AI Agent Workflow Collection

Run the OWASP-aligned agentic security review path — covers goal hijacking, tool misuse, excessive agency, memory poisoning, secrets exposure, handoff failures, and observability. Opt-in from Stage 9 (Review) or the QA track. Not a new track — no state file or slash command namespace. Triggers "agentic security review", "agent security", "security review for agents", "/agentic-security-review".

Drive an Arc42 + 12-Factor questionnaire to baseline architecture and operability decisions before /spec:design. Pre-fills from upstream, grills the user on TBDs, files ADRs for accepted key decisions, and produces specs/ /arc42-questionnaire.md as canonical input for the architect's Part C — Architecture. Applicable to any software project — SaaS, on-premises, embedded, internal tool, or platform. Use during stage 4 (Design) on non-trivial features, when the user wants an Arc42 baseline, says "fill the questionnaire", "Arc42", "12-factor check", or whenever non-functional and operability decisions need to be locked before design proper.

Creates docs/{{DOMAIN}}-context.md with foundational {{PLUGINNAME}} context for this project. Triggered by the {{TRAIT}} trait. Read by all other {{PLUGINNAME}} skills before they act.

Generate 2-3 radically different design alternatives in parallel via Task tool, then synthesize a pick. Use in stage 4 (Design). Triggers "design it twice", "explore options", "compare module shapes".

Drive a Discovery Sprint end-to-end (Frame → Diverge → Converge → Prototype → Validate → Handoff) by gathering scope from the user up front, then dispatching the facilitator and consulted specialists for each phase, persisting artifacts under discovery/ /, and gating between phases with the user. Use when the user wants to run a design sprint, ideate, brainstorm new product ideas, find a feature to build, or mentions "discovery sprint", "design sprint", "ideation", "brainstorm", "explore options", "from scratch with a blank page".

Conductor for the issue-breakdown track. Post-/spec:tasks. Decomposes a GitHub issue into independent draft PRs by parsing tasks.md, opens one draft PR per parallelisable batch, edits the parent issue body to track progress. Triggers "/issue:breakdown ", "break this issue down into draft PRs", "decompose issue".

Conductor for the issue-draft track. Post-/spec:idea opt-in track that opens a draft PR seeded from idea.md and applies a living PRD sentinel block to the parent issue. Evolves both automatically via issue-pr-sync as stages complete. Triggers: "/issue:draft ", "open early draft PR for this issue", "start tracking this issue with a draft PR".

Shared skill invoked by stage conductors (Stages 2–6) and /issue:breakdown as a non-fatal last step. Reads draftpr + issuenumber from workflow-state.md and updates both the draft PR body and the issue PRD sentinel block with the just-completed stage's artifact. No-op when draftpr is absent. No slash command — invoked by other conductors only.

Scaffold a new Architecture Decision Record in docs/adr/ with the repo's canonical format and the next available sequential…

Scaffold a glossary entry at docs/glossary/ .md from template. Triggers /glossary:new, "glossary", "define this term", "add glossary entry", or terminology ambiguity. Replaces ubiquitous-language (ADR-0010).

Drive P5 Express portfolio cycle. Detects which cycle (X strategy / Y monthly / Z daily) is due, dispatches /portfolio:x|y|z. Triggers "run portfolio review", "portfolio cycle", "portfolio health". Opt-in.

Maintain public product page (Astro static site under sites/), hosted on GitHub Pages. Triggers new project, repositioning, user-visible release, or "website", "landing page", "product page", "GitHub Pages".

Review a project and its git/GitHub history to capture learnings, summarize findings, propose improvements, and hand off a first draft PR. Use when the user says "project review", "review this project", "capture learnings", or asks for an improvement review from project history.

Report deterministic quality KPIs — deliverables, traceability, QA checklists, blockers, maturity, trends. Triggers "quality status", "project KPIs", "quality metrics", "quality trend".

Append a new Architecture Decision Record (ADR) to the repo with an auto-incremented number and the MADR template. TRIGGER when the user says "record this decision", "log this decision", "add an ADR for X", "create an ADR about Y", "record the choice to use Postgres", "write up this decision", "document this as an ADR", "/nyann:record-decision". Do NOT trigger on "write a doc" / "add documentation" (those are broader — route to the appropriate doc skill). Do NOT trigger on "record a bug" / "open an issue" (those are GitHub concerns). Do NOT trigger on "what decisions have we made" (that's reading existing ADRs, not creating one).

Roadmap parsing, analysis, and mutation operations for ROADMAP.md. Handles phase and milestone lifecycle including add, insert (decimal), remove, complete, and requirements coverage analysis.

Drive a Sales Cycle end-to-end (Qualify → Scope → Estimate → Propose → Order → Delivery handoff) by gathering deal context from the user up front, then dispatching the right phase agent for each stage, persisting artifacts under sales/ /, and gating between phases with the user. Use when a service provider wants to manage a client opportunity, when someone says "we have a new lead", "we need to write a proposal", "we got an RFP", "help me scope this project for a client", "we need an SOW", or "let's run a sales cycle". Skip when the user already has a signed contract — go directly to /discovery:start or /spec:start instead.

Use this skill to generate well-branded interfaces and assets for Specorator (the open-source agentic-workflow template), for production or prototypes. Contains canonical brand tokens, voice rules, iconography rules, assets, and UI kit components.

Improve the Specorator template itself — scripts, tooling, workflow, agents, skills, templates, docs, and operational automation — through the spec-driven contributor loop. TRIGGER when: new track, new agent, new skill, new workflow, template self-change, modifying docs/ .claude/ scripts/ templates/ AGENTS.md CLAUDE.md, or any change to Specorator itself. SKIP when: building a downstream product with the template (use orchestrate instead).

Create the guided 5-step onboarding series. Always writes local markdown files with frontmatter in docs/onboarding/. Optionally creates GitHub issues when gh auth and a remote are available. Idempotent — skips if series exists.

Drive Stock-taking Engagement end-to-end (Scope → Audit → Synthesize → Handoff). Gather project context from user up front, dispatch legacy-auditor each phase, persist artifacts under stock-taking/ /, gate phases with user. Use when user building on legacy system, needs understand existing system before project, mentions "stock-taking", "legacy assessment", "inventory", "what do we already have", "existing system", "brownfield", or wants catalogue processes + use-cases before building new.

Comprehensive implementation auditor that grills code quality, plugin structure, consistency, and identifies problems. Use when reviewing increment quality, auditing modules, or analyzing the entire codebase for issues. Spawns parallel subagents for thorough analysis.

Conductor for the issue-tackle workflow. Triage a GitHub issue or PR, scan for open tasks, propose a resolution plan, create an isolated worktree, guide execution through the appropriate workflow stages, and open a PR. Triggers when the user says "tackle issue N", "resolve issue N", "work on issue N", "fix issue N", "tackle PR N", or "resolve PR N", or invokes /issue:tackle .

Audit project token usage by area (always-loaded, skills, examples, docs, worktrees, templates, ops bots), surface offenders, emit area-grouped cleanup plan. Trigger /token-review.