bymax-bootstrap

Bymax workflows for Codex: evidence-based code review, planning, testing, PR management, QA and security audits, persona-based usability testing, defensive security playbooks and capability-aware orchestration.

61 skills

Whole-system QA and security audit for any project, with evidence and hand-off. Point /bymax-qa:audit at a target: a Jira ticket key (verifies access, reads the acceptance criteria, reports each PASS/FAIL/BLOCKED/NOT-VERIFIABLE with evidence), a branch or ref range or PR (scopes the hunt to the change, like a code review), or nothing (the whole system via a signed scope). It maps the stack and its trust boundaries, hunts by domain (authentication, authorization and tenant isolation, injection and input, cache/Redis, database/Postgres, observability, transport and config, architecture, frontend, supply chain, and AI/LLM and agents when the project uses them) with read-only finder agents, probes the running stack against allow-listed hosts only, and admits a finding only after verification: a runnable reproduction, captured evidence and verified impact, with an independent verifier for every hunted candidate. Findings carry ASVS 5.0, CWE and API Top 10 references and a CVSS vector, and move OPEN → HANDED-OFF → FIX-CLAIMED → VALIDATED or REOPENED. The auditor never edits source: findings are handed to the owning peer session over cross-session messaging, filed as GitHub issues when no peer is live, or written back to the ticket as a comment, and re-tested before they close. A PreToolUse hook is a floor under the scope while an audit runs: network probes in command position reach only allow-listed hosts, and Write/Edit tool calls land only in .claude/qa/ (arbitrary Bash writes rest on the skill's discipline). External scanners are used when present, never bundled. Also ships Cloudflare's security-audit skill, vendored unchanged, as /bymax-qa:security-audit. Also ships /bymax-qa:security-playbooks, an on-demand index of 20 defensive playbooks from Anthropic-Cybersecurity-Skills (Apache-2.0), unchanged. Also ships /bymax-qa:personas, persona-based usability QA: it interviews the user (persona count, iPhone Simulator, Android emulator or browser, markets, days), researches

24 skills · 3 agents · hooks

Bounded Claude + Codex code review with shared context, verified findings and correction deltas, plus TDD, specialist reviewers and security hooks. The Codex CLI is required for dual-review certification.

1 skill · 4 commands · 7 agents · hooks

Spec → Roadmap → Phase-Tasks → Task — a phased planning + execution workflow with explicit user-approval gates and JIRA-style task dashboards. Includes /bymax-workflow:brainstorm, /bymax-workflow:plan, /bymax-workflow:verify, /bymax-workflow:checkpoint, the universal /bymax-workflow:standards reference (with the §0 reuse-first simplicity ladder), and /bymax-workflow:autopilot — the loop-engineering executor that autonomously drives an approved roadmap to done, one merge-gated PR per phase.

2 skills · 8 commands

Real-browser verification and assisted UI testing. /bymax-web-verify:test brings the full stack up (reuses or starts the backend, frontend in the Claude Desktop Browser pane) and walks a UI flow while the user watches, with console/network/server-log verification per step; agent-browser fallback in terminals. /bymax-web-verify:verify confirms a single web change in a live browser. /bymax-web-verify:setup installs the agent-browser CLI + Chrome in one shot. Depends on agent-browser; never bundles it. /bymax-web-verify:record captures a UI flow as a reviewable video: the project's own Playwright with video forced on for one run, human pacing (slowMo + resized timeout), trimmed and pacing-gated with ffmpeg/ffprobe, published with a plain-text walkthrough derived from the spec that ran.

4 commands · hooks

Slash commands to boot the iOS Simulator (/bymax-mobile:sim-ios) and Android Emulator (/bymax-mobile:sim-android) for Expo / React Native projects. Auto-detects whether to reattach Metro (fast) or run a full rebuild + install (slow). Honors $BYMAX_SIM_IOS, $BYMAX_SIM_ANDROID, and $APP_VARIANT.

2 commands

MetaHarness integration — surfaces score/genome/mint/mcp-scan/threat-model via skills; pairs with @metaharness/router (ADR-148/149) for cost-optimal model routing; honors ADR-150 optional-augmentation constraint

13 skills · 1 command · 1 agent · hooks

Agent skills for Azure SQL Developer, the Azure SQL Database engine running locally in a container. Teaches your agent to run the engine, connect, migrate, scaffold, build RAG, wire CI, and go local-to-cloud, using the real Private Preview image instead of the SQL Server image.

17 skills

REST and GraphQL API scaffolding, framework selection, backend architecture, and API generation

1 skill · 4 agents

Build, launch, grade, and schedule Claude Managed Agents (CMA) in your own Anthropic account — a plugin re-implementation of Anthropic's launch-your-agent reference skill (Apache-2.0; independent, not a fork). Every session starts with a goal (./my-agent/goal.json, opt-in SessionStart hook, driven by /cs-goal); loop_compiler.py compiles it into a bounded grade->iterate loop (max_iterations 1..20), a recurring cron scheduled-deployment loop, or a single-pass interview->stage->launch workflow. 6 skills: orchestrator (context: fork goal router) + interview + stage-launch + grade-iterate + run-without-you + wrap-up. 18 stdlib-only deterministic scaffolders (no network/API calls; live launches emitted as BYOK curl that never prints the key), 4 agents, 8 commands, hooks, 5 references, 4 assets. Validators enforce CMA limits. Distinct from engineering/agent-harness (generic domain loop) and write-a-skill (authors Claude Code skills, not CMAs).

6 skills · 8 commands · 4 agents · hooks

Comprehensive context engineering and harness engineering skills for production-grade AI agent systems: fundamentals, degradation patterns, compression, optimization, self-managed context (model-controlled live context editing), multi-agent coordination, long-horizon prompting (pseudo-formal task briefs for long-running and parallel agents), memory systems, tool design, filesystem context, hosted agents, evaluation, autonomous harnesses, self-improvement loops (RSI, meta-harnesses, evolutionary scaffold search), latent briefing (KV cache sharing between agents), project development, and cognitive architecture. Ships with a researcher operating system (rubrics, mechanism registry, claim provenance, run state machine, adversarial benchmarks, continuous loop).

19 skills

에이전트 팀 & 스킬 아키텍트 v2. 도메인/프로젝트에 맞는 하네스를 구성하고, 전문 에이전트를 정의하며, 에이전트가 사용할 스킬을 생성하는 메타 스킬. 워크플로우 오케스트레이션 · 퍼시스턴트 에이전트 협업 · 서브에이전트 위임 3중 실행 모드 지원.

2 skills