
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
devlyn-cli
Advanced tools
Structured prompts, agent orchestration, and automated pipelines — debugging, code review, UI design, product specs, and more.
Get Started · Commands · Skills · Workflows · Optional Packs · Contributing
Claude Code is powerful out of the box — but teams need consistent, repeatable workflows. Without shared conventions, every developer prompts differently, reviews differently, and debugs differently.
devlyn-cli solves this with two complementary engineering approaches:
Structured prompts and role-based instructions that shape what the AI knows and how it thinks for each task.
Pipeline orchestration that controls how agents execute — permissions, state management, multi-phase workflows, and cross-model evaluation.
/devlyn:auto-resolve — 9-phase automated pipeline (build → browser validate → evaluate → fix loop → simplify → review → security → clean → docs)/devlyn:browser-validate — feature verification in a real browser with tiered fallback (Chrome MCP → Playwright → curl)bypassPermissions mode for autonomous subagent execution.claude/done-criteria.md, EVAL-FINDINGS.md, and BROWSER-RESULTS.md--with-codex flag (OpenAI Codex as independent evaluator)Zero dependencies. One command. Works with any project.
npx devlyn-cli
The interactive installer walks you through setup — select optional skills, choose community packs, done.
# Non-interactive install (CI/CD friendly)
npx devlyn-cli -y
# Update to the latest version
npx devlyn-cli@latest
# See everything that's included
npx devlyn-cli list
your-project/
├── .claude/
│ ├── commands/ # 16 slash commands
│ ├── skills/ # 5 core skills + any optional addons
│ ├── templates/ # Product spec, feature spec, prompt templates
│ ├── commit-conventions.md # Commit message standards
│ └── settings.json # Agent teams enabled
└── CLAUDE.md # Project-level AI instructions
Slash commands are invoked directly in Claude Code conversations (e.g., type /devlyn:resolve).
| Command | Description |
|---|---|
/devlyn:resolve | Systematic bug fixing with root-cause analysis and test-driven validation |
/devlyn:team-resolve | Spawns a full agent team — root cause analyst, test engineer, security auditor — to investigate complex issues |
/devlyn:auto-resolve | Fully automated pipeline for any task — bugs, features, refactors, chores. Build → browser validate → evaluate → fix loop → simplify → review → clean → docs. One command, zero human intervention. Supports --with-codex for cross-model evaluation via OpenAI Codex |
/devlyn:browser-validate | Verify implemented features work in a real browser — starts dev server, tests the feature end-to-end (clicks, forms, verification), with tiered fallback (Chrome MCP → Playwright → curl) |
| Command | Description |
|---|---|
/devlyn:review | Post-implementation review — security, quality, best practices checklist |
/devlyn:team-review | Multi-perspective team review with specialized reviewers (security, quality, testing, performance, product) |
/devlyn:evaluate | Independent quality evaluation — assembles evaluator team to grade work against done criteria with calibrated, skeptical grading |
/devlyn:clean | Detect and remove dead code, unused dependencies, complexity hotspots, and tech debt |
| Command | Description |
|---|---|
/devlyn:design-ui | Generate 5 radically distinct UI style explorations from a spec or reference image |
/devlyn:team-design-ui | Spawns a design team — creative director, product designer, visual designer, interaction designer, accessibility designer |
/devlyn:design-system | Extract design system tokens from a chosen style for exact reproduction |
/devlyn:implement-ui | Team-based UI build — component architect, UX engineer, accessibility engineer, responsive engineer, visual QA |
| Command | Description |
|---|---|
/devlyn:product-spec | Generate or incrementally update product spec documents |
/devlyn:feature-spec | Transform product specs into implementable feature specifications |
/devlyn:discover-product | Scan codebase to generate feature-oriented product documentation |
/devlyn:recommend-features | Prioritize top 5 features to build next based on value and readiness |
| Command | Description |
|---|---|
/devlyn:update-docs | Sync all project docs with current codebase — cleans stale content, preserves roadmaps, generates missing docs |
Skills are not invoked manually — they activate automatically when Claude Code detects a relevant conversation context. Think of them as always-on expertise that shapes how the AI approaches specific types of work.
| Skill | When It Activates | What It Does |
|---|---|---|
root-cause-analysis | Debugging conversations | Enforces 5 Whys methodology, evidence standards, and no-workaround rules |
code-review-standards | Code review tasks | Applies severity framework, quality bar, and approval criteria |
ui-implementation-standards | UI/frontend work | Ensures design fidelity, accessibility, animation quality, and responsive standards |
code-health-standards | Code maintenance | Enforces dead code prevention, dependency discipline, and complexity thresholds |
workflow-routing | Any task | SDLC phase map — guides you to the right command for your current task |
Commands are designed to compose. Pick the right tool based on scope, then chain them together.
One command runs the full cycle — no human intervention needed:
/devlyn:auto-resolve fix the auth bug where users see blank screen on 401
| Phase | What Happens |
|---|---|
| Build | team-resolve investigates and implements, writes testable done criteria |
| Browser Validate | For web projects: starts dev server, tests the implemented feature end-to-end in a real browser, fixes issues found |
| Evaluate | Independent evaluator grades against done criteria with calibrated skepticism |
| Fix Loop | If evaluation fails, fixes findings and re-evaluates (up to N rounds) |
| Simplify | Quick cleanup pass for reuse and efficiency |
| Review | Multi-perspective team review |
| Security | Dedicated OWASP-focused audit (auto-detects when changes touch auth, secrets, APIs) |
| Clean | Remove dead code and unused dependencies |
| Docs | Sync documentation with changes |
Each phase runs as a separate subagent (fresh context), communicates via files, and commits a git checkpoint for rollback safety. Skip phases with flags: --skip-browser, --skip-review, --skip-clean, --skip-docs, --max-rounds 3, --with-codex (cross-model evaluation via OpenAI Codex).
