
Research
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
pro-workflow
Advanced tools
Complete AI coding workflow system with orchestration patterns, cross-agent support, reference guides, and searchable learnings
Complete AI coding workflow system.
Orchestration patterns • 18 hook events • 5 agents • 7 reference guides • Cross-agent support
Works with Claude Code, Cursor, and 32+ agents via SkillKit.
| Orchestration Patterns | Command > Agent > Skill architecture with multi-phase development |
| 5 Agents | planner, reviewer, scout, orchestrator (RPI workflow), debugger |
| 18 Hook Events | Added SubagentStart/Stop, TaskCompleted, PermissionRequest, TeammateIdle, PostToolUseFailure |
| 7 Reference Guides | Settings, CLI cheatsheet, orchestration patterns, context loading, cross-agent workflows, new features, daily habits |
| Context Optimizer | Token management and context budget planning skill |
| Production Settings | Full settings.example.json with permissions, spinner, output style |
| Curated MCP Config | Battle-tested server recommendations with scope guidance |
/develop Command | Research > Plan > Implement > Review & Commit with validation gates |
/doctor Command | Health check for your pro-workflow setup |
"80% of my code is written by AI, 20% is spent reviewing and correcting it." — Karpathy
Pro Workflow optimizes for that ratio. Every pattern reduces correction cycles.
Corrections compound. Each mistake becomes a rule that prevents future mistakes. After 50 sessions, Claude barely needs correcting.
/develop Flow
Multi-phase development with validation gates. Research before planning, plan before implementing, review before committing.
/develop Command in Action
| Pattern | What It Does |
|---|---|
| Self-Correction Loop | Claude learns from your corrections automatically |
| Parallel Worktrees | Zero dead time - native claude -w worktrees |
| Wrap-Up Ritual | End sessions with intention, capture learnings |
| Split Memory | Modular CLAUDE.md for complex projects |
| 80/20 Review | Batch reviews at checkpoints |
| Model Selection | Opus 4.6 adaptive thinking, Sonnet 4.6 (1M context) |
| Context Discipline | Manage your 200k token budget |
| Learning Log | Auto-document insights |
| Orchestration | Command > Agent > Skill wiring for complex features |
| Multi-Phase Dev | Research > Plan > Implement > Review & Commit with validation gates |
/add-plugin pro-workflow
The plugin includes 11 skills, 5 agents, and 6 rules that load automatically.
/plugin marketplace add rohitg00/pro-workflow
/plugin install pro-workflow@pro-workflow
cd ~/.claude/plugins/*/pro-workflow
npm install && npm run build
claude --plugin-dir /path/to/pro-workflow
## Pro Workflow
### Self-Correction
When corrected, propose rule -> add to LEARNED after approval.
### Planning
Multi-file: plan first, wait for "proceed".
### Quality
After edits: lint, typecheck, test.
### LEARNED
| Guide | What's Covered |
|---|---|
docs/settings-guide.md | All settings keys, permission modes, hierarchy, sandbox, MCP approval |
docs/cli-cheatsheet.md | Every CLI flag, keyboard shortcut, slash command, scripting patterns |
docs/orchestration-patterns.md | Command > Agent > Skill architecture, frontmatter reference, agent teams |
docs/context-loading.md | CLAUDE.md loading in monorepos, agent memory, skills discovery |
docs/cross-agent-workflows.md | Using Claude Code + Cursor together, config mapping, SkillKit translation |
docs/new-features.md | Voice mode, agent teams, checkpointing, remote control, new hook events |
docs/daily-habits.md | Session habits, debugging tips, terminal setup, anti-patterns |
| Skill | Description |
|---|---|
pro-workflow | Core workflow patterns for AI-assisted coding |
smart-commit | Quality gates, staged review, and conventional commits |
wrap-up | End-of-session ritual with change audit and learning capture |
learn-rule | Capture corrections as persistent learning rules |
parallel-worktrees | Set up git worktrees for zero dead time |
replay-learnings | Surface past learnings relevant to the current task |
session-handoff | Generate handoff documents for session continuity |
insights | Session analytics, correction trends, and productivity metrics |
deslop | Remove AI-generated code slop and clean up style |
context-optimizer | Token management, context budget, MCP audit |
orchestrate | Wire Commands, Agents, and Skills for multi-phase development |
| Agent | Purpose | Key Feature |
|---|---|---|
| planner | Break down complex tasks | Read-only, approval-gated |
| reviewer | Code review, security audit | Checklist-based, severity levels |
| scout | Confidence-gated exploration | Background, worktree-isolated |
| orchestrator | Multi-phase feature development | Research > Plan > Implement > Review, memory-enabled |
| debugger | Systematic bug investigation | Hypothesis-driven, root cause analysis |
When installed as a plugin, commands are available as /pro-workflow:<name>. Short forms like /develop also work directly after plugin install.
