zuvo
FeaturedAuto-activating, multi-agent skill ecosystem for Claude Code, Codex, and Cursor. 51 skills, 26 agents, quality gates, knowledge store, adversarial review, content writing & optimization.
Install
Plugins install via a marketplace, in two steps.
This plugin isn't listed in a marketplace we've indexed. Install it directly from its GitHub repository — the README has the setup steps.
View on GitHubBundles
Everything this plugin ships — skills, agents, commands, hooks, and MCP servers it bundles.
Skills (52)
a11y-audit
Dedicated WCAG 2.2 AA/AAA accessibility audit across 10 dimensions (A1-A10) covering semantic HTML, keyboard navigation, ARIA patterns, color contrast, forms, images/media, responsive/zoom, motion/animation, reading/content, and legal compliance. Goes far beyond surface-level design-review checks with deep compliance-focused analysis, WCAG criterion mapping, and legal risk assessment (ADA Title II, EAA, Section 508). Critical gates on keyboard (A2) and contrast (A4). Flags: [path] | full | --live-url <url> | --quick | --fix | --standard AA|AAA | --legal ada|eaa|508.
agent-benchmark
Self-benchmark: YOU write the code, adversarial reviews it (multi-provider), you fix, you write tests, adversarial reviews tests, you fix. Measures YOUR quality as an agent. Run in different models (Opus, Sonnet, Haiku) and compare results.
api-audit
API and endpoint integrity audit across 10 dimensions (D1-D10) plus optional contract stability (D11) and optional OWASP API Security Top 10 (D12: BOLA/BOPLA/BFLA, mass assignment, JWT alg-confusion, GraphQL introspection). Covers validation, payloads, pagination, errors, caching, HTTP semantics, waterfalls, rate limiting, auth, documentation, and API-specific authorization security. Supports NestJS, Cloudflare Workers, FastAPI, and frontend call patterns. Optional GET probing on non-production targets. Flags: zuvo:api-audit full | [path] | --static | --security
architecture
Architecture skill with three modes: review existing codebase architecture (A1-A9 dimensions), create Architecture Decision Records, or design new systems from requirements. Modes: --mode review [path], --mode adr, --mode design. Uses CodeSift for module discovery, dependency mapping, structural metrics, and temporal coupling detection.
backlog
Manage the project's tech debt backlog. Add, list, fix, wontfix, delete, prioritize, and suggest batch actions on tracked issues. Used by audit and review skills to persist findings, and directly by users to manage accumulated debt. Modes: list [category], add [description], fix B-{N}, wontfix B-{N} [reason], delete B-{N}, stats, prioritize, suggest.
benchmark
Multi-provider AI coding benchmark. Dispatches a task to Codex, Gemini, Claude, and Cursor-Agent in parallel, scores responses with a Claude meta-judge, and produces a ranked leaderboard with cost, time, quality, and self-eval bias metrics. Supports corpus mode (fixed OrderService + useSearchProducts tasks) for apples-to-apples comparison across runs.
brainstorm
Explores a codebase, researches the problem space, and produces an approved design specification before any code is written. Use when the user wants to create a new feature, add significant functionality, redesign a subsystem, or build something that touches multiple parts of the project.
build
Scoped feature development for changes spanning 1-5 production files. Auto-tiers to LIGHT/STANDARD/DEEP based on risk signals. Flags: --auto (skip plan approval), --auto-commit (commit without confirmation), --tag (create rollback tag).
canary
Post-deploy monitoring with browser or degraded HTTP mode. Checks console errors, performance, page load. Configurable duration (1m-30m) and interval. Reports HEALTHY/DEGRADED/BROKEN. Flags: --duration, --interval, --quick, --max-errors.
