bymax-pr

Bymax workflows for Codex: evidence-based code review, planning, testing, PR management, QA and security audits, persona-based usability testing, defensive security playbooks and capability-aware orchestration.

61 skills

Whole-system QA and security audit for any project, with evidence and hand-off. Point /bymax-qa:audit at a target: a Jira ticket key (verifies access, reads the acceptance criteria, reports each PASS/FAIL/BLOCKED/NOT-VERIFIABLE with evidence), a branch or ref range or PR (scopes the hunt to the change, like a code review), or nothing (the whole system via a signed scope). It maps the stack and its trust boundaries, hunts by domain (authentication, authorization and tenant isolation, injection and input, cache/Redis, database/Postgres, observability, transport and config, architecture, frontend, supply chain, and AI/LLM and agents when the project uses them) with read-only finder agents, probes the running stack against allow-listed hosts only, and admits a finding only after verification: a runnable reproduction, captured evidence and verified impact, with an independent verifier for every hunted candidate. Findings carry ASVS 5.0, CWE and API Top 10 references and a CVSS vector, and move OPEN → HANDED-OFF → FIX-CLAIMED → VALIDATED or REOPENED. The auditor never edits source: findings are handed to the owning peer session over cross-session messaging, filed as GitHub issues when no peer is live, or written back to the ticket as a comment, and re-tested before they close. A PreToolUse hook is a floor under the scope while an audit runs: network probes in command position reach only allow-listed hosts, and Write/Edit tool calls land only in .claude/qa/ (arbitrary Bash writes rest on the skill's discipline). External scanners are used when present, never bundled. Also ships Cloudflare's security-audit skill, vendored unchanged, as /bymax-qa:security-audit. Also ships /bymax-qa:security-playbooks, an on-demand index of 20 defensive playbooks from Anthropic-Cybersecurity-Skills (Apache-2.0), unchanged. Also ships /bymax-qa:personas, persona-based usability QA: it interviews the user (persona count, iPhone Simulator, Android emulator or browser, markets, days), researches

24 skills · 3 agents · hooks

Bounded Claude + Codex code review with shared context, verified findings and correction deltas, plus TDD, specialist reviewers and security hooks. The Codex CLI is required for dual-review certification.

1 skill · 4 commands · 7 agents · hooks

Spec → Roadmap → Phase-Tasks → Task — a phased planning + execution workflow with explicit user-approval gates and JIRA-style task dashboards. Includes /bymax-workflow:brainstorm, /bymax-workflow:plan, /bymax-workflow:verify, /bymax-workflow:checkpoint, the universal /bymax-workflow:standards reference (with the §0 reuse-first simplicity ladder), and /bymax-workflow:autopilot — the loop-engineering executor that autonomously drives an approved roadmap to done, one merge-gated PR per phase.

2 skills · 8 commands

Real-browser verification and assisted UI testing. /bymax-web-verify:test brings the full stack up (reuses or starts the backend, frontend in the Claude Desktop Browser pane) and walks a UI flow while the user watches, with console/network/server-log verification per step; agent-browser fallback in terminals. /bymax-web-verify:verify confirms a single web change in a live browser. /bymax-web-verify:setup installs the agent-browser CLI + Chrome in one shot. Depends on agent-browser; never bundles it. /bymax-web-verify:record captures a UI flow as a reviewable video: the project's own Playwright with video forced on for one run, human pacing (slowMo + resized timeout), trimmed and pacing-gated with ffmpeg/ffprobe, published with a plain-text walkthrough derived from the spec that ran.

4 commands · hooks

Scaffold new projects (Next.js, Expo/RN, Vite+React, Node) with strict TS, ESLint flat-config + security plugin, Prettier, .vscode (format-on-save), Husky + commitlint + lint-staged, and CLAUDE.md/AGENTS.md/README.md templates. Also upgrades existing projects non-destructively.

2 commands

Core skills library for Claude Code: TDD, debugging, collaboration patterns, and proven techniques

15 skills · hooks

Backend API design, GraphQL architecture, workflow orchestration with Temporal, and test-driven backend development

9 skills · 1 command · 8 agents

Repomix MCP server for AI-powered codebase analysis. Pack local/remote repositories and search or read the generated outputs. Foundation plugin that enables all Repomix features in Claude Code.

1 MCP server

AI-supervised issue tracker for coding workflows

1 skill · 1 agent · hooks

Architecture diagrams, explanations and Mermaid source for any public GitHub repository, from gitdiagram.com.

2 skills · 1 MCP server

Connect Claude to Prowler Cloud through the Prowler MCP server. Reads providers, scans, findings, compliance results and resources for AWS, Azure, GCP, Kubernetes, Microsoft 365, GitHub and the other providers listed at https://registry.prowler.com, and returns remediation guidance for failed checks. Writes are limited to Prowler Cloud itself: triggering scans, finding triage, mute rules and the mutelist, providers and integrations. Your cloud resources are not changed by the connector.

1 skill · 1 MCP server