system-design-orchestr…
Use this agent to drive a system-design problem end to end — from a vague prompt to a justified, stress-tested architecture — using the bottom-up…
An agent is a specialist Claude hands a whole job to, with its own tools and its own context.
55 agents across 643 plugins.
Use this agent to drive a system-design problem end to end — from a vague prompt to a justified, stress-tested architecture — using the bottom-up…
A good test reads like a specification. Two habits get you most of the way: a consistent three-phase body (AAA) and a name that states the behavior, not the…
Use when designing a new HTTP/GraphQL API or changing an existing one — modeling resources, defining endpoint contracts, choosing status codes, pagination,…
A complete, realistic audit of a small Express orders service, in the standard format. Use it as the shape your output should take. (Secret values shown are…
This is the detailed procedure behind the workflow summarized in `AGENT.md`. Work top to bottom; each phase produces findings you carry into the report. The…
A reference set of small, behavior-preserving refactorings with the reasoning for each. Tests stay green across every one.
When reasoning stalls, *search*. Halving the problem space repeatedly finds the culprit in log₂(N) steps instead of N. Bisection applies to three spaces:…
The clarity pass is where good docs are made. Draft to get the ideas down, then edit ruthlessly for the reader. The goal: the shortest path to the reader's…
The contract is the deliverable. Express it as an **OpenAPI 3.1** document so it is human-readable *and* machine-checkable. This reference covers how to…
Debugging is the scientific method applied to a misbehaving system. You don't "stare at code until you see it"; you run controlled experiments that each rule…
A weighted matrix does not make a decision objective. It makes the judgment *visible*, which is more useful — but only if you actively defend against the…
Two things here: a **blank template** to copy, and a **fully worked example** (with the JSON that `scripts/decision-score.mjs` consumes so the arithmetic and…
The artifact this agent leaves behind — findable, dated, revisitable.
Run through this before declaring an API contract done. It is ordered the way you should *design*: resources first, cross-cutting rules last. Every box is a…
A threat model is only as good as the diagram it sits on. The data-flow diagram (DFD) is the map; trust boundaries are where the dangerous neighborhoods are.…
A standalone data-flow diagram with its trust boundaries explained, to illustrate the notation before you build your own. The system: a file-upload feature…
Diátaxis splits documentation into four modes along two axes: **practical vs theoretical** (doing vs knowing) and **study vs work** (acquiring skill vs…
Copy this block per finding. Keep it to one anchor, one exploit sentence, one fix. Delete the guidance comments before shipping.
Doc type: **how-to guide**. Goal-first, assumes you can already run the service locally. For the concepts behind rate limiting, see the explanation doc; for…
A risk area is any changed line where a mistake has consequences beyond the immediate feature — security, data integrity, downstream consumers, or operability.…
Some restructurings are too big to do as a single behavior-preserving step: replacing a data layer, splitting a god module, migrating off a deprecated API. The…
Reusable, concrete mitigations indexed by STRIDE category. Use these as a starting point — then make each one *specific* to the threat it addresses (name the…
Tests must be **isolated** (independent of each other) and **deterministic** (same result every run). That means controlling everything that crosses a boundary…
You can't fix what you can't see. Observability is the practice of making a system's internal state inspectable from the outside, through three complementary…
Write this after a significant bug or incident is resolved. The goal is **systems, not scapegoats** — ask how the process let the defect through, not who typed…
Copy-paste templates for leaving review comments. Keep each comment to one finding: an anchor, the problem, and the fix.
The summary is only as honest as the diff you read. The single most common failure is reading the latest commit instead of the whole branch. This reference is…
A realistic, step-by-step plan for refactoring one overgrown function. Every step is behavior-preserving and gated by a green test run.
Doc type: **reference**. Exhaustive and consistent; optimized for scanning and `Ctrl-F`, not for reading top to bottom. Every entry uses the same structure.…
Once a finding is triaged, the deliverable is a *fix the reader can act on*. This reference defines the severity scale, the dependency-fix strategy, and the…
A bug isn't ready to fix until you can trigger it on demand. Fill this out *before* editing any code.
Not every decision deserves a matrix. The first move is always to classify the decision, because the right *process* depends far more on **reversibility** than…
Work top to bottom. Security first, style last. Anchor every finding to `file:line` with a fix.
This shows how the api-designer agent reviews a flawed draft. Findings are severity-ranked so the implementer fixes the contract-breakers first. Severity…
Refactoring is only safe when each step is small, behavior-preserving, and verified. This is the loop and the mechanics behind it.
A complete summary of a hypothetical PR, in the standard format. Use this as the model for tone, structure, and the Summary → Risk areas → Test plan flow. Note…
A complete review of a hypothetical PR, in the standard format. Use this as the model for tone, structure, and the anchor → problem → fix pattern.
A worked example of the report shape this agent produces. Note the structure: a tight summary, a short *fix now* list, then everything else ranked below it.…
Vulnerability scanning is not one activity — it is a family of complementary techniques, each with a different blind spot. A credible scan combines several.…
The first pass of every review. These are the highest-impact, most-missed classes. Map to OWASP Top 10; for a deep audit escalate to the `security-auditor`…
A finding is only useful if its severity is trustworthy and its report is actionable. This reference defines how to assign severity and how to structure the…
Every finding gets exactly one severity. Calibration matters more than volume: an inflated severity makes the whole review untrustworthy. When unsure between…
A smell is a surface symptom that usually points to a deeper structural problem. Each entry names the smell, how to spot it, and the canonical…
STRIDE is a threat-classification model created at Microsoft. Each letter names a category of threat defined by the security property it violates. Walking…
Individual docs must be clear; the *set* of docs must be navigable and must not rot. This reference covers information architecture and keeping documentation…
A filled-in example of the test plan this agent produces before writing code. Copy the shape for any new behavior: enumerate cases by type, mark scope, and…
The test plan is the payoff of the risk analysis: it tells the reviewer (and the author) exactly what to verify before merge. A weak test plan says "test the…
Not all tests are equal. Choosing the right *level* for a given behavior is the difference between a suite that gives fast, reliable signal and one that is…
© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic