bymax-quality

Bymax workflows for Codex: evidence-based code review, planning, testing, PR management, QA and security audits, persona-based usability testing, defensive security playbooks and capability-aware orchestration.

61 skills

Whole-system QA and security audit for any project, with evidence and hand-off. Point /bymax-qa:audit at a target: a Jira ticket key (verifies access, reads the acceptance criteria, reports each PASS/FAIL/BLOCKED/NOT-VERIFIABLE with evidence), a branch or ref range or PR (scopes the hunt to the change, like a code review), or nothing (the whole system via a signed scope). It maps the stack and its trust boundaries, hunts by domain (authentication, authorization and tenant isolation, injection and input, cache/Redis, database/Postgres, observability, transport and config, architecture, frontend, supply chain, and AI/LLM and agents when the project uses them) with read-only finder agents, probes the running stack against allow-listed hosts only, and admits a finding only after verification: a runnable reproduction, captured evidence and verified impact, with an independent verifier for every hunted candidate. Findings carry ASVS 5.0, CWE and API Top 10 references and a CVSS vector, and move OPEN → HANDED-OFF → FIX-CLAIMED → VALIDATED or REOPENED. The auditor never edits source: findings are handed to the owning peer session over cross-session messaging, filed as GitHub issues when no peer is live, or written back to the ticket as a comment, and re-tested before they close. A PreToolUse hook is a floor under the scope while an audit runs: network probes in command position reach only allow-listed hosts, and Write/Edit tool calls land only in .claude/qa/ (arbitrary Bash writes rest on the skill's discipline). External scanners are used when present, never bundled. Also ships Cloudflare's security-audit skill, vendored unchanged, as /bymax-qa:security-audit. Also ships /bymax-qa:security-playbooks, an on-demand index of 20 defensive playbooks from Anthropic-Cybersecurity-Skills (Apache-2.0), unchanged. Also ships /bymax-qa:personas, persona-based usability QA: it interviews the user (persona count, iPhone Simulator, Android emulator or browser, markets, days), researches

24 skills · 3 agents · hooks

Spec → Roadmap → Phase-Tasks → Task — a phased planning + execution workflow with explicit user-approval gates and JIRA-style task dashboards. Includes /bymax-workflow:brainstorm, /bymax-workflow:plan, /bymax-workflow:verify, /bymax-workflow:checkpoint, the universal /bymax-workflow:standards reference (with the §0 reuse-first simplicity ladder), and /bymax-workflow:autopilot — the loop-engineering executor that autonomously drives an approved roadmap to done, one merge-gated PR per phase.

2 skills · 8 commands

Real-browser verification and assisted UI testing. /bymax-web-verify:test brings the full stack up (reuses or starts the backend, frontend in the Claude Desktop Browser pane) and walks a UI flow while the user watches, with console/network/server-log verification per step; agent-browser fallback in terminals. /bymax-web-verify:verify confirms a single web change in a live browser. /bymax-web-verify:setup installs the agent-browser CLI + Chrome in one shot. Depends on agent-browser; never bundles it. /bymax-web-verify:record captures a UI flow as a reviewable video: the project's own Playwright with video forced on for one run, human pacing (slowMo + resized timeout), trimmed and pacing-gated with ffmpeg/ffprobe, published with a plain-text walkthrough derived from the spec that ran.

4 commands · hooks

Scaffold new projects (Next.js, Expo/RN, Vite+React, Node) with strict TS, ESLint flat-config + security plugin, Prettier, .vscode (format-on-save), Husky + commitlint + lint-staged, and CLAUDE.md/AGENTS.md/README.md templates. Also upgrades existing projects non-destructively.

2 commands

Slash commands to boot the iOS Simulator (/bymax-mobile:sim-ios) and Android Emulator (/bymax-mobile:sim-android) for Expo / React Native projects. Auto-detects whether to reattach Metro (fast) or run a full rebuild + install (slow). Honors $BYMAX_SIM_IOS, $BYMAX_SIM_ANDROID, and $APP_VARIANT.

2 commands

Matt Pocock's agent skills for real engineering (grilling, spec/ticket flows, TDD, code review, domain modelling and more).

39 skills

Core skills library for Claude Code: TDD, debugging, collaboration patterns, and proven techniques

15 skills · hooks

Persistent memory for Claude Code: the next session starts where the last one left off.

29 skills · 1 MCP server · hooks

Cross-session memory and token savings for coding agents.

6 skills · 1 agent · 1 MCP server · hooks

Up-to-date documentation lookup. Pull version-specific documentation and code examples directly from source repositories into your coding agent's context.

1 MCP server

Automates browser interactions for web testing, form filling, screenshots, and data extraction

12 skills