Skip to content
Open source · Claude Code plugin

Four engineering skills, one plugin.

ttt-workflows bundles pr-review, sec-audit, trp, and copy-audit: four self-contained skills that review a pull request, run a security audit, deliver a ticket, or audit the copy end to end, from inside Claude Code. Read-only by default; anything that writes waits for your approval.

/plugin marketplace add kaelys-js/ttt-workflows
/plugin install ttt-workflows
How it works ·View on GitHub (opens in a new tab)
Read-only by default Writes are approval-gated Any repo, any tenant Open source

Four skills

Each is self-contained and portable across any repo and any tenant, with no client data baked in.

pr-review
/pr-review
Give it a GitHub or Azure DevOps pull-request URL. It reviews the diff — design and correctness first — checks every finding against the code, and labels each by severity. It drops weak findings before returning the review, so what you get is worth acting on.
designcorrectnesssecuritytests
What it produces One review you can paste straight into the PR: a verdict up top, a table of findings you can scan in seconds, and a concrete fix for each.
Read-onlyNever posts, comments, approves, or merges. You paste the result.
sec-audit
/sec-audit
Audits a repo, a PR, a path, or your live Azure, Entra, and Azure DevOps. It looks where vulnerabilities hide — the code and its infrastructure, the running cloud, and who can reach it. Four modes take a finding from discovery to a fix.
sweepreviewpocremediate
What it produces Scored findings (CVSS 4.0 and CWE), a private advisory for each, a proof-of-concept you can reproduce and throw away, and a report that lists what was and was not covered.
Approval-gatedRead-only until you approve. A fix is a PR opened, never merged.
trp
/trp
Takes a ticket from assigned to merged. It grounds the work in your code, presents a full plan, and stops for your approval. Once you approve, it implements, runs the gates (format, lint, affected tests, build), and opens the PR.
groundplanbuildverifyship
What it produces A merge-ready PR that meets the acceptance criteria, plus a two-layer ticket update for the business and for engineers.
Approval-gatedWaits for your approval. No branch and no write happen before you approve.
copy-audit
/copy-audit
Point it at a repo or a diff and it audits the words: UI microcopy, docs, markdown prose, JSON and YAML copy. Parallel reviewers judge each string in its full-file context against four content pillars. In comment mode, it turns the same lens on code-comment slop and test names.
plain-languageinclusivemicrocopyvoice
What it produces A reviewed set of verdicts — keep, rewrite, flag, delete — with the exact rewrite for each. Applying one splices only the text, so a verify pass can prove not a single line of code moved.
Approval-gatedReads and proposes. Nothing is written to disk until you approve the rewrites.

Install once

Two commands in Claude Code, then invoke a skill whenever you need it.

1

Add the marketplace

Point Claude Code at the git-backed marketplace once. It stays available for every project.

/plugin marketplace add kaelys-js/ttt-workflows
2

Install the plugin

Install ttt-workflows and all four skills register at once. Nothing else to set up.

/plugin install ttt-workflows
Then invoke a skill
  • /pr-reviewPaste a pull-request URL and ask for a review.
  • /sec-auditPoint it at a repo, a PR, a path, or a live tenant, and name a mode: sweep, review, poc, or remediate.
  • /trpHand it a ticket URL; it grounds the work, presents a plan, and stops for approval.
  • /copy-auditPoint it at a repo or a diff for a copy and microcopy pass; add --mode=comments to sweep code comments and test names.

Watch each skill run

A short, synthetic run of each skill, played inside a Claude Code session — the same transcript, with motion off.

pr-review reads the diff, proves each finding, and hands back one paste-ready review.
sec-audit sweeps all three layers and scores what it finds.
trp presents the plan and stops. The approval gate is absolute.
copy-audit weighs every string and rewrites only the words.

Operator's playbooks

Each skill ships a companion PDF: the what, how, and why of doing that work by hand.

PR Review
Read every changed line, prove what you find, and hand back one review that lands in a single round. How to do a senior PR review by hand.
Open the PDF
Security Audit
Look in all three places a vulnerability hides, prove what you find, and never touch a live system until it is approved. The full manual method.
Open the PDF
Task Resolution Protocol
Take a ticket from assigned to merged: ground it in the code, get the plan approved, then build, prove, and close it out.
Open the PDF
Copy Audit
Read every string a repo ships, judge it against the four content pillars, and rewrite only the words — never the code around them. How to do a copy review by hand.
Open the PDF

Questions

What is ttt-workflows?
A plugin for Claude Code. It bundles four self-contained skills (pr-review, sec-audit, trp, and copy-audit) that you invoke inside a Claude Code session. It is not an app, and there is nothing to download and run. You install it from a marketplace and call a skill by pasting a URL, a ticket, or a repo path.
Do I have to trust it with my repo?
It reads whatever you point it at (a PR, a repo, a path, or live cloud state) to do its work. Nothing is baked in: no client data, no hardcoded tenants. It runs in your own Claude Code session against the things you name. The source is open, so you can read exactly what each skill does before you run it.
Is it really read-only?
By default, yes. pr-review only hands you a paste-ready review — it never posts, comments, approves, or merges. sec-audit reads your code and cloud read-only. Anything that writes a repo, creates cloud resources, or opens a PR waits for your approval, and a fix is a PR opened, never merged. trp presents a plan and stops. copy-audit proposes rewrites and writes nothing to disk until you approve. Nothing you can't undo happens before you say yes.
Does it work on GitHub and Azure DevOps?
Both. pr-review takes a github.com or dev.azure.com pull-request URL; trp detects the platform from the repo's remote and routes accordingly; sec-audit resolves a repo or PR on either host. The platform is detected for you; you do not configure it.
How do updates work through the marketplace?
You get a new version only when we publish one. Third-party marketplaces do not auto-update by default, so pull the latest with "/plugin marketplace update ttt-workflows" and then "/reload-plugins". Or turn on auto-update, and Claude Code refreshes it in the background and prompts you to reload. Either way, you choose when to install.
What does copy-audit review, and how does it avoid breaking code?
It audits the words a repo ships: UI microcopy, markdown docs and prose, and copy values in JSON and YAML. Each is judged against four content pillars — plain language, inclusive language, UX microcopy, and voice and grammar. With --mode=comments it turns the same lens on code-comment slop and test names instead. Each string is judged in its full-file context and gets one verdict: keep, rewrite, flag, or delete. When you apply a rewrite, only the text changes — the code around it stays exactly as it was, and a check confirms it. You review every proposed rewrite before anything is written to disk.
Is my data sent anywhere?
There is no telemetry and no phone-home in the plugin. Each skill works within your Claude Code session against the targets you give it, using the tools already on your machine (git, gh, az, the scanners). Working files are written to a scratch directory, never into the repo you are auditing or reviewing.
Add it to Claude Code
/plugin marketplace add kaelys-js/ttt-workflows
/plugin install ttt-workflows