Plugins

Apply systematic debugging practices when investigating, isolating, or fixing bugs in Python, TypeScript/JavaScript, or Java code. Covers reproduction, hypothesis-driven investigation, bisection, root-cause analysis, observability, regression-test design, and postmortems.

DevOps and CI/CD review (DEV1-DEV12: CI pipelines, deployment safety, IaC immutability, container images, secrets/config sourcing, observability, release management, schema migrations, health/readiness, SLO/performance, incident hygiene, and flow/batch signals). Sibling to ship-secure-code; serves as the depth target when the ship-reviewed-prs IN (Senior Infra / SRE / DevOps) persona delegates.

Stop-hook gate against trail-off: detects unpushed commits at turn end and injects an agent-directed nudge to review and finish the branch.

/ship orchestrates simplify → verify → code-review → smart-commit → branch hygiene → PR → babysit → reflect; /fix triages a bug with parallel sub-agents then branches, implements, and ships it; /babysit drives a GitHub PR to a fresh APPROVED + CI-green + mergeable state. Bundles triage/simplify/verify/code-review/yolo so it runs without relying on pre-installed skills. Pass --yolo to run hands-off.

A guided build pipeline that keeps senior-engineer ownership in LLM-speed development.

/ship-ready command: at-a-glance dashboard of what gates a merge on the current branch (failing tests, open PR count, stale branches, outdated deps, merge velocity, review freshness, unresolved risks from docs/solutions/). Reads ce-review envelopes for commit-hash staleness detection.

Multi-persona pull-request review (senior engineer, senior security, senior infra/SRE/DevOps, senior data engineer, senior frontend engineer, test-coverage signal) with comment-lifecycle suppression and decisive APPROVE/REQUEST_CHANGES/COMMENT submission. Runs locally with confirmation gating and in CI fully automated. Composes with the other ship-* skills via delegation: SC → ship-secure-code, IN → ship-devops, SE → ship-clean-code, TS → ship-tested-code.

Application-security review (SEC1-SEC12: auth, input validation, injection, XSS, CSRF/origin, crypto, secrets, supply chain, PII/logging, resource exhaustion, path traversal, deserialization/SSRF) for Python, TypeScript/JavaScript, and Java. Sibling to ship-clean-code; serves as the depth target when ship-reviewed-prs SC persona delegates.

Apply testing best practices when writing or reviewing tests for Python, TypeScript/JavaScript, or Java code. Covers test design, TDD, test strategy, mocking, integration testing, flaky test management, and 49 cataloged test smells.

Build, sign, notarize, and release Tauri 2 desktop apps on macOS, plus dev-loop gotchas (ACL capabilities, watcher, cargo patches)

Facilitated development mode: you implement, Claude assists with specs, plans, scaffolding, and research.

Content creation and documentation skills

The autonomous delivery agent for Claude Code — conversational planning, queue-driven execution, policy-controlled code review, a five-phase test-readiness pipeline, and autonomous deploy (merge → canary → promote) for any software project.

Reusable engineering-methodology skills: quality gates, commit/issue/doc hygiene, tool preferences, and language guidelines.

Onboard an existing (brownfield) repository into the Shipwright SDLC — analyze stack + routes + conventions, generate CLAUDE.md + agent_docs + configs + E2E baseline

TDD implementation with code review, Conventional Commits, and feature branch workflow

Parse Conventional Commits, generate Keep-a-Changelog entries, create version tags and PRs

IREB traceability, Requirements Traceability Matrix, SBOM, test evidence, and change history reports

Deploy to Jelastic (Infomaniak) with smoke test verification and rollback support

Generate UI mockups from IREB specs — standalone HTML screens and user flows

Grade any git repository against the Control Grade rubric (A–F) — a read-only, deterministic cold-repo grader that reuses the same scoring engine as the compliance dashboard. Grades a local path or clones a URL; underivable dimensions render honest n/a.

Lightweight SDLC for ongoing changes. Auto-detects intent (feature/change/bug) and runs specs → build → test → commit.

Deep planning with research, interview, external LLM review, and TDD approach

Local browser preview — start dev server and show URL for in-browser testing

Decompose project requirements into well-scoped planning units with IREB-aligned specs

Orchestrate the full Shipwright SDLC pipeline — from user description to deployed application

Security scanning — Semgrep + Trivy + Gitleaks + Shipwright prompt-injection scan (OSS default), with an automated remediation loop and an optional Aikido backend

Profile-aware test runner: unit tests, smoke tests, Playwright E2E, and security scans

Autonomous engineering loop: audits surface work, /do-work refines and dispatches, parallel workers in isolated worktrees ship the fixes.

Multi-agent software house team v3.6: 19 agents + 18 skills + 5 commands.