sdlc-marketplace

Core skills library for Claude Code: TDD, debugging, collaboration patterns, and proven techniques

Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.

Universal SDLC orchestrator with stack provider auto-discovery. Owns the pipeline; framework plugins register themselves via stack.md profiles. Includes 5 cost-tiered default agents (BA Opus, Dev Sonnet, QA Sonnet with iteration cap, Sec Opus, Docs Haiku). Slash command: /sdlc:start "<feature>".

Shared JavaScript/TypeScript foundation skills for the SDLC marketplace. Contains stack-agnostic conventions: typescript-patterns (strict TS, branded types, validation at boundary, no-any) and npm-patterns (package manager detection, semver, scripts, lockfile hygiene). Referenced cross-plugin by every JS/TS framework provider (nodejs, nestjs, nextjs, react, react-native, vue, angular). No agent, no stack profile — pure shared library.

Node.js backend stack provider for SDLC marketplace. Adds node-architect agent and node-conventions skill for Express/Fastify/Koa/plain Node.js projects. Reuses TypeScript and npm skills from js-foundation. Composes with frontend plugins (react, vue, angular) via aspect resolution.

NestJS opinionated backend stack provider for SDLC marketplace. Replaces nodejs-plugin for projects with @nestjs/core. Covers REST + ORM (TypeORM/Prisma/Mongoose) + GraphQL + WebSockets + Microservices. Reuses TypeScript and npm skills from nodejs-plugin.

Next.js full-stack React framework stack provider for SDLC marketplace. Multi-aspect ownership (backend + frontend). App Router, Server Components, Server Actions, Route Handlers, ISR/SSG/SSR. Reuses TypeScript and npm skills from nodejs-plugin.

React SPA frontend stack provider for SDLC marketplace. Components, hooks, state management, routing, forms, testing. Composes with backend plugins (nodejs/nestjs/laravel) via aspect resolution. Loses to higher-priority frameworks (nextjs, react-native) on their respective project types.

Vue 3 SPA frontend stack provider for SDLC marketplace. Composition API, <script setup>, Pinia, Vue Router v4, vee-validate, Vitest + @vue/test-utils. Vue 3 primary; Vue 2 fallback notes for legacy projects. Nuxt out of scope (separate plugin in roadmap).

Angular 18-21 SPA frontend stack provider for SDLC marketplace. Standalone components + NgModule equally, signals + services + NgRx (Store/Component Store/Signals), Reactive Forms (typed), Angular Router with functional guards, TestBed + component harnesses + Angular Testing Library. Modern era (signal-first, control flow @if/@for/@switch) with legacy NgModule fallback. Angular Universal (SSR) pointer-only — SPA focus.

React Native mobile stack provider for SDLC marketplace. Covers both Expo (managed/dev-client) and bare workflows. Navigation (React Navigation v7 + Expo Router), platform-specific code, native storage (AsyncStorage/MMKV/SecureStore/Keychain), Jest + RTL Native testing with optional Detox/Maestro e2e. Highest frontend priority (300) — wins over react-plugin on RN projects.

Shared PHP foundation skills for the SDLC marketplace. Contains stack-agnostic conventions: php-conventions (modern PHP 8.x idioms — readonly properties, enums, match, constructor promotion, strict_types, PSR-12), composer-tooling (PSR-4 autoloading, version constraints, scripts, platform requirements) and php-testing (PHPUnit + Pest, data providers, test doubles, fixtures, coverage). Referenced by laravel-plugin and symfony-plugin. No agent, no stack profile — pure shared library.

Laravel + Inertia + Vue stack provider for the SDLC marketplace. Registers the Laravel profile via stack.md; substitutes laravel-architect for the development phase and adds an artisan-specialist agent for an extra database phase. Includes laravel-conventions and eloquent-patterns skills, reuses php-foundation shared skills, laravel-boost MCP integration, and a Pint Stop-hook for auto-formatting.

Symfony backend + database stack provider for the SDLC marketplace. Registers the Symfony profile via stack.md (priority=100, detects symfony/framework-bundle); substitutes symfony-architect for the development phase and adds a doctrine-specialist agent for an extra database phase. Includes symfony-conventions and doctrine-patterns skills, a PHP-CS-Fixer Stop-hook for auto-formatting, and a PHP-CS-Fixer/PHPUnit post-pipeline. Reuses php-foundation skills. symfony-architect renders Twig views and designs the Serializer/API contract for SPA frontend plugins.

Inertia.js + Vue 3 frontend stack provider for Laravel SDLC marketplace. Detects @inertiajs/vue3 adapter (priority=175, beats generic vue-plugin at 150). Server-driven Inertia pages, useForm, usePage, shared props — no client-side router.

Inertia.js + React frontend stack provider for Laravel SDLC marketplace. Detects @inertiajs/react adapter (priority=175, beats generic react-plugin at 150). Server-driven Inertia pages, useForm, usePage, shared props — no client-side React Router.

