review, planning, testing, PR management, QA and security audits, persona-based usability testing, defensive security playbooks and capability-aware orchestration.

61 skills

Whole-system QA and security audit for any project, with evidence and hand-off. Point /bymax-qa:audit at a target: a Jira ticket key (verifies access, reads the acceptance criteria, reports each PASS/FAIL/BLOCKED/NOT-VERIFIABLE with evidence), a branch or ref range or PR (scopes the hunt to the change, like a code review), or nothing (the whole system via a signed scope). It maps the stack and its trust boundaries, hunts by domain (authentication, authorization and tenant isolation, injection and input, cache/Redis, database/Postgres, observability, transport and config, architecture, frontend, supply chain, and AI/LLM and agents when the project uses them) with read-only finder agents, probes the running stack against allow-listed hosts only, and admits a finding only after verification: a runnable reproduction, captured evidence and verified impact, with an independent verifier for every hunted candidate. Findings carry ASVS 5.0, CWE and API Top 10 references and a CVSS vector, and move OPEN → HANDED-OFF → FIX-CLAIMED → VALIDATED or REOPENED. The auditor never edits source: findings are handed to the owning peer session over cross-session messaging, filed as GitHub issues when no peer is live, or written back to the ticket as a comment, and re-tested before they close. A PreToolUse hook is a floor under the scope while an audit runs: network probes in command position reach only allow-listed hosts, and Write/Edit tool calls land only in .claude/qa/ (arbitrary Bash writes rest on the skill's discipline). External scanners are used when present, never bundled. Also ships Cloudflare's security-audit skill, vendored unchanged, as /bymax-qa:security-audit. Also ships /bymax-qa:security-playbooks, an on-demand index of 20 defensive playbooks from Anthropic-Cybersecurity-Skills (Apache-2.0), unchanged. Also ships /bymax-qa:personas, persona-based usability QA: it interviews the user (persona count, iPhone Simulator, Android emulator or browser, markets, days), researches

24 skills · 3 agents · hooks

Bounded Claude + Codex code review with shared context, verified findings and correction deltas, plus TDD, specialist reviewers and security hooks. The Codex CLI is required for dual-review certification.

1 skill · 4 commands · 7 agents · hooks

Spec → Roadmap → Phase-Tasks → Task — a phased planning + execution workflow with explicit user-approval gates and JIRA-style task dashboards. Includes /bymax-workflow:brainstorm, /bymax-workflow:plan, /bymax-workflow:verify, /bymax-workflow:checkpoint, the universal /bymax-workflow:standards reference (with the §0 reuse-first simplicity ladder), and /bymax-workflow:autopilot — the loop-engineering executor that autonomously drives an approved roadmap to done, one merge-gated PR per phase.

2 skills · 8 commands

Real-browser verification and assisted UI testing. /bymax-web-verify:test brings the full stack up (reuses or starts the backend, frontend in the Claude Desktop Browser pane) and walks a UI flow while the user watches, with console/network/server-log verification per step; agent-browser fallback in terminals. /bymax-web-verify:verify confirms a single web change in a live browser. /bymax-web-verify:setup installs the agent-browser CLI + Chrome in one shot. Depends on agent-browser; never bundles it. /bymax-web-verify:record captures a UI flow as a reviewable video: the project's own Playwright with video forced on for one run, human pacing (slowMo + resized timeout), trimmed and pacing-gated with ffmpeg/ffprobe, published with a plain-text walkthrough derived from the spec that ran.

4 commands · hooks

Scaffold new projects (Next.js, Expo/RN, Vite+React, Node) with strict TS, ESLint flat-config + security plugin, Prettier, .vscode (format-on-save), Husky + commitlint + lint-staged, and CLAUDE.md/AGENTS.md/README.md templates. Also upgrades existing projects non-destructively.

2 commands

Slash commands to boot the iOS Simulator (/bymax-mobile:sim-ios) and Android Emulator (/bymax-mobile:sim-android) for Expo / React Native projects. Auto-detects whether to reattach Metro (fast) or run a full rebuild + install (slow). Honors $BYMAX_SIM_IOS, $BYMAX_SIM_ANDROID, and $APP_VARIANT.

2 commands

The PR lifecycle, powered by the gh CLI. /bymax-pr:push ships work safely (feature branch — never the default branch — staged set respected, complete Conventional-Commits message, push with upstream; `pr` token opens a fully-described PR). /bymax-pr:babysit-pr shepherds the open PR to merge-readiness: resolves conflicts, polls CI at a cadence matched to the CI's real duration (270 s floor), classifies real vs flaky failures, fixes real ones locally, triages bot review comments, and notifies you when green. Never merges, never pushes to the base branch. Depends on gh + git; never bundles them.

1 skill · 1 command

Engineering Project Manager for multi-agent development. /bymax-pm:pm turns the session into a PM/TPM above independent Claude Code peer sessions: discovers agents via ListAgents, delegates structured task contracts via SendMessage, enforces an evidence-based lifecycle (assign, acknowledge, independent review, PM verification — a worker saying done is never enough), detects stuck agents with one-shot idle notices instead of polling, resolves blockers and cross-repo dependencies, and persists all project truth in a git-friendly .claude/pm/ workspace that survives restarts. The PM coordinates; it does not implement.

1 skill

The weekly silent-standup report for one repository, written from evidence. /bymax-report:standup collects what shipped in a period (pull requests via gh, commits via git) and what was asked (what a person typed into Claude Code or Codex sessions on that repository, worktree sessions and pasted third-party requests included), then writes the two sections the team reads: a PROGRESS list of the asks as outcome sentences, undelivered ones marked in progress, and UPDATES grouped by product area saying what changed and what it replaced. No hashes, PR numbers or file names reach the report; an evidence block under it maps every line to its PR, commit and request. Plain text printed to paste, no Markdown, no file left on disk, English by default; --author keeps one git author. Depends on git; gh is used when present and its absence is reported, never hidden.

1 skill

Meta-plugin reference. Claude Code does not auto-install dependencies — install bymax-workflow, bymax-quality, bymax-bootstrap, bymax-mobile, bymax-web-verify, bymax-pr, bymax-pm, bymax-qa, and bymax-report individually for the full toolkit.