What is dev-workflows?

A set of slash commands and review agents for moving a software product from an idea through requirements, design, implementation, documentation, and release. It also turns business requirements documents into product and engineering documents.

Use it to create and update product requirements, architecture decisions, specifications, designs, implementation plans, documentation, security reviews, and release notes.

Product work can become fragmented when plans, specifications, code, and release preparation are handled separately. The workflow connects these stages and checks each handoff before the next one begins.

dev-workflows — Plugin for Claude Code by ihudak/ihudak-claude-plugins

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo

git clone --depth 1 https://github.com/ihudak/ihudak-claude-plugins

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/plugins/ihudak/ihudak-claude-plugins/dev-workflows/github.svg)](https://agentmods.dev/plugins/ihudak/ihudak-claude-plugins/dev-workflows)

Your own site

<a href="https://agentmods.dev/plugins/ihudak/ihudak-claude-plugins/dev-workflows"><img src="https://agentmods.dev/badge/plugins/ihudak/ihudak-claude-plugins/dev-workflows/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/plugins/ihudak/ihudak-claude-plugins/dev-workflows"><img src="https://agentmods.dev/badge/plugins/ihudak/ihudak-claude-plugins/dev-workflows.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session not measured What this adds to a session before it is invoked.

When invoked not measured The manifest loads nothing itself; its 5 commands, 12 agents, 1 hook cost 1,416 tokens a session between them.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Security

Grade A, and why

dev-workflows scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 23d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/dev-workflows/.claude-plugin/plugin.json · 28 lines

What it actually says

{
  "name": "dev-workflows",
  "version": "4.2.3",
  "description": "Five slash commands for the implementation half of the product lifecycle: `/design` turns a specification into a design, with Opus review and an optional three-take fan-out on a contested interface. `/implement` builds it, gated by Opus plan critique and code review before tests. `/ready` verifies an ARD/spec/design chain's readiness, read-only, no tracker read. `/upgrade` plans and executes dependency upgrades; `/vuln` researches and fixes a CVE. Twelve subagents, one hook, fifteen reference files, no bundled skill. Every code-changing command commits before the run ends; push and PR sit behind one consent choice. Depends on the companion `workflows-core` plugin for its shared foundation. The product-definition ladder, `/epics`, and the BRD-to-PRD route now ship in `product-workflows`; documentation commands ship in `docs-workflows`. Neither is a dependency.",
  "author": {
    "name": "Ivan Gudak",
    "email": "[email protected]"
  },
  "homepage": "https://github.com/ihudak/ihudak-claude-plugins/tree/main/plugins/dev-workflows",
  "repository": "https://github.com/ihudak/ihudak-claude-plugins",
  "license": "MIT",
  "dependencies": [
    "workflows-core"
  ],
  "keywords": [
    "implement",
    "design",
    "ready",
    "vuln",
    "upgrade",
    "development",
    "workflow",
    "security",
    "dependencies",
    "value-increment"
  ]
}

Contents

What it installs

The manifest is a name and a version. 5 commands, 12 agents, 1 hook travel with it, and installing the plugin installs all of them — 1,416 tokens a session between them. Each is measured on its own page, and each can be installed alone.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

23d ago Changed 28e5262fc7b6
24d ago Changed 3d83fb7caeb0
28d ago Changed a1340a8d9598
1mo ago Changed a97da3643304
1mo ago Changed · -1 lines 419e18a7ffa9
1mo ago Changed · +1 lines 1f549d5d6ca1
1mo ago First seen · 28 lines scan A 71913ec0b829

Subscribe to this mod's changes

dev-workflows is a plugin published in the GitHub repository ihudak/ihudak-claude-plugins (2 stars, last pushed 24d ago), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Building agents Claude Code Planning ai-agents ai-code-review claude-code-plugins developer-productivity documentation-automation

review-gate

Native Claude Code AI code review + blocking pre-push gate on your Claude subscription. Isolated headless reviewer, severity/confidence verdicts, fails closed. open-code-review, done compliantly.

Jose-Ribeir/claude-code-review-gate · not measured

handbook-agent-spec-kit

Spec-driven development workflow system with structured phases: Requirements → Design → Tasks → Implementation.

NikiforovAll/claude-code-rules · not measured

sound

Code taste as installable rules. Probe a repo's stack, select only the rules its code shows a surface for (evidence-cited per rule), confirm, and scaffold a browsable .claude/sound/ rule map (surfaced by the sound:prime skill). Installed rules are user-owned; re-runs reconcile.

saadshahd/moo.md · not measured

smk marketplace

Plugin marketplace listing 13 plugins: cursor-delegate, spring-clean, portal-skills, readable, decode.

smk-labs/claude-plugins · not measured

jira-pack

Issue-tracker pack: /jira-fix takes a ticket link of any type, verifies tracker access, classifies it as a defect or a change, reproduces the defect or writes a failing acceptance test for the change, routes the work to core executors, comments back with evidence and moves the ticket to the QA column. Opt-in; requires.

atretyak1985/swarmery · not measured

mem-rescue

Diagnose and fix memory pressure (full swap, crashing browser tabs) in one or two commands. macOS first, Linux best-effort. Agent-agnostic SKILL.md plus two bundled scripts.

jontsai/claude-plugins · not measured