From patriotforge
Use after finishing implementation to commit, run a multi-agent review swarm (security, lint, bandit, trivy, pip-audit, tests, code review), auto-fix all new issues, and merge when clean.
npx claudepluginhub aka-kolton/patriotforge-claude-plugin --plugin patriotforgeThis skill uses the workspace's default tool permissions.
Automated commit → review swarm → fix loop → merge. Invoke after implementation is complete.
Implements Clean Architecture in Android and Kotlin Multiplatform projects: module layouts, dependency rules, UseCases, Repositories, domain models, and data layers with Room, SQLDelight, Ktor.
Enforces code quality on file edits via Plankton hooks: auto-formats, lints, Claude-powered fixes with model tiering, config protection, and legacy package manager blocks.
Enforces C++ Core Guidelines for writing, reviewing, and refactoring modern C++ code (C++17+), promoting RAII, immutability, type safety, and idiomatic practices.
Automated commit → review swarm → fix loop → merge. Invoke after implementation is complete.
$ARGUMENTS — optional commit message or PR title
git status, git diff --stat, and git log --oneline -5 in D:/PatriotForgemain)main, stop — tell the user to create a feature branch first (git checkout -b feature/<name>).env, *.key, credentials, secrets, __pycache__/, node_modules/$ARGUMENTS as the message if providedfeat:, fix:, chore:, or refactor: prefixCo-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>-u to set upstream trackinggh pr list --head "$(git branch --show-current)" --json number,url --jq '.[0]'gh pr create --title "<title>" --body "## Summary\n- ...\n\n## Test plan\n- [ ] ..."
git diff main...HEAD --name-onlygit diff main...HEAD > /tmp/patriotforge-pr-diff.txtSpawn ALL FIVE review agents in parallel using the Task tool. Each agent receives the list of changed files and the diff path. Each must output issues in this exact format (or NO ISSUES FOUND):
ISSUE | <file>:<line> | <CRITICAL|HIGH|MEDIUM|LOW> | <description> | <suggested fix>
subagent_type: "general-purpose")Run PatriotForge lint/format/type checks on ONLY the files changed in this PR.
This agent mirrors the CI pipeline checks that run on push to main.
Python files (.py) — run from D:/PatriotForge/backend/:
python -m ruff check <file>
python -m ruff format --check <file>
D:/PatriotForge/backend/.venv/Scripts/python.exe -m mypy --strict <file>
TypeScript/React files (.ts/.tsx) — run from D:/PatriotForge/frontend/:
cmd /c "cd /d D:\PatriotForge\frontend & npx tsc --noEmit"
cmd /c "cd /d D:\PatriotForge\frontend & npx eslint <file>"
Note: mypy may report errors on unchanged files due to import chains — only report
errors where the file itself is in the changed files list.
Output format per issue:
ISSUE | <file>:<line> | <severity> | <description> | <suggested fix>
If no issues: NO ISSUES FOUND
Changed files: <PR file list>
subagent_type: "patriotforge:security-reviewer")Review ALL changed files for security vulnerabilities introduced by this PR.
Read the diff at D:/PatriotForge to see exactly which lines are new.
PatriotForge-specific checks:
- Parameterized queries only — no SQL string building
- Pydantic extra='forbid' on all request schemas
- CSRF token required on state-changing endpoints
- No localStorage for secrets — HTTP-only cookies only
- Stripe: Checkout Sessions only, webhook sig verified
- Input validation: max lengths, magic bytes on uploads
- No plaintext passwords or secrets in code/logs
- Webhook signatures verified before processing
Also check OWASP top 10: injection, XSS, auth bypass, SSRF, path traversal, insecure deserialization.
ONLY flag issues on lines ADDED or MODIFIED in this PR — ignore pre-existing patterns.
Output format per issue:
ISSUE | <file>:<line> | <CRITICAL|HIGH|MEDIUM|LOW> | <description> | <suggested fix>
If no issues: NO ISSUES FOUND
Changed files: <PR file list>
subagent_type: "patriotforge:tdd-agent")Analyze test coverage for code changed in this PR. Do NOT write tests — only report gaps.
1. Read the diff to identify new functions, endpoints, services, or logic branches
2. Check for corresponding test files in D:/PatriotForge/backend/tests/
3. Run the test suite:
SESSION_SECRET=test-secret-that-is-long-enough ENCRYPTION_KEY=dGVzdC1lbmNyeXB0aW9uLWtleS0zMmJ5dGVzISE= DATABASE_URL="sqlite+aiosqlite:///:memory:" REDIS_URL="redis://fake" D:/PatriotForge/backend/.venv/Scripts/python.exe -m pytest tests/ --tb=short -q
4. Report: untested new code paths, failing tests, missing test files
PatriotForge test conventions:
- Tests should cover: success, 422, 401, 429, 409 cases
- No mocking internal layers — test through real service
- aiosqlite + fakeredis for isolation
Output format per issue:
ISSUE | <file>:<line> | <HIGH|MEDIUM> | <description> | <suggested fix>
If no issues: NO ISSUES FOUND
Changed files: <PR file list>
subagent_type: "patriotforge:code-reviewer")Review all changed files for logic bugs, convention violations, and quality issues.