ci-audit
CI/CD pipeline audit for speed, cost, reliability, and security. 10 dimensions (CI1-CI10): caching, parallelism, conditional execution, artifacts, secret handling, action pinning, timeouts, Docker optimization, test integration, and pipeline speed. Primary support: GitHub Actions. Detection-level: GitLab CI, CircleCI. Switches: zuvo:ci-audit full | [path] | --speed-only | --security-only
code-audit
Batch audit of production files against CQ1-CQ40 quality gates and CAP1-CAP29 anti-patterns. Tiered output (A/B/C/D), critical gate enforcement, evidence-backed scoring, cross-file pattern analysis, and prioritized execution plan. Flags: zuvo:code-audit all | [path] | [file] | --deep | --quick | --services | --controllers
container-audit
Static Docker/container security audit across 6 dimensions (K1-K6): base image provenance and pinning, privilege and runtime hardening, secret and build-context hygiene, image minimalism and attack surface, known-vulnerability scan (Trivy/Grype), and compose/orchestration hardening. Static-first — parses Dockerfile, Containerfile, and docker-compose (incl. override/merge files) with zero Docker and zero network; the CVE dimension (K5) runs Trivy/Grype only when present, else degrades to N/A. Reserved dimensions K7-K10 (Kubernetes) activate behind --k8s. HEALTHY/NEEDS ATTENTION/AT RISK/CRITICAL grade with critical gates. Distinct from infra-audit (live host daemon over SSH) and ci-audit (Docker build speed in the pipeline). Switches: zuvo:container-audit full | [path] | --static | --scan | --dockerfile <p> | --compose <p> | --quick | --k8s | --persist-backlog
Show all 52 bundled skills Showing all 52 bundled skills
content-audit
Content file quality audit across 8 dimensions (CC1-CC8): encoding artifacts (NBSP, mojibake, zero-width), markdown syntax (broken italic, orphan backslash), CMS migration artifacts (Joomla/WordPress/PHP), frontmatter quality, image integrity, link integrity with anchor validation, content completeness, and spelling/typography. Language-agnostic with multi-encoding mojibake detection. Companion fix skill: content-fix. Flags: [path], --live-url <url>, --quick, --content-path <dir>, --lang <code>, --check-external, --profile <type>, --persist-backlog.
content-expand
Expand and optimize existing articles. Adds new sections, deepens thin content, and applies the same quality pipeline as write-article (anti-slop, BLUF, GEO signals, humanization, multi-schema). Includes web search research about the topic and auto-discovery of internal links from your content collection. Replaces content-optimize. Flags: [file], --dry-run, --lang, --tone, --site-dir, --domain, --skip-research, --light.
content-fix
Apply fixes from content-audit findings. Reads audit JSON, classifies fixes by safety tier (SAFE/MODERATE), applies templates per fix type. Handles encoding artifacts (NBSP, mojibake), broken markdown, CMS migration debris, and typography issues. Modes: default (SAFE only), --auto (SAFE+MODERATE), --dry-run, --finding CC1-nbsp-present, --fix-type encoding-strip.
content-migration
Compare old CMS page with new SSG page after migration. Finds missing headings, paragraphs, images, CTAs, tables, forms. Optionally patches safe gaps in local .md files. Use when content was migrated from Joomla/WordPress/ Drupal to Astro/Hugo/Next.js and you need to verify nothing was lost. Flags: --old <url>, --new <url>, --fix, --source-file <path>, --status.
context-audit
Context health monitoring. Analyzes include loading trends from context-metrics.log, audits CLAUDE.md/rules/settings for bloat, scores setup health. Modes: trend (default), full (with /context data), baseline (save snapshot).
db-audit
Database performance and safety audit. 70+ checks across 13 dimensions (DB1-DB13): query patterns, indexes, schema design, connections, transactions, migrations, caching, query optimization, ORM anti-patterns, observability, data lifecycle, DB security, and migration deployment safety. Code-level checks for all ORMs. Optional live analysis via PostgreSQL or MySQL connection. Switches: zuvo:db-audit full | [path] | [file] | --schema | --queries | --connections | --live <conn>
debug
Systematic bug investigation with a five-phase framework: reproduce, narrow, diagnose, fix, verify. Supports automated regression bisect via --regression flag. Produces a structured debug report with root cause analysis, regression test, and CQ/Q self-evaluations.
dependency-audit
Dependency health and internal coupling audit for Node.js/TypeScript projects. 11 dimensions: supply chain CVEs, supply-chain integrity (typosquat/dependency-confusion/malicious-package/SBOM), freshness, dead dependencies, license compliance, bundle weight, circular dependencies, coupling metrics, architecture boundary violations, barrel file health, and change coupling. Tiered tooling with graceful degradation. Switches: zuvo:dependency-audit full | [path] | --supply-chain | --coupling | --dead | --bundle | --lock-in
deploy
Deploy to production and verify health. Reads ship state, merges PR if applicable, detects platform (Vercel/Fly/Netlify/Railway/Render/GHA), waits for CI, triggers deploy, runs health check, offers rollback on failure. Flags: --url, --skip-ci-wait, --skip-health, #<number>.