| Command | Alias | Purpose |
|---|---|---|
/pro-workflow:wrap-up | /wrap-up | End-of-session checklist |
/pro-workflow:learn-rule | /learn-rule | Extract correction to memory |
/pro-workflow:commit | /commit | Smart commit with quality gates |
/pro-workflow:develop | /develop | Multi-phase feature build (Research > Plan > Implement > Review & Commit) |
/pro-workflow:doctor | /doctor | Health check for setup and configuration |
/pro-workflow:insights | /insights | Session analytics and correction heatmap |
/pro-workflow:replay | /replay | Surface past learnings for current task |
/pro-workflow:handoff | /handoff | Generate session handoff document |
/pro-workflow:search | /search | Search learnings by keyword |
/pro-workflow:list | /list | List all stored learnings |
| Hook | When | What |
|---|---|---|
| PreToolUse | Before edits | Track edit count, quality gate reminders |
| PreToolUse | Before git commit/push | Remind about quality gates, wrap-up |
| PostToolUse | After code edits | Check for console.log, TODOs, secrets |
| PostToolUse | After tests | Suggest [LEARN] from failures |
| UserPromptSubmit | Each prompt | Drift detection, correction tracking |
| SessionStart | New session | Load learnings from database |
| Stop | Each response | Context-aware reminders |
| SessionEnd | Session close | Save session stats to database |
| PreCompact | Before compaction | Save context state |
| ConfigChange | Settings modified | Detect mid-session changes |
| Notification | System events | Log permission requests |
| SubagentStart | Subagent spawns | Log agent lifecycle |
| SubagentStop | Subagent finishes | Collect results |
| TaskCompleted | Task marked done | Quality gate on completion |
| PermissionRequest | Permission dialog | Flag dangerous operations |
| PostToolUseFailure | Tool fails | Track failures, suggest learnings |
| TeammateIdle | Teammate goes idle | Detect blockers in agent teams |
| Setup | Initial setup | One-time initialization (available, not configured) |
| WorktreeCreate | Worktree created | Set up worktree config (available, not configured) |
| WorktreeRemove | Worktree removed | Cleanup (available, not configured) |
graph LR
A[SessionStart] --> B[UserPromptSubmit]
B --> C[PreToolUse]
C --> D{Tool Runs}
D -->|Success| E[PostToolUse]
D -->|Failure| F[PostToolUseFailure]
E --> G[Stop]
F --> G
G -->|More prompts| B
G -->|Session ends| H[SessionEnd]
C -->|Spawns agent| I[SubagentStart]
I --> J[SubagentStop]
C -->|Needs permission| K[PermissionRequest]
style A fill:#6366f1,color:#fff,stroke:none
style H fill:#ef4444,color:#fff,stroke:none
style D fill:#f59e0b,color:#000,stroke:none
style E fill:#22c55e,color:#fff,stroke:none
style F fill:#ef4444,color:#fff,stroke:none
| Rule | Applies To | Description |
|---|---|---|
quality-gates | Always | Lint, typecheck, and test before commits |
atomic-commits | Always | Conventional format, feature branches, specific staging |
context-discipline | Always | Read before edit, plan before multi-file changes |
self-correction | Always | Capture mistakes as compounding learnings |
no-debug-statements | *.{ts,tsx,js,jsx,py,go,rs} | Remove console.log, debugger, print before committing |
communication-style | Always | Concise, action-oriented, no over-engineering |
See settings.example.json for a production-ready configuration including:
See mcp-config.example.json for curated server recommendations:
Rule: Start with 3 MCPs. Add only for concrete needs.
