by echoVic
Boss Skill - BMAD 全自动研发流水线(多 Agent 编排)
# Add to your Claude Code skills
git clone https://github.com/echoVic/boss-skillLast scanned: 5/22/2026
{
"issues": [],
"status": "PASSED",
"scannedAt": "2026-05-22T07:44:52.014Z",
"semgrepRan": false,
"npmAuditRan": true,
"pipAuditRan": true
}boss-skill is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by echoVic. Boss Skill - BMAD 全自动研发流水线(多 Agent 编排). It has 551 GitHub stars.
Yes. boss-skill passed SkillsLLM's automated security scan — a dependency vulnerability audit plus prompt-injection heuristics — with no high-severity issues. You can read the full report in the Security Report section on this page.
Clone the repository with "git clone https://github.com/echoVic/boss-skill" and add it to your Claude Code skills directory (see the Installation section above).
boss-skill is primarily written in TypeScript. It is open-source under echoVic on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh boss-skill against similar tools.
No comments yet. Be the first to share your thoughts!

Boss is an auditable agent-team workflow for coding agents. It turns one coding agent into a structured engineering team: PM, Architect, UI Designer, Tech Lead, Scrum Master, Frontend, Backend, QA, and DevOps. Unlike prompt-only agent teams, Boss adds runtime state, append-only events, quality gates, deterministic evals, hooks, and replayable artifacts.
Boss works with Claude Code, Codex, OpenClaw, Antigravity, and Hermes.
Prompt-only orchestration can sound organized, but it usually cannot prove that the plan was followed, tests were run, gates passed, or state was not hallucinated. Boss is built around evidence:
.boss/<feature>/.meta/events.jsonl and projected into read-only execution state..boss/<feature>/.--describe, dry runs, bounded fields, and structured errors.Boss is not a single monolithic command. You can run one role against an existing project, or run the full pipeline from idea to delivery.
| Command | What it does | Use when |
|---|---|---|
/boss |
Full 4-stage pipeline | You want to go from idea to shippable work |
/boss:plan |
PM + Architect planning | You want PRD and architecture before implementation |
/boss:review |
Tech Lead review | You need a read-only code, PR, or design review |
/boss:qa |
QA plus gates | You need verifiable test evidence |
/boss:ship |
DevOps build and deployment checks | You are ready to ship |
/boss:extend |
Custom agent, pack, or gate | You want to adapt Boss for your team |
/boss:upgrade |
Upgrade Boss Skill and reinstall hooks | You want the latest npm package and hook config |
| Good fit | Poor fit |
|---|---|
| New features that need requirements, design, implementation, tests, and delivery evidence | One-line fixes or tiny local edits |
| API, full-stack, UI, or medium-sized product work | Pure code reading or explanation |
Work where .boss/<feature>/ artifacts are valuable |
Tasks with a complete existing spec where you only need a quick patch |
| Teams that want repeatable gates and audit trails | Work that does not need coordination or review evidence |
Rule of thumb: if you do not need a traceable .boss/ folder, you probably do not need the full /boss pipeline. Use a single role or let your coding agent edit directly.
Boss detects the boss CLI at runtime. Without it, the workflow can degrade to Markdown artifacts under .boss/<feature>/ instead of the event stream. The CLI is the auditability upgrade: event sourcing, replayable resume, deterministic evals, runtime gates, and structured diagnostics.
Boss does not mean "install once and get guaranteed autonomous delivery." It provides a runtime workflow and evidence gates; the active coding agent still has to follow the Boss protocol.
npm install -g @blade-ai/boss-skill
boss-skill
boss-skill auto-detects supported agents and installs the Boss skill bundle where possible.
