security-guidance

Lemon AI Hub

Build, Launch, and Scale with AI-Native Architecture.

Lemon AI Hub is a centralized and optimized repository to manage AI Skills and Plugins across different local agents (Claude Code, Codex, OpenCode, Agy). It is the technical foundation of the Lemon.dev ecosystem, designed by Anderson Lima to help founders and developers bridge the gap between AI-generated code and production-ready products.

This project is based on and inspired by Peter Steinberger's pattern (steipete/agent-scripts), but structured with a focus on .claude and shared with other providers via transparent symbolic links.

---

🍋 The Lemon.dev Philosophy

The best code is invisible—it works, scales, and converts. Lemon AI Hub embodies this by providing:

• AI-Native Squads: Specialized agents that understand architecture and product strategy.
• Value Loops: Continuous improvement engines that keep quality high without manual overhead.
• Token Efficiency: Tools like RTK and Caveman Mode to maximize speed and minimize costs.

---

🧩 Install as a Claude Code Hub

This repository ships a marketplace manifest (.claude-plugin/marketplace.json) so you can install its plugins directly inside Claude Code.

1. Register the marketplace

Inside a Claude Code session, run the slash command:

/plugin marketplace add Andersonlimahw/lemon-ai-hub

2. Browse & install plugins

Open the interactive installer, or install a plugin by name using the plugin@marketplace syntax:

/plugin                                            # browse the catalog UI
/plugin install spotify-squad@lemon-ai-hub
/plugin install agentic-value-loops@lemon-ai-hub

Plugin	Description
a11y-audit	WCAG 2.1 AA/AAA accessibility audit for web components, pages, and apps. Detects contrast failures, missing ARIA labels, keyboard trap issues, focus order problems, and screen-reader gotchas. Use when user wants to audit accessibility, fix a11y warnings, prepare for compliance review, or validate UI against WCAG standards.
agent-sdk-dev	A comprehensive plugin for creating and verifying Agent SDK applications in Python and TypeScript.
agentic-value-loops	Agentic Value Loops plugin — Continuous improvement engine that ships verified increments with constant quality. Includes loops for Feature Development, Maintenance & Security, Documentation Sync, and AI Tuning.
ai-workspace-orchestrator	Project and workspace AI setup orchestrator. Builds AGENTS.md/CLAUDE.md contracts, optional global or project skills, Spotify Squad-style agent/subagent topology, and adversarial setup review for single apps, monorepos, and multi-domain workspaces.
api-test-loop	API Test Loop plugin — Automated REST API validation loop. Executes HTTP requests via CURL, logs findings for REST best practices (method, input/output format, security, performance, docs), and implements backend fixes.
app-store-connect-api	Apple Store Connect API Expert Agent and Skills. Provides comprehensive tools and knowledge for interacting with the App Store Connect API, covering domains like TestFlight, In-app purchases, Subscriptions, App management, and Provisioning.
apple-store-release-agent	AI release agent for the Apple App Store. Audits Expo/React Native iOS builds, App Store metadata, App Privacy readiness, TestFlight, RevenueCat/IAP, Firebase, i18n parity, screenshots, and review notes, then emits a GO/GO_WITH_WARNINGS/NO_GO decision with full risk + privacy + IAP reports. Never submits to App Review or alters the store without explicit human approval. Generic core with presets for Expo/RN/Firebase/RevenueCat apps.
async-patterns	Async and concurrency pattern advisor for JavaScript/TypeScript, Python, Go, and Rust. Identifies race conditions, missing error handling in promise chains, N+1 async anti-patterns, unbounded parallelism, and missing cancellation. Recommends correct patterns: Promise.all, p-limit, AbortController, AsyncLocalStorage, worker threads. Use when async code has bugs, timeouts, or memory leaks.
bundle-analyzer	JavaScript/TypeScript bundle size analysis, tree-shaking audit, and code splitting recommendations. Identifies heavy dependencies, duplicate packages, unused imports, and suggests dynamic imports and lazy loading. Use when bundle is too large, Lighthouse score is low, or user wants to optimize web app loading performance.
chaos-test	Chaos engineering scenarios for resilience testing. Designs fault injection experiments (network partitions, latency injection, dependency failures, disk pressure, memory leaks) and verifies circuit breakers, retries, and fallbacks work correctly. Use when building resilience features, verifying SLO under failure conditions, or preparing for production chaos days.