Shared C#/.NET foundation skills for the SDLC marketplace. Contains stack-agnostic conventions: csharp-conventions (modern C# idioms — nullable reference types, records, pattern matching, async/await, IDisposable, naming), dotnet-tooling (dotnet CLI, NuGet, csproj/sln, central package management, dotnet format) and dotnet-testing (xUnit, Moq/NSubstitute, FluentAssertions, coverlet). Referenced cross-plugin by every .NET framework provider in the marketplace. No agent, no stack profile — pure shared library.

ASP.NET Core backend + database stack provider (priority=100, detects appsettings.json). Provides aspnet-core-architect (Sonnet/medium — Minimal API / MVC, DTOs, FluentValidation, DI, Options, authorization, HTTPS/HSTS, EF Core stubs) and efcore-specialist (Sonnet/low — Fluent API config, migrations, indexes). Adds aspnet-conventions and efcore-patterns skills, dotnet format Stop-hook. Reuses csharp-foundation skills. Designs the API contract for SPA frontend plugins.

Shared Java foundation skills for the SDLC marketplace. Contains stack-agnostic conventions: java-conventions (modern Java idioms — records, sealed types, Optional, streams, immutability, null discipline), build-tooling (Maven vs Gradle detection, wrappers, dependency/BOM management, semver) and jvm-testing (JUnit 5, Mockito, AssertJ, Testcontainers). Referenced cross-plugin by every Java framework provider (java-plugin, spring-boot-plugin). No agent, no stack profile — pure shared library.

Plain Java backend stack provider for the SDLC marketplace (priority=100). Detects any Maven or Gradle project and registers a java-architect agent (Sonnet/medium) as the development-phase backend implementer. Handles CLI tools, libraries, plain services without a web framework. Falls back gracefully to this plugin when no higher-priority Java framework plugin matches (e.g. spring-boot-plugin at 150). Reuses shared skills from java-foundation (java-conventions, build-tooling, jvm-testing).

Spring Boot backend stack provider for the SDLC marketplace (priority=150). Detects Spring Boot projects via pom.xml / build.gradle / build.gradle.kts and registers spring-boot-architect (Sonnet/medium) as the development-phase backend implementer. Covers REST controllers, Spring Data JPA, Bean Validation, Spring Security, Flyway/Liquibase migrations, application.yml configuration, and @SpringBootTest/@WebMvcTest/@DataJpaTest slice testing. Reuses shared skills from java-foundation. Beats java-plugin (100) on the backend aspect for Spring projects.

Shared Python foundation skills for the SDLC marketplace. Contains stack-agnostic Python conventions (python-conventions — type hints, dataclasses, match, pathlib, enums, context managers, PEP 8, strict typing), python-tooling (pyproject.toml as source of truth, pip/Poetry/uv/pipenv, venv, lockfiles, ruff lint+format, mypy, console scripts), and pytest-testing (fixtures, parametrize, conftest, monkeypatch, unittest.mock, pytest-cov). No agent, no stack profile — pure shared library. Referenced by django-plugin, fastapi-plugin, flask-plugin, and python-plugin.

Plain Python backend stack provider (priority=100, detects pyproject.toml/requirements.txt/setup.py/Pipfile). Handles Python libraries, CLI tools, scripts, data pipelines, and microservices without a recognized web framework. Adds python-architect agent (Sonnet/medium) and python-app-conventions skill. Falls back gracefully when django-plugin/fastapi-plugin/flask-plugin (priority 150) match instead. Reuses python-foundation skills.

Django backend + database stack provider (priority=150). Detects manage.py or Django in pyproject.toml/requirements.txt. Provides django-architect (Sonnet/medium — views, DRF ViewSets, serializers, forms, URLconf, middleware, signals, model definitions, Django templates, DRF API contract for SPA) and django-migrations-specialist (Sonnet/low — model field finalization, indexes/constraints, makemigrations, sqlmigrate review, migrate, verify) agents plus django-conventions and django-orm-patterns skills. Reuses python-foundation skills. Extra database phase after development.

FastAPI backend + database stack provider (priority=150). Detects fastapi in pyproject.toml/requirements.txt. Provides fastapi-architect (Sonnet/medium — APIRouter, Pydantic v2 schemas, Depends injection, async endpoints, OAuth2/JWT, OpenAPI, SQLAlchemy model stubs, API contract for SPA frontends) and alembic-specialist (Sonnet/low — SQLAlchemy 2.0 mapped classes, alembic revision --autogenerate, migration review, alembic upgrade head, verification) agents plus fastapi-conventions and sqlalchemy-patterns skills. Reuses python-foundation skills. Extra database phase after development.

Flask backend + database stack provider (priority=150). Detects Flask in pyproject.toml/requirements.txt. Provides flask-architect (Sonnet/medium — app factory, Blueprints, views, Flask-Login/JWT auth, Jinja2 templates or JSON API, Marshmallow/WTForms validation, SQLAlchemy model definitions) and flask-migrate-specialist (Sonnet/low — Flask-Migrate: flask db migrate, sqlmigrate review, flask db upgrade, flask db check) agents plus flask-conventions and sqlalchemy-patterns skills. Reuses python-foundation skills. Extra database phase after development.