PM Skills Evaluation
PM Skills Evaluation (#1029)
Section titled “PM Skills Evaluation (#1029)”Evaluated 2026-10-01 by reading the repository through the GitHub API and the article over HTTP; nothing was installed or run. Both sources are live:
- phuryn/pm-skills: MIT, about 26,700 stars, created 2026-03-01, last pushed 2026-09-14. A Claude Code plugin marketplace of nine plugins.
- The AI PM roadmap 2026 (Pawel Huryn, Product Compass). The X thread that pointed to it was not read.
Verdict: reference-only, with two patterns taken. Almost all of the
catalogue is product-management method (strategy canvases, go-to-market,
market sizing, OKRs) for a person writing a product, not for BoB’s job of
running development work through GitHub issues. Its local-document outputs
(PRDs, tests.md) would also clash with BoB’s no-local-PM-files rule. Two
patterns from its shipping plugin are worth having:
- Intended vs. implemented, folded into the security-audit adaptation (#2668) as input rather than a separate skill.
- An independent, unsteered review of the diff since the last release, filed as #3561.
Inventory
Section titled “Inventory”| Plugin | Skills | Commands | What it covers | Overlap with BoB |
|---|---|---|---|---|
pm-ai-shipping |
3 | 5 | Document an app, derive tests from intent, static security and performance audits, /ship-check |
Partial: security-auditor, /security-review, /code-review, performance-auditing, doc-bootstrap. Two patterns taken (below) |
pm-execution |
16 | 11 | PRDs, user and job stories, sprint plans, OKRs, pre-mortem, retro, release notes, stakeholder maps, test scenarios | /requirement, /capability, /use-case, /retrospective, /release, idea-stress-test; BoB keeps these as issues, not documents |
pm-product-discovery |
13 | 5 | Ideas, experiments, assumptions, opportunity-solution trees, interview scripts, feature-request triage, metrics dashboards | user-research (partial); /groom for triage |
pm-product-strategy |
12 | 5 | Vision, strategy, business model, lean canvas, SWOT, PESTLE, Porter, Ansoff, pricing | /vision, /business-case (partial) |
pm-market-research |
7 | 3 | Personas, segments, market sizing, competitor analysis, journey maps, sentiment | None |
pm-go-to-market |
6 | 3 | Beachhead, ICP, GTM motions, growth loops, battlecards | None |
pm-marketing-growth |
5 | 2 | North-star metric, positioning, value propositions, naming | None |
pm-data-analytics |
3 | 3 | SQL, cohorts, A/B test analysis | d1-expert for SQL only |
pm-toolkit |
4 | 5 | NDA, privacy policy, proofreading, résumés | None, and out of scope |
Each skill is a prompt: a role, a framework, steps and an output template. Few carry scripts or checks.
Candidates
Section titled “Candidates”1. Intended vs. implemented: adapt, into #2668
Section titled “1. Intended vs. implemented: adapt, into #2668”pm-ai-shipping/skills/intended-vs-implemented is a method for one class of
bug scanners miss: the code is internally consistent but does not do what was
meant. Read the documented rules (permissions, flows, architecture) as claims;
for each, find the enforcement point in the code on every path and cite it,
or prove it is absent; keep a mismatch only when crossing it reaches someone
else’s data, money, infrastructure or tenant; and report a finding only with
both the doc quoted and the code cited. Missing documentation is itself the
first finding.
BoB’s security-auditor agent hunts by vulnerability class (OWASP, auth
checks, secrets, headers) and has no intent axis. The Cloudflare
security-audit adaptation (#2668, p2-high, approved) is the planned rebuild of that
capability, so the method went there as a comment rather than into a second
skill. In BoB the intent sources would be /threat-model output, project docs
and requirement acceptance criteria.
2. Independent, unsteered review: adapt, filed as #3561
Section titled “2. Independent, unsteered review: adapt, filed as #3561”/ship-check runs a sequence of steered reviews (correctness, security,
performance), then a final step it calls the highest-yield on a real release:
a fresh session of a different model, given no checklist and no earlier
findings, reviewing a subject defined mechanically (the diff since the last
release tag plus the working tree). Each of its findings is verified against
the code by hand and marked as introduced by the change (blocks it) or
revealed (filed, does not block).
BoB’s reviews are all steered by their own checklists, so they share blind spots. #3561 adds one unsteered pass to the release path, with a fresh Claude session standing in for a different model (BoB is Claude Code only; cross-harness review belongs with #2394).
3. Pre-mortem: drop
Section titled “3. Pre-mortem: drop”pm-execution/skills/pre-mortem sorts risks into Tigers (real), Paper Tigers
(overblown) and Elephants (unspoken), then into launch-blocking, fast-follow
and track. BoB’s idea-stress-test already runs an adversarial pre-mortem
before a build commitment, with a go / no-go verdict. The Tigers vocabulary
adds nothing BoB acts on.
Also looked at and dropped: /derive-tests, whose coverage map separates
existing tests from proposed ones and unverified gaps (BoB’s
test policy and the warp-drive check runner
already decide what to test and record what was skipped), and
/red-team-prd / strategy-red-team, which red-team a PRD document BoB does
not write.
Evals and observability, shipping and hardening
Section titled “Evals and observability, shipping and hardening”The article’s sections 8 and 9 are reading lists. Their framing, mapped onto BoB:
| Article | Its point | Where BoB stands |
|---|---|---|
| AI evals | When an agent runs unwatched and can affect a customer, quality must be measured, not eyeballed; start with error analysis, then pick metrics | Skill evals through claude plugin eval (#2390, under #2387); error analysis is what /trace-mining does over session evidence |
| Observability | See what the agent did | The session ledger, warp-drive state, bob warp viz / bob viz, chunk and session reports, harness-defect fingerprints |
| Shipping and hardening | Branching dev / test / prod, CI/CD, security, performance | The promotion ladder and ceiling, bob deploy, CI locus and runner preflight, the security-review ritual |
Nothing here maps to a new hook. The one gap the article points at is the one #3561 covers: a check that is not steered by the same checklists as the rest.
Using the catalogue anyway
Section titled “Using the catalogue anyway”The marketplace installs as Claude Code plugins. A client project whose work includes product management (discovery, positioning, PRDs) can install the relevant plugin on its own; BoB does not need to carry or provision it.
Not verified
Section titled “Not verified”- The X thread.
- Any skill’s output: no command was run.