devagent-standards

Plugin devagent-standards from marketplace devagent in mrjones-cs/devagent. Commands read from the repo's manifest — 23 days ago.

Skills (14)

• api-security

  Standard for APIs and any machine-facing endpoint. Use when building, exposing, reviewing, or deploying an API - REST, GraphQL, webhooks, Lambda/Function URLs, API Gateway, ALB or container ingress, service-to-service calls, API keys, rate limits, pagination, or multi-tenant data access. Also use wh

• auth-portal

  Standard for any system with a login. Use when building, reviewing, deploying, or debugging authentication - login pages, signup, session handling, MFA enrolment or challenges, password reset and account recovery, JWT or cookie sessions, OAuth/OIDC/SAML, Cognito, Entra ID, Auth0, Identity Center, or

• cloud-infra

  Standard for public cloud work. Use when provisioning, modifying, deploying, or reviewing cloud infrastructure on AWS/GCP/Azure/Cloudflare - Terraform/OpenTofu/Pulumi/CloudFormation/CDK/Bicep, accounts and OUs, IAM, VPCs, budgets and cost estimates, teardown scripts, or deploying a demo or client-fa

• document-artifact

  Standard for generated document artifacts. Use whenever creating or regenerating a PDF, DOCX, PPTX, slide deck, one-pager, capability statement, brochure, white paper, case study, proposal, or an image rendered from one - by any method (python-pptx, reportlab, fpdf2, python-docx, Markdown-to-PDF, he

• encryption

  Standard for encryption in transit and at rest. Use when creating or modifying any data store (bucket, database, volume, cache, queue, search index, warehouse, backup or snapshot), configuring TLS or certificates, choosing KMS/CMK vs provider-managed keys, hashing passwords, handling secrets on disk

• engagement-closeout

  Standard for ending an engagement. Use when a project is finishing, delivering, or being handed over - final delivery and acceptance, transferring repos, IaC state, secrets and cloud accounts, revoking access in both directions, license and IP attestation or an SBOM at delivery, returning or destroy

• feature-flags

  Standard for feature flags, toggles, kill switches and gradual rollouts in software we build. Use when adding, evaluating, flipping or removing a flag - server-side versus client-side evaluation, client SDK keys and bootstrap payloads, flagged-off code in public bundles, who may change a flag and ho

• incident-breach

  Playbook for a suspected breach of a customer-facing system - unauthorized access, data exposure, compromised account or key with blast radius, ransomware, or any event that may trigger a contractual notification clock. Use when a breach is suspected or confirmed, when assessing notification obligat

• llm-app-security

  Standard for AI-powered software we build. Use when designing or reviewing anything that calls a model - prompts, system prompts, agents, tool/function calling, RAG and retrieval, embeddings and vector stores, chat UIs, model output that reaches a shell/SQL/renderer, model vendor selection, or promp

• observability

  Standard for making a system operable. Use when designing or handing over a customer-facing system - structured logging, correlation IDs, health/liveness/readiness endpoints, metrics, tracing, alerting and thresholds, availability/latency/durability targets, backups and restore testing (RTO/RPO), da

• public-release

  Standard for anything about to become public. Use before publishing, launching or deploying a website, landing page, blog post, case study, portfolio or marketing page; before making a repository public, open-sourcing code, posting a gist, or sharing a screenshot, recording or demo outside the firm;

• stack-selection

  Standard for choosing a language and runtime version. Use at the start of a greenfield project, when proposing a stack, when adding a second language or runtime to a delivery, when picking a base image or managed service version, when setting up the project check command and type checking, or when a

• verification-methods

  Method for proving a built thing actually works before reporting it done. Use when finishing, validating, testing, or about to claim completion on ANY work product - code, a PDF/DOCX/PPTX or slide deck, a diagram or chart, a web page or UI change, a deployed endpoint, or cloud infrastructure. Covers

• web-browser-security

  Standard for anything that renders in a browser. Use when building or reviewing a web page, SPA, or front end - Content Security Policy, security headers, XSS, CSRF, cookies, clickjacking, third-party scripts and analytics tags, file uploads, or rendering user-supplied or model-generated HTML/Markdo

Hooks (3)

• PreToolUse

  python3 "${CLAUDE_PLUGIN_ROOT}/hooks/guard.py" pre

• PostToolUse

  python3 "${CLAUDE_PLUGIN_ROOT}/hooks/guard.py" post

• SessionStart

  python3 "${CLAUDE_PLUGIN_ROOT}/hooks/guard.py" session

Similar plugins