For step-by-step control between phases:
| Step | Command | What It Does |
|---|---|---|
| 1. Resolve | /devlyn:resolve or /devlyn:team-resolve | Fix the issue — solo for focused bugs (1-2 modules), team for complex issues (3+ modules) |
| 2. Evaluate | /devlyn:evaluate | Independent quality evaluation — grades against done criteria written in step 1 |
If the evaluation finds issues: /devlyn:team-resolve "Fix issues in .claude/EVAL-FINDINGS.md" | ||
| 3. Simplify | /simplify | Quick cleanup pass for reuse, quality, and efficiency (built-in Claude Code command) |
| 4. Review | /devlyn:review or /devlyn:team-review | Audit the changes — solo for small PRs (< 10 files), team for large PRs (10+ files) |
| 5. Clean | /devlyn:clean | Remove dead code, unused dependencies, and complexity hotspots |
| 6. Document | /devlyn:update-docs | Sync project documentation with the current codebase |
Steps 5-6 are optional — run them periodically rather than on every PR.
Scope matching matters. For a simple one-file bug,
/devlyn:resolve+/devlyn:review(solo) is fast. For a multi-module feature,/devlyn:auto-resolvehandles everything. Don't over-tool simple changes.
A full explore → extract → build pipeline:
| Step | Command | What It Does |
|---|---|---|
| 1. Explore | /devlyn:design-ui | Generates 5 radically distinct style options from a spec or reference image |
| 2. Extract | /devlyn:design-system | Pulls exact design tokens (colors, spacing, typography) from your chosen style |
| 3. Build | /devlyn:implement-ui | Spawns a build team (component architect, UX engineer, accessibility engineer, responsive engineer, visual QA) |
For design exploration with a full creative team, use
/devlyn:team-design-uiinstead of step 1.
After building, follow the recommended workflow starting from step 2 (simplify) to review and polish the implementation.
These commands work independently, outside of the main workflow:
| Command | What It Does |
|---|---|
/devlyn:clean [focus] | Focused cleanup — e.g., /devlyn:clean dependencies or /devlyn:clean dead-code |
/devlyn:update-docs [area] | Focused doc sync — e.g., /devlyn:update-docs API reference |
/devlyn:product-spec | Generate or update a product specification |
/devlyn:feature-spec | Transform a product spec into an implementable feature spec |
/devlyn:discover-product | Scan codebase to auto-generate product documentation |
/devlyn:recommend-features | Prioritize top 5 features to build next |
During installation, the interactive selector lets you add optional skills and community packs.
Copied directly into your .claude/skills/ directory.
| Skill | Description |
|---|---|
cloudflare-nextjs-setup | Cloudflare Workers + Next.js deployment with OpenNext |
generate-skill | Create well-structured Claude Code skills following Anthropic best practices |
prompt-engineering | Claude 4 prompt optimization using official Anthropic best practices |
better-auth-setup | Production-ready Better Auth + Hono + Drizzle + PostgreSQL auth setup |
pyx-scan | Check whether an AI agent skill is safe before installing |
dokkit | Document template filling for DOCX/HWPX — ingest, fill, review, export |
devlyn:pencil-pull | Pull Pencil designs into code with exact visual fidelity |
devlyn:pencil-push | Push codebase UI to Pencil canvas for design sync |
Installed via the skills CLI (npx skills add). These are maintained by their respective communities.
| Pack | Description |
|---|---|
vercel-labs/agent-skills | React, Next.js, React Native best practices |
supabase/agent-skills | Supabase integration patterns |
coreyhaines31/marketingskills | Marketing automation and content skills |
anthropics/skills | Official Anthropic skill-creator with eval framework and description optimizer |
Leonxlnx/taste-skill | Premium frontend design skills — modern layouts, animations, and visual refinement |
Installed via claude mcp add during setup.
| Server | Description |
|---|---|
codex-cli | Codex MCP server for cross-model evaluation via OpenAI Codex |
playwright | Playwright MCP for browser testing — powers devlyn:browser-validate Tier 2 |
Want to add a pack? Open a PR adding your pack to the
OPTIONAL_ADDONSarray inbin/devlyn.js.
npx devlyn-cli in your project root.claude/ and CLAUDE.md to the project root.claude/commands/ and .claude/skills/ on startup/devlyn:resolve in your Claude Code session — skills activate on their ownThe installation is idempotent — run it again anytime to update to the latest config.
Want to author custom skills for your team or the community?
generate-skill optional skill — or —npx skills add anthropics/skills
Both provide structured templates, best practices, and eval frameworks for writing high-quality Claude Code skills.
See the Claude Code skills documentation for the full specification.
Contributions are welcome! Here are some ways to get involved:
.md file in config/commands/config/skills/ with a SKILL.mdoptional-skills/ and the OPTIONAL_ADDONS arraygit checkout -b feat/my-feature)git push origin feat/my-feature)MIT — Donut Studio
FAQs
Claude Code configuration toolkit for teams
We found that devlyn-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.