
Research
/Security News
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
pro-workflow
Advanced tools
Battle-tested Claude Code workflows with persistent storage and searchable learnings
Battle-tested Claude Code workflows from power users. Self-correcting memory, parallel worktrees, wrap-up rituals, and the 80/20 AI coding ratio.
v0.1.0: Now with persistent SQLite storage and searchable learnings!
If this helps your workflow, please give it a star!
~/.pro-workflow/data.db/learn, /search, /list for database operations"80% of my code is written by AI, 20% is spent reviewing and correcting it." — Karpathy
This skill optimizes for that ratio. Every pattern reduces correction cycles.
| Pattern | What It Does |
|---|---|
| Self-Correction Loop | Claude learns from your corrections automatically |
| Parallel Worktrees | Zero dead time - work while Claude thinks |
| Wrap-Up Ritual | End sessions with intention, capture learnings |
| Split Memory | Modular CLAUDE.md for complex projects |
| 80/20 Review | Batch reviews at checkpoints |
| Model Selection | Opus+Thinking for one-shot accuracy |
| Context Discipline | Manage your 200k token budget |
| Learning Log | Auto-document insights |
# Add marketplace
/plugin marketplace add rohitg00/pro-workflow
# Install plugin
/plugin install pro-workflow@pro-workflow
Or via CLI:
claude plugin marketplace add rohitg00/pro-workflow
claude plugin install pro-workflow@pro-workflow
After installation, build the TypeScript for persistent storage:
cd ~/.claude/plugins/*/pro-workflow # Navigate to plugin directory
npm install && npm run build
This creates the SQLite database at ~/.pro-workflow/data.db.
claude --plugin-dir /path/to/pro-workflow
git clone https://github.com/rohitg00/pro-workflow.git /tmp/pw
cp -r /tmp/pw/templates/split-claude-md/* ./.claude/
cp -r /tmp/pw/commands/* ~/.claude/commands/
cp -r /tmp/pw/hooks/* ~/.claude/
## Pro Workflow
### Self-Correction
When corrected, propose rule → add to LEARNED after approval.
### Planning
Multi-file: plan first, wait for "proceed".
### Quality
After edits: lint, typecheck, test.
### LEARNED
After plugin install, commands are namespaced:
| Command | Purpose |
|---|---|
/pro-workflow:wrap-up | End-of-session checklist |
/pro-workflow:learn-rule | Extract correction to memory (file-based) |
/pro-workflow:parallel | Worktree setup guide |
/pro-workflow:learn | NEW Save learning to SQLite database |
/pro-workflow:search | NEW Search learnings by keyword |
/pro-workflow:list | NEW List all stored learnings |
Learnings are stored in SQLite with FTS5 full-text search:
~/.pro-workflow/
└── data.db # SQLite database with learnings and sessions
/search testing # Find all testing-related learnings
/search "file paths" # Exact phrase search
/search git commit # Multiple terms
Automated enforcement of workflow patterns.
| Hook | When | What |
|---|---|---|
| PreToolUse | Before edits | Track edit count, quality gate reminders |
| PreToolUse | Before git commit/push | Remind about quality gates, wrap-up |
| PostToolUse | After code edits | Check for console.log, TODOs, secrets |
| PostToolUse | After tests | Suggest [LEARN] from failures |
| SessionStart | New session | Load learnings from database |
| Stop | Each response | Periodic wrap-up reminders |
| SessionEnd | Session close | Save session stats to database |
# Full setup with hooks
git clone https://github.com/rohitg00/pro-workflow.git /tmp/pw
cp -r /tmp/pw/hooks/* ~/.claude/
cp -r /tmp/pw/scripts ~/.claude/scripts/pro-workflow/
cp -r /tmp/pw/commands/* ~/.claude/commands/
| Context | When | Behavior |
|---|---|---|
| dev | Building | Code first, iterate |
| review | PRs | Read-only, security focus |
| research | Exploring | Summarize, plan |
| Agent | Purpose |
|---|---|
| planner | Break down complex tasks |
| reviewer | Code review, security audit |
pro-workflow/
├── .claude-plugin/
│ ├── plugin.json # Plugin manifest
│ ├── marketplace.json # Marketplace config
│ └── README.md
├── src/ # TypeScript source (NEW)
│ ├── db/
│ │ ├── index.ts # Database initialization
│ │ ├── store.ts # Stateless store factory
│ │ └── schema.sql # SQLite schema with FTS5
│ ├── search/
│ │ └── fts.ts # BM25 search helpers
│ └── index.ts
├── dist/ # Compiled JavaScript
├── skills/
│ └── pro-workflow/
│ └── SKILL.md # Main skill
├── agents/
│ ├── planner.md
│ └── reviewer.md
├── commands/
│ ├── wrap-up.md
│ ├── learn-rule.md
│ ├── parallel.md
│ ├── learn.md # NEW
│ ├── search.md # NEW
│ └── list.md # NEW
├── hooks/
│ └── hooks.json
├── scripts/ # Hook scripts
├── contexts/
│ ├── dev.md
│ ├── review.md
│ └── research.md
├── rules/
│ └── core-rules.md
├── templates/
│ └── split-claude-md/
├── package.json # NEW
├── tsconfig.json # NEW
└── README.md
One skill. 32+ AI coding agents. Install pro-workflow across Claude Code, Cursor, Codex, Gemini CLI, and more with SkillKit.
# Install this skill
npx skillkit install pro-workflow
# Translate to any agent format
npx skillkit translate pro-workflow --agent cursor
# Get AI-powered skill recommendations
npx skillkit primer
Why SkillKit?
Explore the marketplace at agenstskills.com
If you find this useful:
Distilled from Claude Code power users and real production use.
FAQs
Complete AI coding workflow system with orchestration patterns, cross-agent support, reference guides, and searchable learnings
The npm package pro-workflow receives a total of 28 weekly downloads. As such, pro-workflow popularity was classified as not popular.
We found that pro-workflow demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.

Research
/Security News
We identified over 20 additional malicious extensions, along with over 20 related sleeper extensions, some of which have already been weaponized.