AI Agent Workflow Collection

Scan recent git history and open issues to find architectural decisions that were made without a corresponding ADR. Use when auditing documentation coverage or before a release. Triggers: "adr gap", "missing adrs", "undocumented decisions", "adr coverage", "find undocumented decisions".

Dispatch ad-hoc tasks to remote agent-box (agent-box scripts or free-form claude prompts). Maps named aliases (ci-watch, health, security, etc.) to shell scripts on homelab; routes free-form prompts to agent-box via SSH. Use when (1) running a named agent-box task script (health check, CI watch), (2) running a one-time claude prompt on agent-box (remote investigation), (3) accessing homelab-only state.

Standalone post-generation QA pass that lints any frontend output (HTML/JSX/Vue/Svelte/CSS) against the named anti-pattern catalogue and proposes specific rewrites with severity rating. Use after any UI generation that didn't pass through ui-expert (so existing impeccable, frontend-design, hand-written code, AI-pasted code, contractor work) to catch the "AI made that" tells. Use proactively when output reads as templated, generic, or stock. Returns a verdict — pass / warn / fail — plus a diff-style list of findings, each with diagnosis, evidence, and the specific rewrite from the catalogue. Not a full design critique — narrow lint against known-slop patterns.

Composite skill — audit and deepen codebase architecture in one orchestrated workflow. Chains: coupling-map → orphan-hunt → improve-codebase-architecture → domain-modeling → adr-write. Use when: (1) planning a refactor, (2) evaluating architectural health, (3) user says "improve architecture", "reduce coupling", "find dead code", "audit architecture", (4) audit-deep flagged architectural friction, (5) need to sharpen domain language alongside structural changes.

Composite health audit skill — runs test-health, config-drift-detect, hook-effectiveness, performance-audit, security-audit, mcp-audit, plugin-audit, socket-audit in parallel and reconciles into severity-ranked report. Use when: "is this project healthy", "audit this repo", "tech debt review", before releases, or weekly per active project.

A narrow, opinionated post-generation lint for backend/server-side code. Audits a changeset against a named catalogue of backend anti-patterns — swallowed errors, unvalidated input, missing timeouts, read-check-write races, N+1 queries, wrong status codes, unparameterized queries, hardcoded secrets, dead/duplicate handlers, and more — and returns specific, evidence-backed findings with the fix, not vibes. Use this whenever backend code was just written, generated, or pasted (an API route, service, handler, job, query, migration), when reviewing a server-side diff or PR, or when the user says "audit this backend", "does this look AI-generated / sloppy", "lint the server code", "review this endpoint/service/query", "any obvious backend mistakes here", or "is my error handling / validation / query OK". Reach for it proactively after generating any non-trivial backend code, even when the user didn't say the word "audit" — it's the server-side counterpart to ai-slop-audit (which lints frontend output). It is read-only: it finds and proposes; route accepted fixes to /refactor or the relevant specialist skill. Not for full security or performance audits (it defers those), pure frontend code, or subjective style.

Brief a subagent with task context + constraints, then verify comprehension via drill before delegating real work. Use when: (1) delegating to an agent outside your context thread (independence risk), (2) the task is production-sensitive or security-critical (high-stakes), (3) complex constraints/stop-conditions that must not be missed (destructive-operation risk), or (4) previous agent runs on related work introduced scope-creep. Triggers: \"brief the agent\", \"prepare subagent\", \"verify agent understood\", \"brief-and-drill\", \"ensure agent got it\".

Automate CHANGELOG.md maintenance: promote [Unreleased] → versioned section, compute version bump (major/minor/patch), update package.json + src/index.ts VERSION constant, commit, tag, create GitHub release. Follows Keep a Changelog format. Use when (1) cutting a release, (2) [Unreleased] has accumulated work to version, (3) CHANGELOG stale vs git tags.

Use the codebase knowledge graph for structural code queries. Triggers on: explore the codebase, understand the architecture, what functions exist, show me the structure, who calls this function, what does X call, trace the call chain, find callers of, show dependencies, impact analysis, dead code, unused functions, high fan-out, refactor candidates, code quality audit, graph query syntax, Cypher query examples, edge types, how to use searchgraph.

