zuvo

Plugin zuvo from marketplace zuvo-marketplace in greglas75/zuvo-marketplace. Commands read from the repo's manifest — 2 days ago.

Skills (57)

• a11y-audit

  Dedicated WCAG 2.2 AA/AAA accessibility audit across 10 dimensions (A1-A10) covering semantic HTML, keyboard navigation, ARIA patterns, color contrast, forms, images/media, responsive/zoom, motion/animation, reading/content, and legal compliance. Goes far beyond surface-level design-review checks wi

• agent-benchmark

  Self-benchmark: YOU write the code, adversarial reviews it (multi-provider), you fix, you write tests, adversarial reviews tests, you fix. Measures YOUR quality as an agent. Run in different models (Opus, Sonnet, Haiku) and compare results.

• api-audit

  API and endpoint integrity audit across 10 dimensions (D1-D10) plus optional contract stability (D11) and optional OWASP API Security Top 10 (D12: BOLA/BOPLA/BFLA, mass assignment, JWT alg-confusion, GraphQL introspection). Covers validation, payloads, pagination, errors, caching, HTTP semantics, wa

• architecture

  Architecture skill with three modes: review existing codebase architecture (A1-A9 dimensions), create Architecture Decision Records, or design new systems from requirements. Modes: --mode review [path], --mode adr, --mode design. Uses CodeSift for module discovery, dependency mapping, structural met

• backlog

  Manage the project's tech debt backlog. Add, list, fix, wontfix, delete, prioritize, and suggest batch actions on tracked issues, run by the user to manage accumulated debt (skills file their findings through ~/.zuvo/backlog-add themselves, never through this skill). Modes: list [category], add [des

• benchmark

  Multi-provider AI coding benchmark. Dispatches a task to Codex, Gemini, Claude, and Cursor-Agent in parallel, scores responses with a Claude meta-judge, and produces a ranked leaderboard with cost, time, quality, and self-eval bias metrics. Supports corpus mode (fixed OrderService + useSearchProduct

• brainstorm

  Explores a codebase, researches the problem space, and produces an approved design specification before any code is written. Use when the user wants to create a new feature, add significant functionality, redesign a subsystem, or build something that touches multiple parts of the project. always: -

• canary

  Post-deploy monitoring with browser or degraded HTTP mode. Checks console errors, performance, page load. Configurable duration (1m-30m) and interval. Reports HEALTHY/DEGRADED/BROKEN. Flags: --duration, --interval, --quick, --max-errors.

• ci-audit

  CI/CD pipeline audit for speed, cost, reliability, and security. 10 dimensions (CI1-CI10): caching, parallelism, conditional execution, artifacts, secret handling, action pinning, timeouts, Docker optimization, test integration, and pipeline speed. Primary support: GitHub Actions. Detection-level: G

• code-audit

  Batch audit of production files against CQ1-CQ40 quality gates and CAP1-CAP29 anti-patterns. Tiered output (A/B/C/D), critical gate enforcement, evidence-backed scoring, cross-file pattern analysis, and prioritized execution plan. Flags: zuvo:code-audit all | [path] | [file] | --deep | --quick | --s

• container-audit

  Static Docker/container security audit across 6 dimensions (K1-K6): base image provenance and pinning, privilege and runtime hardening, secret and build-context hygiene, image minimalism and attack surface, known-vulnerability scan (Trivy/Grype), and compose/orchestration hardening. Static-first — p

• content-audit

  Content file quality audit across 8 dimensions (CC1-CC8): encoding artifacts (NBSP, mojibake, zero-width), markdown syntax (broken italic, orphan backslash), CMS migration artifacts (Joomla/WordPress/PHP), frontmatter quality, image integrity, link integrity with anchor validation, content completen

• content-expand

  Expand and optimize existing articles. Adds new sections, deepens thin content, and applies the same quality pipeline as write-article (anti-slop, BLUF, GEO signals, humanization, multi-schema). Includes web search research about the topic and auto-discovery of internal links from your content colle

• content-fix

  Apply fixes from content-audit findings. Reads audit JSON, classifies fixes by safety tier (SAFE/MODERATE), applies templates per fix type. Handles encoding artifacts (NBSP, mojibake), broken markdown, CMS migration debris, and typography issues. Modes: default (SAFE only), --auto (SAFE+MODERATE), -

• content-migration

  Compare old CMS page with new SSG page after migration. Finds missing headings, paragraphs, images, CTAs, tables, forms. Optionally patches safe gaps in local .md files. Use when content was migrated from Joomla/WordPress/ Drupal to Astro/Hugo/Next.js and you need to verify nothing was lost. Flags:

• context-audit

  Context health monitoring. Analyzes include loading trends from context-metrics.log, audits CLAUDE.md/rules/settings for bloat, scores setup health. Modes: trend (default), full (with /context data), baseline (save snapshot).