For Claude Code plugin mode:
claude --plugin-dir "$(boss-skill path)"
Inside your coding agent:
/boss Build a local personal todo app --roles core --skip-deploy
--roles core uses PM, Architect, Dev, and QA.--skip-deploy stops after implementation and test evidence.boss status todo-app --json
boss runtime inspect-pipeline todo-app
Expected artifact layout:
.boss/todo-app/
├── design-brief.md
├── prd.md
├── architecture.md
├── tasks.md
├── qa-report.md
└── .meta/
├── events.jsonl
├── execution.json
└── workflow-plan.json
npm install -g @blade-ai/boss-skill
boss-skill install
Useful install commands:
boss-skill install --dry-run
boss-skill uninstall
boss-skill path
boss-skill --version
Auto-detected targets:
| Agent | Detection | Install method |
|---|---|---|
| OpenClaw | ~/.openclaw/ |
Copy to ~/.openclaw/skills/boss/ and inject metadata |
| Codex | ~/.codex/ |
Copy to ~/.codex/skills/boss/, inject metadata, merge hooks |
| Antigravity | ~/.gemini/antigravity/ |
Copy to Antigravity skills directory and inject metadata |
| Hermes | ~/.hermes/ |
Copy to ~/.hermes/skills/boss/ and inject metadata |
| Claude Code | Always available | Plugin mode with --plugin-dir |
Common slash commands:
/boss Build a todo app
/boss Add authentication to this existing project --skip-ui
/boss Build an API service --skip-deploy --quick
/boss Continue the previous task --continue-from 3
/boss Lightweight mode --roles core --hitl-level off
/boss:upgrade
Common options:
| Option | Meaning |
|---|---|
--roles <preset> |
full for all 9 roles, or core for PM/Architect/Dev/QA |
--skip-ui |
Skip UI design |
--skip-deploy |
Skip deployment |
--quick |
Skip confirmation and requirement clarification nodes |
--template |
Initialize .boss/templates/ and pause |
--continue-from <1-4> |
Resume from a pipeline stage |
--hitl-level <level> |
Human-in-the-loop mode: auto, interactive, or off |
Boss CLI commands:
boss --help
boss status FEATURE
boss continue FEATURE
boss gate FEATURE
boss qa attack FEATURE
boss project init FEATURE
boss design preview FEATURE
boss packs detect
boss runtime inspect-pipeline FEATURE
boss runtime generate-summary FEATURE
Agent-facing boss commands use these common options where applicable; run --describe on a command for its exact JSON schema:
--json: structured output; non-TTY stdout defaults to JSON--describe: JSON command schema--dry-run: structured action plan for writes or risky operations--json-input=<json|->: JSON input payload--fields=<a,b> and --limit=<n>: bounded output--yes: required only for high-risk non-interactive commands that need an extra confirmationStructured errors are written to stderr as {"error":{...}} and include code, message, input, retryable, and suggestion.
Boss follows a four-stage workflow:
User request
-> requirement clarification
-> Stage 1: PM, Architect, UI Designer
-> Stage 2: Tech Lead, Scrum Master
-> Stage 3: Frontend, Backend, QA, gates
-> Stage 4: DevOps, deployment checks, summary
The full role set:
| Role | Responsibility |
|---|---|
| PM | Requirement discovery, PRD, hidden needs, edge cases |
| Architect | System architecture, technical design, APIs |
| UI Designer | UI/UX spec plus renderable design JSON |
| Tech Lead | Technical review, risk assessment |
| Scrum Master | Task breakdown and acceptance criteria |
| Frontend | UI implementation and frontend tests |
| Backend | API, storage, backend tests |
| QA | Test execution, bug reports, verification evidence |
| DevOps | Build, deployment, health checks |
Boss has two layers of quality control:
execution.json, hooks, install matrix tests, harness scenarios, and Vitest coverage.Built-in gates:
| Gate | Timing | Checks |
|---|---|---|
| Gate 0 | After development, before QA | TypeScript, lint, basic compile checks |
| Gate 1 | After QA, before deployment | Test evidence, no P0/P1 bugs, E2E expectations |
| Gate 2 | Before web deployment | Lighthouse and API latency targets when applicable |
Hooks are controlled by environment variables:
| Variable | Values |
|---|---|
BOSS_HOOK_PROFILE |
minimal, standard, strict |
BOSS_DISABLED_HOOKS |
Comma-separated hook IDs |
Runtime state is backed by .boss/<feature>/.meta/workflow-plan.json and .boss/<feature>/.meta/execution.json. The workflow definition records workflowHash, packHash, and artifact DAG hashes. Runtime resume uses boss runtime resume <feature> --from-run <run-id> to reload the plan, compare node inputs, and materialize execution.workflow.nextNodeIds for the next schedulable nodes. GateEvaluated / WaveVerified events update workflow node status when gates and evidence waves complete.
Boss intentionally keeps the published plugin manifest small: it declares only bundled skills and omits MCP servers, app manifests, and asset references unless those companion files exist. Codex hooks are installed by the boss-skill install flow, not by the marketplace manifest.
The npm package excludes local development agent settings such as .claude/settings.json and .claude/settings.local.json. Publishable plugin metadata lives under .claude-plugin/, `.codex-p