xianix-plugins-official

AI-native UX mob elaboration workflow for Greenfield and Brownfield projects. Runs structured, human-gated phase processes with artifact guardrails, approval gates, context isolation, and AI readiness checks before any brownfield work begins.

3 skills · 9 commands · 6 agents · hooks

Autonomous codebase archaeology agent. Triggered by a GitHub Issue or Azure DevOps Work Item tagged 'code-archaeology'. Segments the codebase, maps architecture in business language, extracts coding conventions, runs a due diligence audit for defects and structural problems, classifies all work into typed and prioritised items, and delivers a single structured archaeology report as comments on the originating issue or work item.

7 skills · 1 command · 7 agents · hooks

Automated dependency audit and optimization across all major ecosystems (npm, pip, Cargo, Go modules, Maven, .NET, Bundler). Runs four parallel specialized analyses — vulnerability scanning (CVE/CVSS), SemVer version drift, bundle bloat and unused package detection, and license compliance. Automatically creates a pull request with safe fixes applied; flags critical CVEs and major breaking upgrades for manual review. Works with GitHub, Azure DevOps, and any git repository.

6 skills · 1 command · 5 agents · hooks

Automated impact analysis and risk-based test strategy generation for bug fixes, PBIs, and feature implementations. Gathers work item requirements, code changes across linked pull requests, comments, child items, and referenced documentation — then posts a business-readable Markdown comment series on the PR / issue / work item discussion that serves as the testing guide for QA engineers doing risk-based testing. No HTML files written to the repo.

6 skills · 1 command · 5 agents · hooks

Comprehensive PR review plugin with specialized agents for code quality, security, test coverage, and performance analysis. Works with GitHub, Azure DevOps, Bitbucket, and any git repository.

6 skills · 1 command · 4 agents · hooks

Authorized web-application penetration testing with whitebox source-code analysis. Combines OWASP Top 10 dynamic probes (DAST), static code analysis (SAST via semgrep), web-ecosystem dependency CVE scanning, and secrets detection. Source-code recon runs first and drives targeted URL probing — including authenticated routes, real parameter names, and sink locations — instead of blind crawling. Includes a Playwright-driven probe path for SPA targets and DAST+SAST dual-confirmation. Requires explicit --authorized flag.

1 command · 9 agents · hooks

Unified impact analysis and risk-based test strategy plugin. Combines blast radius analysis, dependency tracing, feature mapping, and structured test case generation into a single HTML report. Works from a PR, GitHub issue, or Azure DevOps work item.

1 skill · 1 command · 7 agents · hooks

Whole-codebase performance bottleneck detection triggered from a GitHub issue or Azure DevOps work item. Analyzes latency, CPU, memory, and I/O patterns across the repository's default branch and opens a single pull request containing focused, low-risk optimizations together with an embedded performance report. Works with GitHub and Azure DevOps.

2 skills · 1 command · 6 agents · hooks

Automated web app behaviour verification triggered from a GitHub PR or Issue. Finds a testable URL from comments, runs or auto-generates a test plan using Playwright CLI (headless Chromium), and posts a structured test execution report as a GitHub comment.

5 skills · 3 commands · 1 agent · hooks

Automated AI chatbot verification for any web application. Loads widget configuration from a knowledge file, opens the chatbot via Playwright, runs six test categories (UI availability, functional accuracy, fallback handling, response latency, conversation continuity, empty input handling), judges Q&A responses with a batched LLM call, and posts a structured report as a PR/issue comment or local markdown file.

5 skills · 1 command · 1 agent · hooks

Impact analysis plugin that analyzes PR changes for functional impact, traces blast radius, maps code to user-facing features, and produces QA-focused reports highlighting high-risk areas.

2 skills · 1 command · 5 agents

Authorized infrastructure security scanning plugin. Runs Infrastructure-as-Code misconfiguration detection (Dockerfile, Terraform, Kubernetes, GitHub Actions), CycloneDX SBOM generation, and optional network port + TLS scanning. Optional --fix opens a draft PR for the single top mechanically-fixable finding (Terraform/Kubernetes config flags, GitHub Action SHA-pinning) without ever modifying your working tree. Companion to pentest-agent for users who want infra coverage alongside web-application pentesting. Requires explicit --authorized flag.

1 command · 6 agents · hooks

Software design agent for groomed backlog items. Reads the repository's accepted architecture (arch-fitness constraints, ADRs, architecture docs) and the code the requirement touches, then produces a conforming design as a design PR, proposing ADRs for any needed deviation. Triggered by the ai-dlc/issue/design tag; conversational via @xianix comments. Works with GitHub, Azure DevOps, and plain text.

2 skills · 1 command · 4 agents · hooks

An intelligent, cross-ecosystem PR Description Agent for GitHub and Azure DevOps that automatically generates context-aware summaries via webhook triggers. It uses language-agnostic intelligence to analyze code diffs, completely overwriting the existing description on updates to maintain a single source of truth, while an internal Knowledge Creation loop continuously refines its repository context without static files.

2 skills · 1 command · 3 agents · hooks

An intelligent, cross-ecosystem Release Note Maintainer Agent for GitHub and Azure DevOps that automatically generates structured release notes when a new git tag is pushed. Language-agnostic — analyzes merged pull requests, commit histories, breaking changes, and linked work items since the previous tag. Publishes to GitHub Releases or an Azure DevOps Wiki page. Dynamically scaffolds universal release note guidelines when no prior release pattern exists.

2 skills · 1 command · 3 agents · hooks

Conversational backlog grooming. Reads an issue or work item's comment thread, asks up to 5 clarifying questions per round (each with a proposed default), folds the humans' @xianix replies into a concise structured description, and marks the item groomed when no decisions remain. Works with GitHub Issues, Azure DevOps Work Items, or plain text.

2 skills · 1 command · 3 agents · hooks

Architecture fitness plugin. Discovers or bootstraps architecture-constraint documents in a repository, opens a docs PR when created or updated, then evaluates a requested changeset scope (a PR, a branch, or PRs merged in a date window) against those constraints and reports the few most important improvements. Works with GitHub, Azure DevOps, and any git repository.

2 skills · 1 command · 2 agents · hooks

Dead code detection for JS/TS repos using Knip — finds unused files, exports, types, and dependencies. Produces HTML/Markdown/JSON reports with run history and delta tracking; optional --fix opens a draft PR that safely removes the dead code via an isolated git worktree, never touching your working tree.

1 command · 4 agents · hooks

Automated resolution of pull request review threads — classifies each unresolved comment as apply, discuss, or decline, applies actionable ones as commits, replies to the rest, and posts a structured disposition report. Works with GitHub, Azure DevOps, and any git repository.

2 skills · 1 command · 1 agent · hooks

Automated documentation updater. Given a pull request number, analyses the modified source files and synchronises the project's documentation — updating existing docs that drifted from the new behaviour, creating new docs for new public surfaces, and removing stale entries — then commits the doc-only changes on a separate docs branch and opens a companion documentation pull request targeting the original PR's head branch, so the docs can be reviewed and merged into the feature branch independently. Works with GitHub, Azure DevOps, and any git repository.

1 skill · 1 command · hooks