agent-security-hardening
AFaffaan-m/ECC278k4,046 new stars in the last 7 days
5 expert personas debate proposed changes before implementation. Catches architectural, security, performance, and UX issues early. Use before major features or risky changes.
Output style: Follow
process/development-protocols/communication-standards.md— answer-first, plain language, no unexplained jargon, TL;DR on long responses.
Five expert personas independently analyze a proposed change, then debate conflicts to produce a consensus verdict before a single line of code is written.
debugger for bugs, generate-plan / plan-agent for already-decided tasks)vc-predict runs in Simple or Deep mode. Choose based on the conditions below.
| Simple | Deep | |
|---|---|---|
| Context source | Approach description already in context | Approach description + historical research subagent |
| Subagent spawned | No | Yes — reads git log, prior reports, test failure history |
| Persona debate quality | Reasons from first principles | "We tried this 3 months ago and hit X" |
| When to use | Contained feature, clear scope, no prior attempts | See trigger conditions below |
--deep flag or "use deep predict")Before the 5-persona debate, spawn a research subagent that performs the following steps in order:
git log --oneline --all -- [relevant files] for each file or directory the approach touches. Flag any commits within the last 6 months that suggest a prior attempt, revert, or known fix.process/features/{feature}/active/ and process/features/{feature}/completed/ for _REPORT_ files mentioning this surface (pattern: active/{slug}_{date}/{slug}_REPORT_{date}.md). Read any that contain keywords from the approach (e.g. "streaming", "SSE", "auth", "billing", "container lifecycle"). Legacy sibling reports/ dir may also exist — scan it too if present.FAIL or Error patterns on relevant module names. Note recurring failures.The 5 personas then receive this Historical Context block before their independent analysis phase. Each persona incorporates it when relevant.
Simple predict (no research):
"Senior dev: this streaming approach could cause a memory leak in the SSE proxy."
Deep predict (with historical research):
"Senior dev: we tried this exact streaming approach in commit
a3f921(2026-03-15) — it caused a memory leak in the SSE proxy because the Bun response body was never released on client disconnect. The current proposal has the same pattern inpackages/api/src/routes/gateway-proxy.tsline 84. The fix at the time was adding anAbortControllerlistener; verify that is still present or re-apply."
| Persona | Focus | Core Questions |
|---|---|---|
| Architect | System design, scalability, coupling | Does this fit the architecture? Will it scale? What new coupling does it introduce? |
| Security | Attack surface, data protection, auth | What can be abused? Where is data exposed? Are auth boundaries respected? |
| Performance | Latency, memory, queries, bundle size | What is the latency impact? N+1 queries? Memory leaks? Bundle bloat? |
| UX | User experience, accessibility, error states | Is this intuitive? What does the error state look like? Accessible on mobile? |
| Devil's Advocate | Hidden assumptions, simpler alternatives | Why not do nothing? What is the simplest alternative? Which assumption could be wrong? |
## Prediction Report: [proposal title]
## Verdict: GO | CAUTION | STOP
### Agreements (all personas align)
- [Point 1 — what they all agree on]
- [Point 2]
### Conflicts & Resolutions
| Topic | Architect | Security | Performance | UX | Devil's Advocate | Resolution |
|-------|-----------|----------|-------------|-----|-----------------|------------|
| [Issue] | [View] | [View] | [View] | [View] | [View] | [Recommendation] |
### Risk Summary
| Risk | Severity | Mitigation |
|------|----------|------------|
| [Risk description] | Critical/High/Medium/Low | [Concrete action] |
### Recommendations
1. [Action item — rationale]
2. [Action item — rationale]
3. [Action item — rationale]
| Verdict | Meaning |
|---|---|
| GO | All personas aligned, no critical risks, proceed with confidence |
| CAUTION | Concerns exist but are manageable — mitigations identified, proceed carefully |
| STOP | Critical unresolved issue found — needs redesign or more information before proceeding |
| Workflow Step | Skill | How |
|---|---|---|
| Deepen risk scenarios | vc-scenario | Feed Risk Summary rows as feature description |
| Create implementation plan | generate-plan / plan-agent | Attach Recommendations as constraints to the canonical planning path |
| High-risk feature implementation | execute-agent | Reference CAUTION/STOP items as acceptance gates |
/vc-predict "Add WebSocket support for real-time notifications"
/vc-predict "Migrate authentication from JWT to session cookies"
/vc-predict "Add multi-tenancy to the database layer"
/vc-predict "Replace REST API with GraphQL" --files src/api/**/*.ts
/vc-predict "Rework SSE streaming for chat responses" --deep
/vc-predict "Change container lifecycle on instance stop" --deep --files packages/api/src/infra/**/*.ts
/vc-predict "Refactor billing credit deduction" --deep
Deep mode is also auto-triggered (no flag needed) when the plan is COMPLEX shape or the approach touches auth, billing, container lifecycle, or streaming surfaces.
AFaffaan-m/ECC278k4,046 new stars in the last 7 days
DIDietrichGebert/ponytail162k5,405 new stars in the last 7 days
DIDietrichGebert/ponytail162k5,405 new stars in the last 7 days
DIDietrichGebert/ponytail162k5,405 new stars in the last 7 days
GAgarrytan/gstack136k883 new stars in the last 7 days
Harden code against the OWASP Top 10: input handling, authentication, sessions and dependencies.
ADaddyosmani/agent-skills106k3,628 new stars in the last 7 days