gb-plugins-marketplace

Authenticate outbound network calls from inside a sandbox running behind a MITM egress-proxy + gateway auth-webhook (e.g. SandboxedOstoolsMcpServer). Authentication is a required first step — the proxy blocks unauthenticated egress — and tokens are injected server-side so the agent never holds them. A common egress-auth skill owns the wire contract (HTTP 511 auth_pending handshake, 403 deny), backoff polling, human-in-the-loop device-code relay, transparent token injection, warm-then-run, and a portable Python probe engine. Thin user-invocable service skills (github, azure-devops, microsoft-graph, connect) reference and use it FIRST with service-specific probe URLs, scopes, and endpoints.

Workspace-agent skills for sandboxed task execution: bootstrap Memory/ and scripts/, maintain task handoffs, use repeatable script helpers, and understand sandbox auth/context boundaries without bloating the chat-mode system prompt.

Azure DevOps integration for work item management, PR publishing, iterative PR tending, autonomous work item implementation, and autonomous backlog processing. Orchestrates development methodology skills via the development plugin.

GitHub integration for issue and project management, PR publishing, iterative PR tending, issue-driven implementation, and autonomous backlog processing. Orchestrates development methodology skills via the development plugin.

Development methodology toolkit: design-first brainstorming, autonomous design with review-planning and implementation-handoff steps, test-driven development, parallel subagent-driven execution with review gates, evidence-based completion verification, severity-and-cost triage for acting on received code review (Critical/Blocker always, High even when costly, Medium/Low only when cheap, with a practicality-and-alignment gate), a provider-agnostic work-item drafting router that classifies intent and posts to GitHub or Azure DevOps — delegating to deep draft-feature and draft-bug sub-skills with agent-driven blind-spot detection — and a provider-agnostic autonomous work-on workflow (plan → HITL approval → implement → verify → publish) shared by the GitHub and Azure DevOps plugins, with a dedicated provider-agnostic implement engine (purpose-and-consumption context, atomic TDD task execution, self-review, and evidence-based verification) that work-on delegates to. Includes planning, execution, and git workflow reference guides.

Developer performance review skill for analyzing work over time (weeks/months)

Code review toolkit with specialized agents for duplicate detection, EUII leak scanning, exception handling review, test coverage review, design simplification, code simplification, over-engineering / scope-creep detection, architecture review, performance review, schema and wire-contract compatibility review (forward/backward compat, rollout sequencing, serializer asymmetry, DB migration footguns), feature-flag rollout review (blast-radius and reversibility assessment), severity grading quality gate, log review, and PR work item context gathering. Includes a review-pr command that auto-detects the repository provider (GitHub or Azure DevOps) and tech stack and publishes findings to the PR, a post-pr-review skill for structured comment posting with summary thread management, plus a review-pending-prs batch orchestrator with persistent tracking.

Microsoft Orleans patterns, best practices, and code review for virtual actor model applications — covers grain design, concurrency, cross-grain communication, streams, and serialization.

Achieve zero-warning builds through systematic warning elimination, code formatting, and package version validation

Log-first debugging methodology using structured JSONL logs queried with DuckDB. Includes debugging workflows, logging enablement for codebases, logging compliance review with calibrated Trace-coverage recommendations for AI-assisted debugging, and systematic root-cause debugging.