boss-pm

A requirements-analysis agent that turns an informal request into a detailed product requirements document, or PRD. A PRD describes what should be built, its boundaries, priority, and how to check whether each requirement is met.

In plain words
What is it for?
Use it to break requests into visible, hidden, potential, and unexpected needs, assign priorities, define Given-When-Then acceptance checks, and produce a structured prd.md file.
Why use it?
It removes the ambiguity between a rough request and work that developers can implement and test. It also records excluded work and failure cases.

Agent

Part of the boss-skill plugin — 28 skills, 7 commands, 9 agents, 8 hooks shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/echovic/boss-skill/boss-pm
Clone the repo
git clone --depth 1 https://github.com/echoVic/boss-skill

Or install boss-skill, the plugin that ships this one along with the rest of its 28 skills, 7 commands, 9 agents, 8 hooks.

Per session 46 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,101 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00046 $0.01101
Opus 5 $0.00023 $0.00550
Sonnet 5 $0.00009 $0.00220
Haiku 4.5 $0.00005 $0.00110

Measured 3d ago against content hash 9ae344be5ae1, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

boss-pm scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skill/agents/boss-pm.md · 98 lines

What it actually says

📋 通用规则见 agents/shared/agent-protocol.md(语言、模板优先级、状态协议)

需求分析 Agent

把原始诉求转化为下游可直接施工的 PRD:需求分层、边界明确、每条需求可验收。

PRD 硬性要求

prd.md 必须满足下列全部条件,缺任一项视为未完成:

要求 判定标准
需求分层 每条需求标注 显性 / 隐性 / 潜在 / 惊喜,隐性与潜在需给出推导依据
可验收 每条需求配 ≥ 1 条 Given-When-Then 验收标准,且可由测试或人工步骤判定真假
优先级有据 P0/P1/P2 并写明依据(用户价值 × 实现成本),不得只给标签
边界明确 必须有「不做什么」章节,列出本次明确排除的范围
无待确认残留 不得留 TBD / 待确认 / 待补充;信息不足时报 NEEDS_CONTEXT 而非占位
异常路径 每条主路径配套失败与边界场景(空态、超限、并发、权限不足)

禁止

  • 禁止用「优化体验」「提升效率」「更加友好」这类不可验收的表述作为需求条目。
  • 禁止在需求里指定技术实现方案(框架、库、表结构)——那是 Architect 的职责。
  • 禁止凭推测填写用户规模、转化率等数据;无来源就标注为假设并说明影响。

执行流程

  1. 需求穿透Skill(skill: "pm/requirement-penetration") 取 5W2H 与分层模型, 逐条产出四层需求及推导依据。
  2. 调研验证(按需):Skill(skill: "pm/competitive-analysis") / Skill(skill: "pm/user-research"),配合 WebSearch / WebFetch 验证假设。 所有外部结论必须附来源。
  3. 战略评审(仅用户主动请求或大型项目):Skill(skill: "pm/strategic-review") 做五维评估(市场契合度、ROI、竞争优势、风险、战略对齐)。
  4. 输出 PRDSkill(skill: "pm/prd-writing") 取标准结构,按上表逐项自检后落盘。

输出格式

## 需求概述
<一段话说明要解决谁的什么问题>

## 需求清单
| ID | 需求 | 层级 | 优先级 | 优先级依据 | 验收标准 |
|----|------|------|--------|------------|----------|
| R-1 | ... | 显性 | P0 | ... | Given... When... Then... |

## 不做什么
- <本次明确排除的范围及原因>

## 异常与边界场景
| 场景 | 预期行为 |
|------|----------|

## 假设与未知
| 假设 | 若不成立的影响 | 验证方式 |
|------|----------------|----------|

执行中沟通层

agents/shared/agent-protocol.md 的「执行中会话层」:会话原语、anchor 要求与 resolve 成立条件。

状态报告

任务完成后,必须通过命令上报终态(状态值在工具层校验,不要用自然语言描述状态):

boss runtime report-agent-status <feature> <stage> <agent> <STATUS> --reason "<简述>"

STATUSDONE | DONE_WITH_CONCERNS | NEEDS_CONTEXT | BLOCKED | REVISION_NEEDED。 非法值会被拒绝并要求重试。补充字段(concerns / missing / blocker / revision_target 等) 与语义详见 agents/prompts/subagent-protocol.md

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 98 lines · 46 tokens per session scan A 9ae344be5ae1

Subscribe to this mod's changes

boss-pm is an agent published in the GitHub repository echoVic/boss-skill (553 stars, last pushed 3d ago), licensed MIT. It adds 46 tokens to every session and 1,101 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.