
Research
/Security News
CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.
pro-workflow
Advanced tools
Battle-tested Claude Code workflows with agent teams, smart commit, insights, and searchable learnings
Battle-tested Claude Code workflows from power users. Self-correcting memory, parallel worktrees, wrap-up rituals, and the 80/20 AI coding ratio.
v1.2.0: Scout agent, /replay, /handoff, drift detection, adaptive quality gates, and correction heatmap!
If this helps your workflow, please give it a star!
/replay: Surface relevant past learnings before starting a task — your SQLite-powered coding muscle memory/handoff: Generate structured session handoff documents for seamless continuation in the next session/insights heatmap shows which categories and projects get corrected most, with hot/cold learning analysis/commit with quality gates, /insights analytics, agent teams, persistent SQLite storage with FTS5"80% of my code is written by AI, 20% is spent reviewing and correcting it." — Karpathy
This skill optimizes for that ratio. Every pattern reduces correction cycles.
| Pattern | What It Does |
|---|---|
| Self-Correction Loop | Claude learns from your corrections automatically |
| Parallel Worktrees | Zero dead time - work while Claude thinks |
| Wrap-Up Ritual | End sessions with intention, capture learnings |
| Split Memory | Modular CLAUDE.md for complex projects |
| 80/20 Review | Batch reviews at checkpoints |
| Model Selection | Opus+Thinking for one-shot accuracy |
| Context Discipline | Manage your 200k token budget |
| Learning Log | Auto-document insights |
# Add marketplace
/plugin marketplace add rohitg00/pro-workflow
# Install plugin
/plugin install pro-workflow@pro-workflow
Or via CLI:
claude plugin marketplace add rohitg00/pro-workflow
claude plugin install pro-workflow@pro-workflow
After installation, build the TypeScript for persistent storage:
cd ~/.claude/plugins/*/pro-workflow # Navigate to plugin directory
npm install && npm run build
This creates the SQLite database at ~/.pro-workflow/data.db.
claude --plugin-dir /path/to/pro-workflow
git clone https://github.com/rohitg00/pro-workflow.git /tmp/pw
cp -r /tmp/pw/templates/split-claude-md/* ./.claude/
cp -r /tmp/pw/commands/* ~/.claude/commands/
cp -r /tmp/pw/hooks/* ~/.claude/
## Pro Workflow
### Self-Correction
When corrected, propose rule → add to LEARNED after approval.
### Planning
Multi-file: plan first, wait for "proceed".
### Quality
After edits: lint, typecheck, test.
### LEARNED
After plugin install, commands are namespaced:
| Command | Purpose |
|---|---|
/pro-workflow:wrap-up | End-of-session checklist |
/pro-workflow:learn-rule | Extract correction to memory (file-based) |
/pro-workflow:parallel | Worktree setup guide |
/pro-workflow:learn | Claude Code best practices & save learnings |
/pro-workflow:search | Search learnings by keyword |
/pro-workflow:list | List all stored learnings |
/pro-workflow:commit | Smart commit with quality gates and code review |
/pro-workflow:insights | Session analytics, learning patterns, and correction heatmap |
/pro-workflow:replay | Surface past learnings for current task |
/pro-workflow:handoff | Generate session handoff document for next session |
Learnings are stored in SQLite with FTS5 full-text search:
~/.pro-workflow/
└── data.db # SQLite database with learnings and sessions
/search testing # Find all testing-related learnings
/search "file paths" # Exact phrase search
/search git commit # Multiple terms
Automated enforcement of workflow patterns.
