Claude Swe Workflows — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Claude Swe Workflows (Plugin) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
Aggregate score unchanged between these scans.
The primary manifest — the file an agent reads to learn what this artifact does.
A system of composable software engineering workflows for [Claude Code][cc]. Plan projects, implement tickets, and run quality passes — from a single ticket to a multi-batch project, using the same layered architecture.
claude plugin marketplace add https://github.com/chrisallenlane/claude-swe-workflows.git
claude plugin install claude-swe-workflows@claude-swe-workflowsThe skills are arranged as layered composition — higher-level skills invoke lower-level ones. Enter at the layer that matches your task. The deepest stack:
/lead-project ← autonomous tech lead (decides what to do next)
└── invokes any skill below
/implement-project ← full-lifecycle project execution
└── /implement-batch ← one batch of related tickets
└── /implement ← one ticket, end-to-end
└── SME agents ← language-specific specialistsThree other entry points orchestrate bounded autonomous loops:
/lead-bug-hunt — loops /bug-hunt → /implement-batch until bugs converge below a severity floor./lead-refactor — /refactor → loops /review-arch + /implement-batch → /refactor./lead-review — runs every /review-* sub-skill once.Planning feeds implementation: /scope-project → /implement-project, or /scope → /implement. Supporting skills (/think-*, /review-*, /bug-*, /tidy-*) compose into any of the orchestrators above or run standalone.
Skills are grouped by namespace for discoverability. Each namespace gathers skills with a related purpose.
| Namespace | Purpose | Skills |
|---|---|---|
/lead-* | Autonomous orchestrators | /lead-project, /lead-bug-hunt, /lead-refactor, /lead-review |
/implement-* | Implement tickets (mutate the working tree) | /implement, /implement-batch, /implement-project |
/scope-* | Plan and produce tickets | /scope, /scope-project |
/review-* | Advisory audits — no code changes | /review-arch, /review-test, /review-perf, /review-a11y, /review-health, /review-security, /review-release |
/think-* | Reasoning support — no artifacts | /think-reframe, /think-brainstorm, /think-diagnose, /think-ach, /think-deliberate, /think-premortem, /think-scrutinize, /think-reflect |
/tidy-* | Mechanical hygiene | /tidy-docs, /tidy-git |
/bug-* | Find and fix bugs | /bug-fix, /bug-hunt |
/test-* | Test-quality work | /test-mutation |
| (standalone) | Skills that don't share a namespace | /refactor, /pre-compact, /release |
The /lead-* and /implement-* namespaces additionally share an autonomy discipline (commander's intent, pre-loaded options, pre-rebutted recommendations, risk budgets) — see references/autonomy.md. The /think-* namespace shares a design discipline (practitioner-sourced countermeasures to specific cognitive failure modes) — see references/think.md.
Not everything needs the full pipeline. Enter at the level that matches your task:
| You want to... | Use |
|---|---|
| Drive a project to completion autonomously, deciding what to work on | /lead-project |
| Implement an entire multi-batch project autonomously | /implement-project |
| Implement a batch of related tickets | /implement-batch |
| Implement a single ticket or feature | /implement |
| Plan a multi-batch project with adversarial review | /scope-project |
| Plan a single feature and create a ticket | /scope |
| Fix a bug with diagnosis and root-cause analysis | /bug-fix |
| Proactively hunt for bugs before they're reported | /bug-hunt |
| Iterate hunt → fix until bugs converge below a severity floor (autonomous) | /lead-bug-hunt |
| Comprehensively refactor (tactical + architectural + tactical, autonomous) | /lead-refactor |
| Pressure-test a problem's framing before solving it | /think-reframe |
| Brainstorm approaches to a goal | /think-brainstorm |
| Reason about why a phenomenon is happening | /think-diagnose |
| Narrow among competing hypotheses against evidence | /think-ach |
| Make a hard decision with adversarial deliberation | /think-deliberate |
| Imagine how a plan could fail, or how a hypothetical catastrophe could hit a running system | /think-premortem |
| Scrutinize an idea or plan before committing to it | /think-scrutinize |
| Reflect on a completed experience to update beliefs | /think-reflect |
| Clean up code quality (DRY, dead code, naming) | /refactor |
| Rethink module boundaries and architecture | /review-arch |
| Survey the test suite and surface gaps as tickets | /review-test |
| Verify test quality via mutation testing | /test-mutation |
| Tidy all project documentation | /tidy-docs |
| Pre-release readiness check | /review-release |
| Cut a versioned release (preflight + plan + execute) | /release |
| Audit web content for accessibility barriers | /review-a11y |
| First-pass strategic orientation on a repo | /review-health |
| Review performance (compute and/or web) | /review-perf |
| Perform a white-box security audit | /review-security |
| Run every review dimension autonomously (with optional backlog creation) | /lead-review |
Tidy up the session before running /compact | /pre-compact |
| Clean up local git state (stale refs, merged branches) | /tidy-git |
Rules of thumb:
/lead-project/implement-project/implement-batch/implement (or /bug-fix if it's a bug)/scope or /scope-projectOne-line summaries grouped by namespace. Click through to each skill's detailed README.
/lead-* — Autonomous orchestrators/bug-hunt → /implement-batch until bugs converge below a stated severity floor; runs /review-test on the new reproducing tests at termination. (details)/refactor → loop of /review-arch + /implement-batch until convergence → final tactical /refactor. (details)/review-* sub-skill autonomously with an operator-set toggle for whether sub-skill ticket proposals are written to the tracker. (details)/implement-* — Working-tree mutators/implement autonomously, runs cross-cutting /refactor and /tidy-docs passes. (details)/scope-* — Planning/implement-project. (details)/review-* — Read-only auditsAll /review-* skills are advisory — they audit and propose, never mutate.
/think-* — ReasoningAll /think-* skills produce feedback only — no code, no tickets, no artifacts. See references/think.md for the namespace's design discipline.
/bug-* — Bug work/tidy-* — Mechanical hygienedoc-maintainer agent. Fixes within agent authority; surfaces judgment calls. (details)/test-* — Testing utilities/review-arch. Mutates. (details)/compact. (details)/review-release as preflight, plans every step with reversibility annotations, executes step-by-step, halts on first failure. No skip-preflight or force-release flag. (details)This project follows Semantic Versioning. Skills (slash commands like /implement, /review-perf, etc.) are the public interface. Subagent names are internal implementation details and may be renamed or restructured without constituting a breaking change.
git repository[cc]: https://claude.ai/code
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.