• db-audit

  Database performance and safety audit. 70+ checks across 13 dimensions (DB1-DB13): query patterns, indexes, schema design, connections, transactions, migrations, caching, query optimization, ORM anti-patterns, observability, data lifecycle, DB security, and migration deployment safety. Code-level ch

• debug

  Systematic bug investigation with a five-phase framework: reproduce, narrow, diagnose, fix, verify. Supports automated regression bisect via --regression flag. Produces a structured debug report with root cause analysis, regression test, and CQ/Q self-evaluations.

• dependency-audit

  Dependency health and internal coupling audit for Node.js/TypeScript projects. 11 dimensions: supply chain CVEs, supply-chain integrity (typosquat/dependency-confusion/malicious-package/SBOM), freshness, dead dependencies, license compliance, bundle weight, circular dependencies, coupling metrics, a

• deploy

  Deploy to production and verify health. Reads ship state, merges PR if applicable, detects platform (Vercel/Fly/Netlify/Railway/Render/GHA), waits for CI, triggers deploy, runs health check, offers rollback on failure. Flags: --url, --skip-ci-wait, --skip-health, #<number>. always: - analyze_project

• design-review

  UI/UX design consistency audit. Code-based DX1-DX20 checklist covering states, consistency, accessibility, responsive behavior, and interaction patterns. Optional visual audit via chrome-devtools screenshots and automated WCAG accessibility via axe-core. DAP1-DAP12 anti-pattern detection. Modes: [pa

• design

  Intent-first UI design with conscious, traceable design decisions. Persists decisions in .interface-design/ for cross-session consistency. Includes domain exploration, design system generation (system.md + system.json), per-component construction with mandatory checkpoints, and craft validation test

• docs

  Write and update technical documentation from actual codebase analysis. Generates README, API reference, runbook, onboarding guide, or changelog. Supports update mode that patches stale sections without rewriting from scratch. Modes: readme [path], api [path], runbook [topic], onboarding, update [fi

• env-audit

  Environment variable and configuration audit. 8 dimensions (ENV1-ENV8): variable completeness, unused vars, startup validation, secret exposure, environment parity, type safety, default values, and documentation. Supports Node.js (.env/process.env), Python (os.environ/settings), and framework-specif

• execute

  Activated when an implementation plan exists. Executes plan tasks in dependency order (independent, non-same-file tasks may run in parallel batches) with enforced review gates, adversarial validation, and resumable session state.

• fix-tests

  Batch repair of systematic test quality issues. Detects anti-patterns across the test suite, then fixes one pattern at a time with production context. Modes: --triage (scan all patterns, report counts), --pattern [ID] [path] (fix specific pattern), --dry-run (preview changes), --bundle-gates (fix pa

• geo-audit

  GEO (Generative Engine Optimization) readiness audit. Scans source code for AI citation signals across 12 dimensions: AI crawler access, schema graph connectivity, llms.txt, SSR rendering, freshness, chunkability, canonicalization, sitemap, BLUF structure, heading quality, citation signals, and anti

• geo-fix

  Apply fixes from geo-audit findings. Reads geo-audit JSON, classifies by safety tier (SAFE/MODERATE/DANGEROUS), applies framework-aware code patches for schema, robots.txt, canonical, sitemap, llms.txt, and freshness fixes. Emits content scaffolds for advisory findings. Deduplicates against seo-fix

• incident

  Incident response and postmortem generation from git/deploy context. When something breaks in production, this skill builds a timeline, identifies the probable cause, and generates a structured postmortem document. Flags: --since, --service, --sev, --revert, --comms, --dry-run. always: - analyze_pro

• infra-audit

  Server / infrastructure security audit of LIVE hosts over SSH (12 dimensions IS1-IS12: SSH hardening, accounts, network exposure, TLS, firewall, patch posture, logging, web services, Docker, databases, filesystem, host secrets). Deterministic collector + parallel LLM analysts; dual-vantage (internal

• leads

  B2B lead discovery and enrichment skill. Finds company addresses, employee emails, and phone numbers filtered by industry, geography, role, and company size. 100% free-tier: orchestrates Claude Code's native WebSearch and WebFetch plus free OSINT subprocesses (theHarvester, crt.sh, whois, GitHub API

• mutation-test

  Mutation testing with two engines. Uses the project's NATIVE mutation runner (StrykerJS / Infection / mutmut / PIT / cargo-mutants) when one is configured — installing it on explicit consent when it is not — for a reproducible, comparable score; and an LLM-guided engine for the mutation classes nati

• pentest

  Hybrid white-box + black-box penetration testing across 7 dimensions (PT1-PT7). Stack-aware source-to-sink tracing, exploit verification, CMS overlay, and deterministic finding aggregation. Uses explicit candidate schemas, canonical-key deduplication, score caps, and MUST-GATE enforcement. Flags: zu

• performance-audit

  Full-stack performance health check across 12 dimensions. Rendering, bundles, assets, API/network, algorithms, memory, database, caching, Web Vitals, backend runtime, concurrency, and framework-specific pathologies. Evidence-based Impact Models with confidence tiers and a prioritized optimization ro

• plan

  Analyzes architecture, selects patterns, assesses testability, then decomposes work into ordered TDD tasks with exact verification commands and explicit acceptance mapping. Works from an approved spec (zuvo:brainstorm output) or directly from a user-provided description.

• presentation

  Generate PowerPoint (PPTX) presentations from a topic, outline, or content file. Creates professional slides using python-pptx with consistent theming and typography. Modes: [topic] (from scratch), from [file] (from markdown), --slides N, --theme dark|light|corporate, --outline-only, --out [path], -

• profile-session

  Answers \"why was that session slow?\" from the agent transcript's own timestamps. Attributes wall-clock time to categories (tests/build, subagent dispatch, adversarial review, model thinking, stalls, user-away), ranks the biggest gaps, and names the specific commands behind them. Reads Claude Code

• receive-review

  Process code review feedback with technical rigor. Activates when the user shares review comments, PR feedback, or asks to address reviewer suggestions. always: - analyze_project - index_status - index_folder - index_file - plan_turn - search_symbols # locate code referenced in review - ge

• refactor-radar

  Select refactor candidates with immutable git measurements, evidence-backed module families and temporary collision checks. Use for ranked refactor/test-debt triage, not implementation. DISCOVER saves reports without changing product code; REGISTER requires validated decisions. Worktree names are hi

• refactor

  Refactor existing code by extracting helpers, splitting files, removing duplication, or untangling dependencies. Supports resumable and batch runs. Use for structural changes that preserve behavior; use zuvo:build for new features. always: - analyze_project - index_status - index_folder - index_file

• release-docs

  Diff-driven documentation sync after a release. Determines what source files changed, delegates changelog to zuvo:docs, updates only docs whose source changed. Flags: --dry-run, explicit range argument. always: - analyze_project - index_status - index_folder - index_file - plan_turn - changed_symbol

• retro

  Engineering retrospective from git metrics. Reports deployment frequency, release cycle span, churn hotspots, backlog health. Outputs narrative report with 3+ actionable items. Flags: --since, --path, explicit range argument.

• review

  Structured code review with parallel audit agents, confidence-scored triage, and optional auto-fix. Examines uncommitted changes, staged diffs, commit ranges, or specific paths. Produces a tiered report (MUST-FIX / RECOMMENDED / NIT) backed by evidence, then optionally applies fixes with verificatio

• security-audit

  Application security audit covering OWASP Top 10, injection, XSS, SSRF, auth/authz, multi-tenant isolation, secrets, headers, dependencies, business logic, infrastructure, and AI/LLM + MCP tool-invocation security (S15, incl. tool poisoning and confused-deputy). Uses Sentry 3-tier confidence model.