Audit project gates (jest/vitest coverage thresholds, tsconfig strictness, eslint rules, husky/lint-staged, sonar quality gate, branch protection) and flag values…

Map module coupling via import graph analysis. Identifies high fan-in (many callers) and high fan-out (many dependencies) nodes, and surfaces cycles. Use when planning a refactor, evaluating testability, or identifying brittle modules. Triggers: "coupling map", "module coupling", "dependency map", "fan-in fan-out", "import graph", "find tightly coupled code".

Composite skill — full debugging workflow from "this is broken" to root cause and fix.

Composite skill — batch-process the queue of open Dependabot / Renovate / npm-bot PRs by grouping them by risk, auto-merging the safe ones into release, and surfacing only the risky ones for human review. Chains gh PR enumeration → risk classification (devDeps / patch / minor / major / lockfile-only) → pr-merge-readiness per group → auto-merge safe group → flag risky group → optional /pr-to-release for batch entry on release. Use when bot-PR noise has piled up; reduces a 20-PR queue to "merged 14, 6 need eyes".

Audits a JS/TS codebase for hand-rolled boilerplate that a secure, well-maintained, widely-used npm package could replace, and vets each candidate for security advisories, maintenance recency, adoption, and license before proposing it. Use when the user asks to reduce boilerplate, find npm packages to adopt, replace custom utilities with libraries, "stop building from scratch", audit deps for consolidation, or do a dependency/package-opportunity analysis. Propose-only — never installs.

Build distinctive, production-grade interfaces with Ralph Wiggum velocity. Ships working code — web or mobile — with modern CSS, fluid typography, purposeful motion, and zero generic AI aesthetics. Use when: 'build UI', 'design this', 'create interface', 'make it look good', 'build screen', 'implement design', 'frontend build', 'design build'.

Analyze a proposed multi-agent workflow, Workflow() script, or active session for token waste and time bottlenecks. Catches model-tier mismatches, sequential work that should be parallel, re-read waste, and context bloat — scores each fix by impact with estimated savings. Use before spawning large agent fleets, when choosing between parallel vs sequential dispatch, or when a session is burning budget faster than expected.

Scans a codebase for self-contained, low-coupling modules (often a secondary part of a feature — a util, parser, state machine, algorithm) that are generic enough to reuse across projects, then checks whether npm already serves that niche well; surfaces the strong candidates to extract into a standalone, minimal-dependency npm package. Use when the user asks what code could become an npm package / be open-sourced / extracted / reused across projects, wants to find portable or reusable modules, or asks "is any of this worth packaging". Propose-only — never extracts or publishes.

Scans a repo or workspace for whole capabilities — features, subsystems, internal tools, pipelines, dashboards — self-contained enough to spin off as their own project or product (OSS repo, CLI tool, SaaS micro-product, template/starter, Claude Code skill/plugin, MCP server), then checks whether the market already serves that niche and what demand evidence exists. Use when the user asks what could become its own project or product, what is worth spinning off / open-sourcing / productizing / turning into a SaaS, tool, or template, or "is any of this a product?". Library-sized finds hand off to extract-package. Propose-only — never scaffolds, extracts, or publishes.

Mega-composite for end-to-end greenfield feature: idea → ADR → plan → implement → test → merge → deploy → capture. Chains: research-and-decide → scope-and-execute → design-build (if UI) → test-health → fix-the-suite (if tests need work) → merge-confidently → ship-it → knowledge-loop. Invoke when: "build feature X end-to-end", "implement Y start-to-finish", "ship new feature from spec".

Composite skill — repair and validate a test suite end-to-end when: suite is bloated (test count >2× proportionality), slow (runtime >5 min), or cleanup previously stalled at coverage gate. Chains: diagnose → gate-check → prune+replace → validate → capture.

Orient on a project or project family. Shows recent activity, milestones, and commits from event logs.

Development workflow for forge-ai-init — the AI governance layer CLI. Covers architecture, dev commands, test patterns, release process, and common contribution patterns. Use when working on forge-ai-init source code.

Structured decision interview using 2–4 bounded options per fork (AskUserQuestion). Use when the user says "help me decide", "grill me with options", "pick-path", or to stress-test a plan with explicit trade-offs fast. Stop at 95% predictive convergence.

Composite skill — query, capture, improve, persist knowledge in one workflow. Chains recall (semantic lookup) → sync-memories (write note) → rag-curate (improve weak retrievals) → handoff (snapshot). Use when asking "what did we decide about X", "remember this", "save where we are", or closing a session.