[Issues](https://git.evandro.dev.br/evandro/dev-workflows/issues) · [Skills inventory](docs/SKILLS.md) · [Vendored skills notice](skills/NOTICE.md) · [Contributing](CONTRIBUTING.md)
**English** · [Português (BR)](README.pt-BR.md)
Harness output after installing the workflows and the vendored skills in the Hermes layout (real run; `impeccable` is a third-party skill that was not installed, so the harness exits 1):
```console
$ cd qa && python wf_quality_harness.py
wf-frontend score= 385.5 refs=18 sem_match=['impeccable'] fases_sem_verif=[]
wf-backend score= 424.0 refs=15 sem_match=[] fases_sem_verif=[]
wf-architecture score= 413.7 refs=11 sem_match=[] fases_sem_verif=[]
wf-security-review score= 390.0 refs=14 sem_match=[] fases_sem_verif=[]
TOTAL: 1613.2 / 400.0 (403.3%)
```
## What it is
Five agent workflows written as standard `SKILL.md` files. The `description` in each frontmatter is the trigger, so the workflow loads when the agent's context matches it. The workflow bodies are in Portuguese.
| Workflow | File | Phases | Covers |
|---|---|---|---|
| Frontend / UI | [`wf-frontend.md`](workflows/wf-frontend.md) | DESIGN, BUILD, REVIEW | Design direction before code, anti-AI-slop, React performance, visual QA for PDFs |
| Backend / API | [`wf-backend.md`](workflows/wf-backend.md) | PLAN, BUILD, SECURITY, TEST + BUG HUNT | Contract before handler, safe defaults, OWASP audit, tests and adversarial bug hunt |
| Architecture | [`wf-architecture.md`](workflows/wf-architecture.md) | REQUIREMENTS, DESIGN, DOCS, REVIEW | Measurable requirements, C4 diagrams, ADRs, threat modeling |
| Security review | [`wf-security-review.md`](workflows/wf-security-review.md) | SCOPE, HUNT, CONSULT, CODE REVIEW, REPORT + GATE | Front and back code review, known CVEs and a live lookup of new ones |
| README | [`wf-readme.md`](workflows/wf-readme.md) | SCAN, CLASSIFY, AUDIT or DRAFT, GENERATE, VERIFY + VALIDATE | Create, audit or rewrite READMEs grounded in real repo facts |
The repository also vendors ten security skills under [`skills/`](skills/NOTICE.md) and ships a QA harness under [`qa/`](qa).
## Why use it
Agents generate code well and admit ignorance badly. Each workflow makes the agent prove the work at every phase:
- **Verification steps:** run the build, run the tests, hit the API, consult the registry.
- **Acceptance criteria:** checkbox gates that must be marked before a phase closes.
- **Hard rules:** "never merge with a red build", "never claim 'no CVE' without querying OSV.dev".
Do not use it if you want self-contained skills. The frontend, backend, architecture and README workflows load third-party skills that are not in this repository, the security workflow also expects two local skills that are not vendored, and the QA harness only reads the Hermes Agent layout.
## How it works
The security workflow is built on one fact: a model's knowledge of CVEs stops at its training date, so "no vulnerabilities" from memory is a guess.
1. **SCOPE** defines the target before auditing.
2. **HUNT** checks known CVEs in the dependencies (`safedeps` queries OSV.dev for a `package@version`).
3. **CONSULT** looks up new vulnerabilities in live sources: OSV.dev, GitHub Advisory DB and NVD.
4. **CODE REVIEW** reviews front and back code against OWASP Top 10 and ASVS.
5. **REPORT + GATE** delivers the report with sources and date stamped, then decides.
The QA harness scores `wf-frontend`, `wf-backend`, `wf-architecture` and `wf-security-review` (not `wf-readme`) on 30+ static criteria extracted from each `SKILL.md`: structure, numbered steps per phase, verification verbs, referenced skills and AI-isms density. `test_tests.py` holds meta-tests that break the harness on purpose and check that the score changes.