• seo-audit

  SEO/GEO site audit covering 13 dimensions with 6 critical gates. Scans source code, templates, and config files across meta tags, structured data, AI crawlers, content quality, GEO readiness, performance, and optional live Core Web Vitals. Framework-aware: Astro, Next.js, Hugo, WordPress, React, pla

• seo-fix

  Apply fixes from seo-audit findings. Reads audit JSON, classifies fixes by safety tier (SAFE/MODERATE/DANGEROUS), applies templates per framework. Supports Astro, Next.js, Hugo. Modes: default (SAFE only), --auto (SAFE+MODERATE), --all (all tiers, requires confirmation), --dry-run, --finding F1,F3,

• ship

  Pre-merge release pipeline: run tests, auto-scaled code review, version bump, changelog generation, git tag, push or PR. Auto-detects branch context (direct push on main, PR on feature branch). Scales review depth by diff size. Flags: --full, --no-bump, --no-tag, --dry-run, patch/minor/major. always

• skill-eval

  Behavioral evaluator for zuvo skills. Runs a skill against its eval corpus (evals/<skill>.evals.json) in fresh executor sub-agents, grades each run transcript against the corpus assertions with an injection-hardened grader, and writes a per-assertion pass/fail report to zuvo/reports/. Supports old-v

• structure-audit

  Codebase structure and organization audit across 13 dimensions (SA1-SA13): directory consistency, naming conventions, folder depth, colocation, barrel exports, separation of concerns, file size distribution, dead code, complexity distribution, duplication, root organization, documentation, hotspots.

• test-audit

  Batch audit of test files against Q1-Q25 quality gates and AP1-AP32 anti-patterns. Detects orphan tests, phantom mocks, untested public methods. Tiered output (A/B/C/D) with critical gate enforcement and optional post-audit fix workflow. Flags: zuvo:test-audit all | [path] | [file] | --deep | --quic

• tests-performance

  Test suite performance audit and optimization. Measures baseline timing, audits runner configuration against TP1-TP17 checklist, identifies the slowest tests, and produces an impact-ranked action plan. Modes: full audit (default), baseline (measure only), verify (compare to saved baseline), --no-run

• ui-design-team

  Multi-agent UI review with 4 specialist perspectives: UX Researcher, Visual Designer, i18n/Multilingual QA, and Accessibility/Performance Auditor. Each agent scores independently from their expertise. Lead Designer synthesizes into prioritized fixes with exact code. Works with any stack: React, Astr

• using-zuvo

  ALWAYS LOADED — Zuvo skill router. Injected at session start. Determines which zuvo skill to invoke for the current task.

• worktree

  Isolate work in a git worktree. Activates when the user needs branch isolation before executing a plan, wants a clean environment for a feature, is ready to finish work in an existing worktree, or wants to reclaim worktrees that accumulated and are now polluting filesystem-level measurement. always:

• write-article

  Write high-quality articles from scratch using a 6-phase pipeline: deep STORM-inspired research with parallel agents, multi-perspective outline generation, section-by-section drafting with research grounding, adaptive anti-slop enforcement (hard/soft banned vocabulary per tone), cross-model adversar

• write-e2e

  Generate Playwright E2E tests from codebase analysis. Discovers routes, scores user flows by criticality, writes .spec.ts files that assert causality, and reports what was actually proven: GENERATED, STATIC_CHECKED, VERIFIED_LOCAL or VALIDATED_LIVE. Modes: --scope <path>, --flow <name>, --output <di

• write-tests

  Write tests for existing production code. Processes ONE file at a time through a full pipeline: analyze, inventory (frozen BEFORE writing), write, executable coverage gate, verify, blind coverage audit, adversarial review, log. Uses CodeSift for discovery and analysis when available. Modes: [path] (

Hooks (14)

• SessionStart

  "${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.cmd" session-start

• PreToolUse

  "${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.cmd" block-no-verify.sh

• PreToolUse

  "${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.cmd" pre-push-gate.sh

• PreToolUse

  "${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.cmd" pre-commit-adversarial-gate.sh

• PreToolUse

  "${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.cmd" route-suite-through-verify.sh

• PreToolUse

  "${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.cmd" require-inventory-first.sh

• PostToolUse

  "${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.cmd" post-skill-adversarial-check.sh

• PostToolUse

  "${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.cmd" zuvo-archive-review-artifact.sh

• PostToolUse

  "${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.cmd" track-includes.sh

• PostToolUse

  "${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.cmd" zuvo-heartbeat.sh

• PostToolUse

  "${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.cmd" zuvo-todo-watchdog.sh

• StopFailure

  "${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.cmd" zuvo-rewake-on-failure.sh

• Stop

  "${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.cmd" zuvo-stop-pipeline-gate.sh

• Stop

  "${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.cmd" zuvo-rewake-reset.sh

Similar plugins