design-review
UI/UX design consistency audit. Code-based DX1-DX20 checklist covering states, consistency, accessibility, responsive behavior, and interaction patterns. Optional visual audit via chrome-devtools screenshots and automated WCAG accessibility via axe-core. DAP1-DAP12 anti-pattern detection. Modes: [path], visual, --fix-critical, --dry-run, --max-files, --quick, loop. NOT for code quality (use zuvo:code-audit) or test quality (use zuvo:test-audit).
design
Intent-first UI design with conscious, traceable design decisions. Persists decisions in .interface-design/ for cross-session consistency. Includes domain exploration, design system generation (system.md + system.json), per-component construction with mandatory checkpoints, and craft validation tests. Modes: init, [component], improve [path], extract [path], status, --quick, --dry-run. NOT for auditing existing UI (use zuvo:design-review).
docs
Write and update technical documentation from actual codebase analysis. Generates README, API reference, runbook, onboarding guide, or changelog. Supports update mode that patches stale sections without rewriting from scratch. Modes: readme [path], api [path], runbook [topic], onboarding, update [file], changelog [range].
env-audit
Environment variable and configuration audit. 8 dimensions (ENV1-ENV8): variable completeness, unused vars, startup validation, secret exposure, environment parity, type safety, default values, and documentation. Supports Node.js (.env/process.env), Python (os.environ/settings), and framework-specific patterns (Vite import.meta.env, Next.js NEXT_PUBLIC_). Switches: zuvo:env-audit full | [path] | --secrets-only | --parity
execute
Activated when an implementation plan exists. Executes plan tasks in dependency order (independent, non-same-file tasks may run in parallel batches) with enforced review gates, adversarial validation, and resumable session state.
fix-tests
Batch repair of systematic test quality issues. Detects anti-patterns across the test suite, then fixes one pattern at a time with production context. Modes: --triage (scan all patterns, report counts), --pattern [ID] [path] (fix specific pattern), --dry-run (preview changes), --bundle-gates (fix pattern plus adjacent quality gaps).
geo-audit
GEO (Generative Engine Optimization) readiness audit. Scans source code for AI citation signals across 12 dimensions: AI crawler access, schema graph connectivity, llms.txt, SSR rendering, freshness, chunkability, canonicalization, sitemap, BLUF structure, heading quality, citation signals, and anti-patterns. Produces tiered report (A/B/C/D) with evidence-backed findings and JSON output for geo-fix consumption.
geo-fix
Apply fixes from geo-audit findings. Reads geo-audit JSON, classifies by safety tier (SAFE/MODERATE/DANGEROUS), applies framework-aware code patches for schema, robots.txt, canonical, sitemap, llms.txt, and freshness fixes. Emits content scaffolds for advisory findings. Deduplicates against seo-fix to prevent double-application.
incident
Incident response and postmortem generation from git/deploy context. When something breaks in production, this skill builds a timeline, identifies the probable cause, and generates a structured postmortem document. Flags: --since, --service, --sev, --revert, --comms, --dry-run.
infra-audit
Server / infrastructure security audit of LIVE hosts over SSH (12 dimensions IS1-IS12: SSH hardening, accounts, network exposure, TLS, firewall, patch posture, logging, web services, Docker, databases, filesystem, host secrets). Deterministic collector + parallel LLM analysts; dual-vantage (internal SSH + external via proxy); per-target authorization gate; consent-gated tool installs; read-only with one consented exception. Flags: --host user@addr[:port] (single ad-hoc host), --quick (IS1+IS3+IS4, <3 min/host), --dimensions IS1,IS3,… (explicit subset), --no-install (hard read-only), --dry-run (print commands, no connections), --resume <run-dir> (continue interrupted run), --proxy <url> (external-scan proxy), --external direct (proxyless external scan, polite timing), --skip-external (internal vantage only), --deep-scan (nmap -p- full port sweep), --confirm-targets <sha256> (non-interactive authorization).