Read CLAUDE.md at D:\PatriotForge\CLAUDE.md for full conventions. Key rules:
- All functions async — no sync DB or Redis calls
- Service layer has no HTTP objects (no Request, Response, HTTPException)
- Domain exceptions in services, HTTP mapping in routers
- response_model and status_code on every endpoint
- Dependency injection via Depends() — no global state
- Pydantic v2: model_dump() not dict(), from_attributes not orm_mode
- forge_ table prefix, UUID PKs, NUMERIC(12,2) for money
- Soft delete (deleted_at) — never hard delete
- TypeScript strict — no any without justification
- Tailwind utilities only — no custom CSS
ONLY flag issues on lines ADDED or MODIFIED. Only report HIGH confidence issues.
Output format per issue:
ISSUE | <file>:<line> | <HIGH|MEDIUM> | <description> | <suggested fix>
If no issues: NO ISSUES FOUND
Changed files: <PR file list>
subagent_type: "general-purpose")Run security scanning tools that mirror the PatriotForge CI pipeline.
These catch vulnerable dependencies and common security anti-patterns.
Run ALL of these from D:/PatriotForge/:
1. Bandit (Python security linter) — run on changed .py files only:
D:/PatriotForge/backend/.venv/Scripts/bandit.exe -r <file> -f json
Bandit flags: hardcoded passwords, eval/exec, subprocess shells, weak crypto, etc.
Map bandit severity: HIGH->HIGH, MEDIUM->MEDIUM, LOW->LOW
IMPORTANT: Only report findings in files changed by this PR.
2. pip-audit (Python dependency vulnerabilities):
D:/PatriotForge/backend/.venv/Scripts/pip-audit.exe --requirement D:/PatriotForge/backend/requirements.txt --format json 2>&1 || true
If pip-audit finds vulnerabilities, only report HIGH+ severity.
If a requirements file doesn't exist, try: cd D:/PatriotForge/backend && .venv/Scripts/pip-audit.exe
3. npm audit (JS/TS dependency vulnerabilities):
cmd /c "cd /d D:\PatriotForge\frontend & npm audit --json"
Only report HIGH and CRITICAL severity vulnerabilities.
4. Trivy (filesystem vulnerability scan):
trivy fs D:/PatriotForge --severity HIGH,CRITICAL --format json 2>&1 || C:/Users/Kolton/AppData/Local/Microsoft/WinGet/Packages/AquaSecurity.Trivy_Microsoft.Winget.Source_8wekyb3d8bbwe/trivy.exe fs D:/PatriotForge --severity HIGH,CRITICAL --format json 2>&1
If neither trivy command works, output: INFO | trivy | LOW | Trivy not found — reinstall with winget install AquaSecurity.Trivy | Reinstall trivy
5. Gitleaks (secrets detection) — scan for leaked secrets in the PR diff:
gitleaks detect --source D:/PatriotForge --no-banner --report-format json 2>&1 || C:/Users/Kolton/AppData/Local/Microsoft/WinGet/Packages/Gitleaks.Gitleaks_Microsoft.Winget.Source_8wekyb3d8bbwe/gitleaks.exe detect --source D:/PatriotForge --no-banner --report-format json 2>&1
Gitleaks flags: API keys, tokens, passwords, private keys, connection strings in code.
IMPORTANT: Only report findings in files changed by this PR.
If neither gitleaks command works, output: INFO | gitleaks | LOW | Gitleaks not found — reinstall with winget install Gitleaks.Gitleaks | Reinstall gitleaks
For bandit findings: output one ISSUE line per finding in changed files.
For dependency audit findings: output one ISSUE line per vulnerable package.
For gitleaks findings: output one ISSUE line per leaked secret — ALWAYS CRITICAL severity.
Output format per issue:
ISSUE | <file-or-package>:<line-or-version> | <CRITICAL|HIGH|MEDIUM|LOW> | <description> | <suggested fix>
If no issues: NO ISSUES FOUND
After all five agents return:
ISSUE | ... lines from agent outputsgit diff main...HEAD -- <file> for each flagged fileReview complete: X issues found (Y pre-existing filtered out)
CRITICAL: N | HIGH: N | MEDIUM: N | LOW: N
If 0 issues → skip to Phase 6.
Maximum 3 iterations.
Each iteration:
python -m ruff format <file> and cmd /c "cd /d D:\PatriotForge\frontend & npx eslint --fix <file>"subprocess.call(shell=True) with subprocess.run(...))python -m ruff format on all changed .py filescmd /c "cd /d D:\PatriotForge\frontend & npx eslint --fix <files>" on changed .ts/.tsxfix: address review findings (round N)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
AskUserQuestion:
gh pr merge <number> --squash --delete-branch (or --merge)sed or awk — use Edit tool or Python scriptsD:/PatriotForge/...)gh CLI is missing or git is broken, stop and tell the user