mjmetter

Sdlc Skill — Security skill for Claude Code

Security community

End-to-end SDLC orchestrator skill for Claude Code.

How to install Sdlc Skill

This entry records only its repository, not the path inside it, so there is no exact command to give. Open mjmetter/sdlc-skill and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Sdlc Skill does

End-to-end SDLC orchestrator skill for Claude Code. Drives one development task from brainstorm → plan → implement → security review → quality gate → commit → pull request, using model-optimized subagents at each phase and the gh CLI for GitHub. Optional JIRA integration. Step-by-step or autonomous run modes.

Alternatives in Security

Defense In Depth — Implement multi-layered testing and security best practices 98.1k ★
Token Scan — Meme coin and token security scan — checks for rug pull vectors (hidden mint, honeypot, fee manipulation, LP l 3.8k ★
Octoboss Clean Contexts — You are the Octoboss — a cross-tentacle orchestrator 1.4k ★

README

SDLC Orchestrator Skill

Runs the full development workflow end-to-end — from a problem statement (or optional JIRA ticket) to a merged pull request — using model-optimised agents at each phase.

Extracted from internal work at Bloomreach and published with permission; history squashed for confidentiality.

Invoke

/sdlc PROJ-123
/sdlc fix the cache invalidation bug in the metrics pipeline
/sdlc

Accepts a JIRA ticket key, a free-text problem description, or nothing (prompts interactively).

What you get

Phase	What happens
0 Bootstrap	Reads CLAUDE.md, detects language / build command / test presence, writes `conductor/tech-stack.md`
1 JIRA (optional)	If JIRA is configured: links to an existing ticket, creates a new one, or looks up a key you provide. Skipped entirely when JIRA is not configured.
2 Brainstorm	Explores the codebase, proposes 2–3 approaches with trade-offs, agrees direction with you
3 Planning	Opus subagent writes a detailed plan to `.claude/plans/` covering approach, tests, and PR description
4 Implementation	Sonnet subagent implements the plan (writes failing tests first when a test suite exists), runs the build — up to 3 fix-and-retry cycles
5 Security Review	Conditional: spawns a security agent if the diff touches HTTP calls, secrets, shell construction, or untrusted data parsing
6 Quality Gate	Runs `/simplify` then `/review`, applies fixes, confirms build is still green
7 Commit & PR	You approve the diff, then the skill commits, opens the PR via `gh`, and monitors CI + review threads

Two run modes

After the plan is presented you choose how to proceed:

Autonomous — a single subagent runs Phases 4–6 unattended and reports back. You approve the diff once before anything is committed.
Step-by-step — each phase runs with a checkpoint, giving you full visibility and control at every stage.