| Hook | When | What |
|---|---|---|
| PreToolUse | Before edits | Track edit count, quality gate reminders |
| PreToolUse | Before git commit/push | Remind about quality gates, wrap-up |
| PostToolUse | After code edits | Check for console.log, TODOs, secrets |
| PostToolUse | After tests | Suggest [LEARN] from failures |
| UserPromptSubmit | Each prompt | Drift detection — warns when straying from original intent |
| SessionStart | New session | Load learnings from database |
| Stop | Each response | Periodic wrap-up reminders |
| SessionEnd | Session close | Save session stats to database |
# Full setup with hooks
git clone https://github.com/rohitg00/pro-workflow.git /tmp/pw
cp -r /tmp/pw/hooks/* ~/.claude/
cp -r /tmp/pw/scripts ~/.claude/scripts/pro-workflow/
cp -r /tmp/pw/commands/* ~/.claude/commands/
| Context | When | Behavior |
|---|---|---|
| dev | Building | Code first, iterate |
| review | PRs | Read-only, security focus |
| research | Exploring | Summarize, plan |
| Agent | Purpose |
|---|---|
| planner | Break down complex tasks |
| reviewer | Code review, security audit |
| scout | Confidence-gated exploration before implementation |
Coordinate multiple Claude Code sessions working together:
# Enable in settings.json
{ "env": { "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS": "1" } }
Shift+Up/Down) or split panes (tmux/iTerm2)Shift+Tab): lead orchestrates onlypro-workflow/
├── .claude-plugin/
│ ├── plugin.json # Plugin manifest
│ ├── marketplace.json # Marketplace config
│ └── README.md
├── src/ # TypeScript source
│ ├── db/
│ │ ├── index.ts # Database initialization
│ │ ├── store.ts # Stateless store factory
│ │ └── schema.sql # SQLite schema with FTS5
│ ├── search/
│ │ └── fts.ts # BM25 search helpers
│ └── index.ts
├── dist/ # Compiled JavaScript
├── skills/
│ └── pro-workflow/
│ └── SKILL.md # Main skill
├── agents/
│ ├── planner.md # Planner agent
│ ├── reviewer.md # Reviewer agent
│ └── scout.md # Confidence-gated scout agent
├── commands/
│ ├── wrap-up.md
│ ├── learn-rule.md
│ ├── parallel.md
│ ├── learn.md
│ ├── search.md
│ ├── list.md
│ ├── commit.md
│ ├── insights.md
│ ├── replay.md # Surface past learnings
│ └── handoff.md # Session handoff document
├── hooks/
│ └── hooks.json # Hooks file
├── scripts/ # Hook scripts
├── contexts/
│ ├── dev.md # Dev context
│ ├── review.md # Review context
│ └── research.md # Research context
├── references/
│ └── claude-code-resources.md # Claude code resources reference file
├── rules/
│ └── core-rules.md # Core rules file
├── templates/
│ └── split-claude-md/ # Split claude md template
├── package.json
├── tsconfig.json # TypeScript configuration file
└── README.md # README file
Pro-workflow teaches Claude Code best practices directly, with links to official documentation for deep dives.
Official Docs: https://code.claude.com/docs/
Topics covered: sessions, context management, modes, CLAUDE.md, prompting, writing rules, skills, subagents, hooks, MCP, security, and IDE integration.
/pro-workflow:learn # Best practices guide & save learnings
/pro-workflow:learn-rule # Capture corrections to memory
/pro-workflow:search claude-code # Find past Claude Code learnings
One skill. 32+ AI coding agents. Install pro-workflow across Claude Code, Cursor, Codex, Gemini CLI, and more with SkillKit.
# Install this skill
npx skillkit install pro-workflow
# Translate to any agent format
npx skillkit translate pro-workflow --agent cursor
# Get AI-powered skill recommendations
npx skillkit primer
Why SkillKit?
Explore the marketplace at agenstskills.com
If you find this useful:
Distilled from Claude Code power users and real production use.
FAQs
Complete AI coding workflow system with orchestration patterns, cross-agent support, reference guides, and searchable learnings
The npm package pro-workflow receives a total of 28 weekly downloads. As such, pro-workflow popularity was classified as not popular.
We found that pro-workflow demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.