
Research
/Security News
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
@every-env/compound-plugin
Advanced tools
[](https://github.com/EveryInc/compound-engineering-plugin/actions/workflows/ci.yml) [
bunx @every-env/compound-plugin install compound-engineering --to windsurf
# convert to Windsurf workspace scope
bunx @every-env/compound-plugin install compound-engineering --to windsurf --scope workspace
# convert to Qwen Code format
bunx @every-env/compound-plugin install compound-engineering --to qwen
# auto-detect installed tools and install to all
bunx @every-env/compound-plugin install compound-engineering --to all
When developing and testing local changes to the plugin:
Claude Code — add a shell alias so your local copy loads alongside your normal plugins:
# add to ~/.zshrc or ~/.bashrc
alias claude-dev-ce='claude --plugin-dir ~/code/compound-engineering-plugin/plugins/compound-engineering'
One-liner to append it:
echo "alias claude-dev-ce='claude --plugin-dir ~/code/compound-engineering-plugin/plugins/compound-engineering'" >> ~/.zshrc
Then run claude-dev-ce instead of claude to test your changes. Your production install stays untouched.
Codex — point the install command at your local path:
bun run src/index.ts install ./plugins/compound-engineering --to codex
Other targets — same pattern, swap the target:
bun run src/index.ts install ./plugins/compound-engineering --to opencode
| Target | Output path | Notes |
|---|---|---|
opencode | ~/.config/opencode/ | Commands as .md files; opencode.json MCP config deep-merged; backups made before overwriting |
codex | ~/.codex/prompts + ~/.codex/skills | Claude commands become prompt + skill pairs; canonical ce:* workflow skills also get prompt wrappers; deprecated workflows:* aliases are omitted |
droid | ~/.factory/ | Tool names mapped (Bash→Execute, Write→Create); namespace prefixes stripped |
pi | ~/.pi/agent/ | Prompts, skills, extensions, and mcporter.json for MCPorter interoperability |
gemini | .gemini/ | Skills from agents; commands as .toml; namespaced commands become directories (workflows:plan → commands/workflows/plan.toml) |
copilot | .github/ | Agents as .agent.md with Copilot frontmatter; MCP env vars prefixed with COPILOT_MCP_ |
kiro | .kiro/ | Agents as JSON configs + prompt .md files; only stdio MCP servers supported |
openclaw | ~/.openclaw/extensions/<plugin>/ | Entry-point TypeScript skill file; openclaw-extension.json for MCP servers |
windsurf | ~/.codeium/windsurf/ (global) or .windsurf/ (workspace) | Agents become skills; commands become flat workflows; mcp_config.json merged |
qwen | ~/.qwen/extensions/<plugin>/ | Agents as .yaml; env vars with placeholders extracted as settings; colon separator for nested commands |
All provider targets are experimental and may change as the formats evolve.
Sync your personal Claude Code config (~/.claude/) to other AI coding tools. Omit --target to sync to all detected supported tools automatically:
# Sync to all detected tools (default)
bunx @every-env/compound-plugin sync
# Sync skills and MCP servers to OpenCode
bunx @every-env/compound-plugin sync --target opencode
# Sync to Codex
bunx @every-env/compound-plugin sync --target codex
# Sync to Pi
bunx @every-env/compound-plugin sync --target pi
# Sync to Droid
bunx @every-env/compound-plugin sync --target droid
# Sync to GitHub Copilot (skills + MCP servers)
bunx @every-env/compound-plugin sync --target copilot
# Sync to Gemini (skills + MCP servers)
bunx @every-env/compound-plugin sync --target gemini
# Sync to Windsurf
bunx @every-env/compound-plugin sync --target windsurf
# Sync to Kiro
bunx @every-env/compound-plugin sync --target kiro
# Sync to Qwen
bunx @every-env/compound-plugin sync --target qwen
# Sync to OpenClaw (skills only; MCP is validation-gated)
bunx @every-env/compound-plugin sync --target openclaw
# Sync to all detected tools
bunx @every-env/compound-plugin sync --target all
This syncs:
~/.claude/skills/ (as symlinks)~/.claude/commands/ (as provider-native prompts, workflows, or converted skills where supported)~/.claude/settings.jsonSkills are symlinked (not copied) so changes in Claude Code are reflected immediately.
Supported sync targets:
opencodecodexpidroidcopilotgeminiwindsurfkiroqwenopenclawNotes:
config.toml content and now includes remote MCP servers.~/.copilot/skills/ and MCP config to ~/.copilot/mcp-config.json.~/.gemini/ and avoids mirroring skills that Gemini already discovers from ~/.agents/skills, which prevents duplicate-skill warnings.Brainstorm → Plan → Work → Review → Compound → Repeat
| Command | Purpose |
|---|---|
/ce:brainstorm | Explore requirements and approaches before planning |
/ce:plan | Turn feature ideas into detailed implementation plans |
/ce:work | Execute plans with worktrees and task tracking |
/ce:review | Multi-agent code review before merging |
/ce:compound | Document learnings to make future work easier |
The /ce:brainstorm skill supports collaborative dialogue to clarify requirements and compare approaches before committing to a plan.
Each cycle compounds: brainstorms sharpen plans, plans inform future plans, reviews catch more issues, patterns get documented.
Each unit of engineering work should make subsequent units easier—not harder.
Traditional development accumulates technical debt. Every feature adds complexity. The codebase becomes harder to work with over time.
Compound engineering inverts this. 80% is in planning and review, 20% is in execution:
FAQs
[](https://github.com/EveryInc/compound-engineering-plugin/actions/workflows/ci.yml) [
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.

Research
/Security News
We identified over 20 additional malicious extensions, along with over 20 related sleeper extensions, some of which have already been weaponized.