agentmods.dev

sdlc

sdlc is a plugin for Claude Code from XRenSiu/claude-code-forge. Its manifest loads nothing; the 14 skills, 5 agents it bundles cost 4,406 tokens per session together, scanned A, original, MIT.

A software delivery system covering requirements, implementation, commits, pull requests, review, and acceptance. It uses written rules and automated checks, with specified points where a person must make the final decision.

In plain words
What is it for?
Use it to turn a bug or requirement into a tracked issue, implement it in controlled pieces, create auditable commits and pull requests, and verify the result.
Why use it?
It reduces missed checks, unclear requirements, oversized changes, unsafe commits, and review decisions that are not backed by evidence.

Plugin for Claude Code

Written for Claude Code: a Claude Code plugin manifest.

not rated 2 yesterday A scan tokens not measured original MIT
View the source file XRenSiu/claude-code-forge
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Claude Code
/plugin marketplace add XRenSiu/claude-code-forge
agentmods
npx agentmods add plugins/xrensiu/claude-code-forge/sdlc
Clone the repo
git clone --depth 1 https://github.com/XRenSiu/claude-code-forge

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for sdlc

README.md
[![agentmods](https://agentmods.dev/badge/plugins/xrensiu/claude-code-forge/sdlc.svg)](https://agentmods.dev/plugins/xrensiu/claude-code-forge/sdlc)
Your own site
<a href="https://agentmods.dev/plugins/xrensiu/claude-code-forge/sdlc"><img src="https://agentmods.dev/badge/plugins/xrensiu/claude-code-forge/sdlc.svg" alt="Measured on agentmods" height="20"></a>
Per session not measured What this adds to a session before it is invoked.
When invoked not measured The manifest loads nothing itself; its 14 skills, 5 agents cost 4,406 tokens a session between them.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Security

Grade A, and why

sdlc scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/sdlc/.claude-plugin/plugin.json · 74 lines

How it starts

The opening of the file, as written. The whole thing — 74 lines — stays where its author put it; the contents beside it link to each section on GitHub.

{
  "name": "sdlc",
  "description": "SDLC — the complete software development lifecycle as gaps the engine cannot fill on its own (skillwise four-atom discipline: Knowledge / Capability / Judgment / Control, no step-marches). Twenty-seven skills organised as nine rings + a spine (docs/ARCHITECTURE.md). Delivery spine (original): `/sdlc` (lifecycle orchestrator: SKILL.state-style state file whose transitions are validated by a script, WikiSkill-style append-only ledger, routing.yaml with per-layer budgets + fingerprint termination, three human-only gates G1 world-adjudication / G2 done_when hash-freeze / G3 exception review), `/issue` (requirement or bug → falsifiable GitHub issue: PSL-vs-TASK dual track, DOS vocabulary closure, acceptance in done_when-v2 shape gated by verify_issue.py), `/commit` (atomic Conventional Commit gated by verify_commit.py: message grammar, card whitelist, G2 lock hash, secret + debug-code scan), `/pr` (PR body in product order with AC→evidence mapping, size classes, XL must split; verify_pr.py), `/review-loop` (zero-token blocking wait via pr-poll.sh, reviewer comments as claims to verify, ACCEPT/REJECT/REPLY/ESCALATE/SKIPPED, reply-before-resolve, per-thread strikes, compiled termination; adapted from vana-builder), `/pr-review` (Detective Loop, reproduction for P0/P1, 5-finding cap, A/B/C tiers, posts a GitHub review, never approves), `/plan-cards` (L4: contract → self-contained task cards, lint_cards.py), `/implement` (L6: isolated implementer sees only card + AC subset + red baseline; whitelist executor; fingerprint escalation), `/release` (L8 delivery: SemVer from commits, changelog ↔ tag ↔ notes consistency, rollback before deploy, verified-green before done; verify_release.py), `/retro` (X3 learning: baseline → reflow distribution → proposals routed to psl / dos / invariant / ac / routing / skill; metrics.py). Single contract schema: done_when.yaml v2 (AC-first, v1 superset) validated by validate_done_when_v2.py inside `advance g2

Read the full file on GitHub · 74 lines

Contents

What it installs

The manifest is a name and a version. 14 skills, 5 agents travel with it, and installing the plugin installs all of them — 4,406 tokens a session between them. Each is measured on its own page, and each can be installed alone.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 74 lines scan A 4d2ff27c79c4

Subscribe to this mod's changes

sdlc is a plugin published in the GitHub repository XRenSiu/claude-code-forge (2 stars, last pushed yesterday), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.

CommitsGit and workflowProject management
Related

Other plugins, from other repositories

aidd-vcs

External artifacts: repo-init, commit, pull-request, release-tag, issue-create.

ai-driven-dev/framework · not measured

comfyui-plugin

ComfyUI custom-node pack lifecycle - scaffold a pack, create + seed the repo, open the gitops adoption PR, publish to the Comfy Registry, and add README screenshots.

laurigates/claude-plugins · not measured

release-conductor

Owns everything around the diff: craft Conventional Commits and PR descriptions, recommend the right semver bump by reasoning about behavioral breaking changes, assemble changelogs from messy history, and guide merge-conflict resolution, rebase planning, and git-history archaeology.

sigistry/marketplace · not measured

obsidian-tracker

Project tracking, task management with kanban boards, bug logging, decision records (ADR), session management, and engineering traceability via Obsidian. Auto-tracks sessions, actions, bugs, and commits via hooks.

IvanLutsenko/awac-ai-agent-plugins · not measured

bitwarden-delivery-tools

Delivery lifecycle skills for Bitwarden initiatives — initiative funnel navigation, work transitions, architectural judgment, commits, pull requests, preflight checks, change labeling, and Jira ticket filing.

bitwarden/ai-plugins · not measured

action

Convert tickets to branches in isolated worktrees. Uses team branch conventions, lands gated commits, and supports parallel tickets.

tony/skills · not measured