leads
B2B lead discovery and enrichment skill. Finds company addresses, employee emails, and phone numbers filtered by industry, geography, role, and company size. 100% free-tier: orchestrates Claude Code's native WebSearch and WebFetch plus free OSINT subprocesses (theHarvester, crt.sh, whois, GitHub API, OSM Overpass, DNS MX, bash SMTP probe). No paid API keys required — optional env vars (ZUVO_HUNTER_KEY, ZUVO_APOLLO_KEY, ZUVO_GITHUB_TOKEN) are recognized as enhancers but never required. Hybrid mode: supplying --domains triggers enrichment; --industry + --geo triggers discovery. Interactive checkpoints after Phase 1 and Phase 2. Output: CSV + JSON + Markdown in docs/leads/. Optional --gdpr-strict for EU/EEA compliance.
mutation-test
Mutation testing with two engines. Uses the project's NATIVE mutation runner (StrykerJS / Infection / mutmut / PIT / cargo-mutants) when one is configured — installing it on explicit consent when it is not — for a reproducible, comparable score; and an LLM-guided engine for the mutation classes native mutators cannot express: error-path removal, state mutation, async hazards, and security guard removal. Generates mutations, executes them against the relevant tests, and FIXES the tests whose gaps let a mutation survive — surviving mutants are closed in-run, not handed to another skill. Emits the cross-tool stryker-mutator.io/report.schema.json report alongside its own artifact. Flags: [path] (scope), full, --max N, --category, --runner auto|native|llm|hybrid, --break N, --no-install, --dry-run, --quick, --report-only.
pentest
Hybrid white-box + black-box penetration testing across 7 dimensions (PT1-PT7). Stack-aware source-to-sink tracing, exploit verification, CMS overlay, and deterministic finding aggregation. Uses explicit candidate schemas, canonical-key deduplication, score caps, and MUST-GATE enforcement. Flags: zuvo:pentest [path] | --url <url> | --from-audit <dir> | --cms <type> | --quick | --scope <path> | --dimensions PT1,PT2 | --verify-live | --rate <N> | --source | --runtime
performance-audit
Full-stack performance health check across 12 dimensions. Rendering, bundles, assets, API/network, algorithms, memory, database, caching, Web Vitals, backend runtime, concurrency, and framework-specific pathologies. Evidence-based Impact Models with confidence tiers and a prioritized optimization roadmap. Switches: zuvo:performance-audit full | [path] | [file] | --frontend | --backend | --db | --bundle
plan
Analyzes architecture, selects patterns, assesses testability, then decomposes work into ordered TDD tasks with exact verification commands and explicit acceptance mapping. Works from an approved spec (zuvo:brainstorm output) or directly from a user-provided description.
presentation
Generate PowerPoint (PPTX) presentations from a topic, outline, or content file. Creates professional slides using python-pptx with consistent theming and typography. Modes: [topic] (from scratch), from [file] (from markdown), --slides N, --theme dark|light|corporate, --outline-only, --out [path], --lang [code].
profile-session
Answers "why was that session slow?" from the agent transcript's own timestamps. Attributes wall-clock time to categories (tests/build, subagent dispatch, adversarial review, model thinking, stalls, user-away), ranks the biggest gaps, and names the specific commands behind them. Reads Claude Code session JSONL and Codex rollout JSONL. Modes: [transcript], --last, --skill <name>, --since <iso>, --compare <a> <b>.
receive-review
Process code review feedback with technical rigor. Activates when the user shares review comments, PR feedback, or asks to address reviewer suggestions.
refactor
Structured refactoring runner with ETAP workflow, resumable CONTRACT, and batch processing. Use when restructuring code, extracting methods, splitting files, breaking circular dependencies, or cleaning up god classes. NOT for new features (use zuvo:build). Execution modes: full (default), batch <file> (queue processing). Control flags: plan-only, no-commit, continue.
release-docs
Diff-driven documentation sync after a release. Determines what source files changed, delegates changelog to zuvo:docs, updates only docs whose source changed. Flags: --dry-run, explicit range argument.
retro
Engineering retrospective from git metrics. Reports deployment frequency, release cycle span, churn hotspots, backlog health. Outputs narrative report with 3+ actionable items. Flags: --since, --path, explicit range argument.
