Autonomous codebase archaeology agent. Triggered by a GitHub Issue or Azure DevOps Work Item tagged 'code-archaeology'. Segments the codebase, maps architecture in business language, extracts coding conventions, runs a due diligence audit for defects and structural problems, classifies all work into typed and prioritised items, and delivers a single structured archaeology report as comments on the originating issue or work item.
7 skills · 1 command · 7 agents · hooks
Automated dependency audit and optimization across all major ecosystems (npm, pip, Cargo, Go modules, Maven, .NET, Bundler). Runs four parallel specialized analyses — vulnerability scanning (CVE/CVSS), SemVer version drift, bundle bloat and unused package detection, and license compliance. Automatically creates a pull request with safe fixes applied; flags critical CVEs and major breaking upgrades for manual review. Works with GitHub, Azure DevOps, and any git repository.
6 skills · 1 command · 5 agents · hooks
Automated impact analysis and risk-based test strategy generation for bug fixes, PBIs, and feature implementations. Gathers work item requirements, code changes across linked pull requests, comments, child items, and referenced documentation — then posts a business-readable Markdown comment series on the PR / issue / work item discussion that serves as the testing guide for QA engineers doing risk-based testing. No HTML files written to the repo.
6 skills · 1 command · 5 agents · hooks
Comprehensive PR review plugin with specialized agents for code quality, security, test coverage, and performance analysis. Works with GitHub, Azure DevOps, Bitbucket, and any git repository.
6 skills · 1 command · 4 agents · hooks
Authorized web-application penetration testing with whitebox source-code analysis. Combines OWASP Top 10 dynamic probes (DAST), static code analysis (SAST via semgrep), web-ecosystem dependency CVE scanning, and secrets detection. Source-code recon runs first and drives targeted URL probing — including authenticated routes, real parameter names, and sink locations — instead of blind crawling. Includes a Playwright-driven probe path for SPA targets and DAST+SAST dual-confirmation. Requires explicit --authorized flag.
1 command · 9 agents · hooks
Unified impact analysis and risk-based test strategy plugin. Combines blast radius analysis, dependency tracing, feature mapping, and structured test case generation into a single HTML report. Works from a PR, GitHub issue, or Azure DevOps work item.
1 skill · 1 command · 7 agents · hooks