Works across 32+ AI coding agents via SkillKit:
graph TD
PW[Pro Workflow] --> CC[Claude Code]
PW --> CU[Cursor]
PW --> SK[SkillKit]
CC --> |"CLAUDE.md + hooks + agents"| CC
CU --> |".cursorrules + skills + agents"| CU
SK --> CO[Codex CLI]
SK --> GC[Gemini CLI]
SK --> WS[Windsurf]
SK --> MORE[27+ more]
style PW fill:#6366f1,color:#fff,stroke:none
style CC fill:#a78bfa,color:#fff,stroke:none
style CU fill:#f59e0b,color:#000,stroke:none
style SK fill:#22c55e,color:#fff,stroke:none
npx skillkit install pro-workflow
npx skillkit translate pro-workflow --agent cursor
npx skillkit translate pro-workflow --agent codex
npx skillkit translate pro-workflow --agent gemini-cli
See docs/cross-agent-workflows.md for configuration mapping between Claude Code, Cursor, Codex, and Gemini CLI.
pro-workflow/
├── .claude-plugin/ # Claude Code plugin
├── .cursor-plugin/ # Cursor plugin
├── skills/ # 11 skills (Cursor + Claude Code)
│ ├── pro-workflow/SKILL.md
│ ├── smart-commit/SKILL.md
│ ├── context-optimizer/SKILL.md
│ ├── orchestrate/SKILL.md
│ └── ...
├── agents/ # 5 agents
│ ├── planner.md
│ ├── reviewer.md
│ ├── scout.md
│ ├── orchestrator.md
│ └── debugger.md
├── commands/ # 10 slash commands
│ ├── develop.md # Multi-phase feature build
│ ├── doctor.md # Health check
│ ├── commit.md
│ └── ...
├── hooks/ # 18 hook events
│ └── hooks.json
├── docs/ # Reference guides
│ ├── settings-guide.md
│ ├── cli-cheatsheet.md
│ ├── orchestration-patterns.md
│ ├── context-loading.md
│ ├── cross-agent-workflows.md
│ ├── new-features.md
│ └── daily-habits.md
├── rules/ # 6 Cursor rules
├── contexts/ # 3 context modes
├── templates/ # Split CLAUDE.md templates
├── references/ # Claude Code resources
├── scripts/ # Hook scripts
├── settings.example.json # Production settings template
├── mcp-config.example.json # Curated MCP recommendations
├── src/ # TypeScript source (SQLite)
└── config.json
Learnings stored in SQLite with FTS5 full-text search:
~/.pro-workflow/
└── data.db # SQLite database with learnings and sessions
/search testing # Find all testing-related learnings
/search "file paths" # Exact phrase search
# Option A: Plugin install (Claude Code)
/plugin marketplace add rohitg00/pro-workflow
/plugin install pro-workflow@pro-workflow
# Option B: Plugin install (Cursor)
/add-plugin pro-workflow
# Option C: Manual (any agent)
git clone https://github.com/rohitg00/pro-workflow.git /tmp/pw
cp -r /tmp/pw/templates/split-claude-md/* ./.claude/
# Then try it (use /pro-workflow:<name> with plugin install):
/pro-workflow:develop add user authentication # Multi-phase feature build
/pro-workflow:doctor # Check your setup
/pro-workflow:wrap-up # End session properly
If you find this useful, star the repo to help others discover it.
SkillKit Marketplace •
Report Issues •
Reference Guides
Complete AI coding workflow system from production use across Claude Code, Cursor, and beyond.
FAQs
Complete AI coding workflow system with orchestration patterns, cross-agent support, reference guides, and searchable learnings
The npm package pro-workflow receives a total of 28 weekly downloads. As such, pro-workflow popularity was classified as not popular.
We found that pro-workflow demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.

Research
/Security News
We identified over 20 additional malicious extensions, along with over 20 related sleeper extensions, some of which have already been weaponized.