review
Structured code review with parallel audit agents, confidence-scored triage, and optional auto-fix. Examines uncommitted changes, staged diffs, commit ranges, or specific paths. Produces a tiered report (MUST-FIX / RECOMMENDED / NIT) backed by evidence, then optionally applies fixes with verification.
security-audit
Application security audit covering OWASP Top 10, injection, XSS, SSRF, auth/authz, multi-tenant isolation, secrets, headers, dependencies, business logic, infrastructure, and AI/LLM + MCP tool-invocation security (S15, incl. tool poisoning and confused-deputy). Uses Sentry 3-tier confidence model. Supports Next.js, NestJS, Express, FastAPI, Django, Flask. Dual scoring: static posture + runtime exploitability. Flags: zuvo:security-audit [path] | full | --live-url <url> | --static | --quick | --persist-backlog
seo-audit
SEO/GEO site audit covering 13 dimensions with 6 critical gates. Scans source code, templates, and config files across meta tags, structured data, AI crawlers, content quality, GEO readiness, performance, and optional live Core Web Vitals. Framework-aware: Astro, Next.js, Hugo, WordPress, React, plain HTML. Flags: full (default), [path], --live-url <url>, --quick, --content-only, --geo, --profile <marketing|docs|blog|ecommerce|app-shell>, --content-profile auto|marketing|docs|blog|ecommerce|app-shell, --live-sample-bots <default|all|bot1,bot2>, --persist-backlog.
seo-fix
Apply fixes from seo-audit findings. Reads audit JSON, classifies fixes by safety tier (SAFE/MODERATE/DANGEROUS), applies templates per framework. Supports Astro, Next.js, Hugo. Modes: default (SAFE only), --auto (SAFE+MODERATE), --all (all tiers, requires confirmation), --dry-run, --finding F1,F3, --fix-type sitemap-add,robots-fix,schema-cleanup.
ship
Pre-merge release pipeline: run tests, auto-scaled code review, version bump, changelog generation, git tag, push or PR. Auto-detects branch context (direct push on main, PR on feature branch). Scales review depth by diff size. Flags: --full, --no-bump, --no-tag, --dry-run, patch/minor/major.
skill-eval
Behavioral evaluator for zuvo skills. Runs a skill against its eval corpus (evals/<skill>.evals.json) in fresh executor sub-agents, grades each run transcript against the corpus assertions with an injection-hardened grader, and writes a per-assertion pass/fail report to zuvo/reports/. Supports old-vs-new comparison via --compare <ref>. Dev-only (needs the repo's evals/ + .git).
structure-audit
Codebase structure and organization audit across 13 dimensions (SA1-SA13): directory consistency, naming conventions, folder depth, colocation, barrel exports, separation of concerns, file size distribution, dead code, complexity distribution, duplication, root organization, documentation, hotspots. Tool-driven with CodeSift primary and CLI fallbacks (cloc, knip, dep-cruiser, jscpd, eslint, git mining). Flags: full (default), [path], --naming, --size, --dead-code, --duplication, --hotspots, --quick, --fix.
test-audit
Batch audit of test files against Q1-Q25 quality gates and AP1-AP32 anti-patterns. Detects orphan tests, phantom mocks, untested public methods. Tiered output (A/B/C/D) with critical gate enforcement and optional post-audit fix workflow. Flags: zuvo:test-audit all | [path] | [file] | --deep | --quick | --include-e2e | --details | --commit=ask|auto|off
tests-performance
Test suite performance audit and optimization. Measures baseline timing, audits runner configuration against TP1-TP17 checklist, identifies the slowest tests, and produces an impact-ranked action plan. Modes: full audit (default), baseline (measure only), verify (compare to saved baseline), --no-run (config audit only), --path <dir> (monorepo scope).
ui-design-team
Multi-agent UI review with 4 specialist perspectives: UX Researcher, Visual Designer, i18n/Multilingual QA, and Accessibility/Performance Auditor. Each agent scores independently from their expertise. Lead Designer synthesizes into prioritized fixes with exact code. Works with any stack: React, Astro, vanilla HTML/CSS, Tailwind, CSS-in-JS. Flags: [file/path], --screenshot, --mobile, --fix.
Hooks (28)
Quality Score: 74/100
Details
- Author
- greglas75
- Repository
- greglas75/zuvo
- Created
- 5 months ago
- Last Updated
- 4 days ago
- Language
- Shell
- License
- MIT