
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
strikethroo
Advanced tools
Spec-driven development that fits each codebase like a glove.
Plain-Markdown hooks teach the agent your conventions, so every plan, task, and run inherits them. No API keys, no extra tools to run.
Workflow · Customization · Visualizations · FAQ
Bends to your conventionsPlain-Markdown hooks fire at nine points across the workflow; inject your test commands, standards, and domain rules so every plan, task, and run inherits them. No plugins, no code. |
Clean context per agentEvery step runs with a fresh, focused context: the planner sees only your work order, the task generator only the approved plan, each execution sub-agent only its single task. No context bleed, no drift. | |
No API keysRuns inside the assistant you already use -- Claude Code, Codex, Cursor, OpenCode, or Copilot -- on the subscription you already pay for. Nothing to provision, host, or rotate. |
Harness-agnostic skillsThe workflow ships as Agent Skills: one |
Every codebase has its own conventions, and Strikethroo bends to them instead of imposing its own. Three plain-Markdown surfaces -- no plugins, no code:
Fire at nine points across the workflow (before planning, after each phase, on errors, and more). Drop in your test commands, coding standards, and domain rules; every plan, task, and execution run inherits them.
Define the shape of plans and tasks -- add your own sections and checklists.
One file of domain knowledge every step reads.
Hooks, templates, and a project-context file are all plain Markdown -- nothing to compile, no plugin API to learn. See the Customization Guide for examples.
# 1. Bootstrap the shared workspace
npx strikethroo init --harnesses claude
# 2. Install the workflow skills
npx skills add e0ipso/strikethroo
Requires Node.js 22+ and an assistant that supports the Agent Skills format.
flowchart LR
A[Work Order] --> B[Plan]
B --> C{Review}
C -->|Edit| B
C -->|Approve| D[Tasks]
D --> E{Verify}
E --> G[Execute]
G --> H{Review}
H -->|Edit| G
H -->|Approve| J[Done]
Three steps, each delivered as an Agent Skill that loads when you describe what you need:
| Step | Skill | Output |
|---|---|---|
| Plan | /st-create-plan <your prompt> | .ai/strikethroo/plans/64--auth/plan-64--auth.md |
| Tasks | /st-generate-tasks 64 | .ai/strikethroo/plans/64--auth/tasks/*.md |
| Execute | /st-execute-blueprint 64 | Working code, one commit per phase |
Human review gates between steps catch scope creep before any code is written. Each step runs with clean context -- the planning agent sees only the work order, the task agent sees only the approved plan, and each execution sub-agent receives only its specific task.
See the Workflow Guide for the full step-by-step with advanced patterns. Once a plan exists, visualize its plans, tasks, and dependency graph in Visualizations.
Strikethroo comes with an optional web application to help you visualize your plans, tasks, and progress. No installation necessary, just execute the following command in a project using Strikethroo:
npx strikethroo serve
This will open a web page that will help you navigate your plans and their tasks, present or archived.
| Plans board | Plan detail page | Archive |
|---|---|---|
![]() | ![]() | ![]() |
FAQs
Task management for AI coding assistants
We found that strikethroo demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.