bymax-mobile

Bymax workflows for Codex: evidence-based code review, planning, testing, PR management, QA and security audits, persona-based usability testing, defensive security playbooks and capability-aware orchestration.

61 skills

Whole-system QA and security audit for any project, with evidence and hand-off. Point /bymax-qa:audit at a target: a Jira ticket key (verifies access, reads the acceptance criteria, reports each PASS/FAIL/BLOCKED/NOT-VERIFIABLE with evidence), a branch or ref range or PR (scopes the hunt to the change, like a code review), or nothing (the whole system via a signed scope). It maps the stack and its trust boundaries, hunts by domain (authentication, authorization and tenant isolation, injection and input, cache/Redis, database/Postgres, observability, transport and config, architecture, frontend, supply chain, and AI/LLM and agents when the project uses them) with read-only finder agents, probes the running stack against allow-listed hosts only, and admits a finding only after verification: a runnable reproduction, captured evidence and verified impact, with an independent verifier for every hunted candidate. Findings carry ASVS 5.0, CWE and API Top 10 references and a CVSS vector, and move OPEN → HANDED-OFF → FIX-CLAIMED → VALIDATED or REOPENED. The auditor never edits source: findings are handed to the owning peer session over cross-session messaging, filed as GitHub issues when no peer is live, or written back to the ticket as a comment, and re-tested before they close. A PreToolUse hook is a floor under the scope while an audit runs: network probes in command position reach only allow-listed hosts, and Write/Edit tool calls land only in .claude/qa/ (arbitrary Bash writes rest on the skill's discipline). External scanners are used when present, never bundled. Also ships Cloudflare's security-audit skill, vendored unchanged, as /bymax-qa:security-audit. Also ships /bymax-qa:security-playbooks, an on-demand index of 20 defensive playbooks from Anthropic-Cybersecurity-Skills (Apache-2.0), unchanged. Also ships /bymax-qa:personas, persona-based usability QA: it interviews the user (persona count, iPhone Simulator, Android emulator or browser, markets, days), researches

24 skills · 3 agents · hooks

Bounded Claude + Codex code review with shared context, verified findings and correction deltas, plus TDD, specialist reviewers and security hooks. The Codex CLI is required for dual-review certification.

1 skill · 4 commands · 7 agents · hooks

Spec → Roadmap → Phase-Tasks → Task — a phased planning + execution workflow with explicit user-approval gates and JIRA-style task dashboards. Includes /bymax-workflow:brainstorm, /bymax-workflow:plan, /bymax-workflow:verify, /bymax-workflow:checkpoint, the universal /bymax-workflow:standards reference (with the §0 reuse-first simplicity ladder), and /bymax-workflow:autopilot — the loop-engineering executor that autonomously drives an approved roadmap to done, one merge-gated PR per phase.

2 skills · 8 commands

Real-browser verification and assisted UI testing. /bymax-web-verify:test brings the full stack up (reuses or starts the backend, frontend in the Claude Desktop Browser pane) and walks a UI flow while the user watches, with console/network/server-log verification per step; agent-browser fallback in terminals. /bymax-web-verify:verify confirms a single web change in a live browser. /bymax-web-verify:setup installs the agent-browser CLI + Chrome in one shot. Depends on agent-browser; never bundles it. /bymax-web-verify:record captures a UI flow as a reviewable video: the project's own Playwright with video forced on for one run, human pacing (slowMo + resized timeout), trimmed and pacing-gated with ffmpeg/ffprobe, published with a plain-text walkthrough derived from the spec that ran.

4 commands · hooks

Scaffold new projects (Next.js, Expo/RN, Vite+React, Node) with strict TS, ESLint flat-config + security plugin, Prettier, .vscode (format-on-save), Husky + commitlint + lint-staged, and CLAUDE.md/AGENTS.md/README.md templates. Also upgrades existing projects non-destructively.

2 commands

Install the "AAS Mobile App Builder" editorial skill bundle for Claude Code.

19 skills

Official Expo skills for building, deploying, upgrading, and debugging React Native apps with Expo. Covers UI development with Expo Router, SwiftUI and Jetpack Compose components, Tailwind CSS setup, API routes, data fetching, CI/CD workflows, App Store and Play Store deployment, SDK upgrades, DOM components, and dev client distribution.

23 skills · 1 MCP server

Comprehensive UI/UX design plugin for mobile (iOS, Android, React Native) and web applications with design systems, accessibility, and modern patterns

9 skills · 4 commands · 3 agents

Work with incident.io from Claude: respond to and investigate incidents, check on-call schedules and escalations, and author the runbooks, skills and architecture docs that incident.io investigations draw on. Bundles the official incident.io MCP server (OAuth on first use).

11 skills · 1 MCP server

Master Apple's Human Interface Guidelines (HIG) with focus on 2026 Liquid Glass aesthetics. Design and audit iOS, macOS, and visionOS apps for full compliance and premium feel. Includes hig_checker Python tool for tap targets and contrast.

1 skill

Essential development subagents for everyday coding tasks - backend, frontend, fullstack, mobile, and API design