phuryn/pm-skills is a marketplace of reusable skills, commands, and plugins that guide AI assistants through product-management work such as discovery, strategy, planning, metrics, launches, and growth. It is for product managers and teams using Claude Code, Cowork, or compatible assistants. The catalogue entries are the project's own workflows and extensions.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/phuryn/pm-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/phuryn/pm-skills/document-app)<a href="https://agentmods.dev/commands/phuryn/pm-skills/document-app"><img src="https://agentmods.dev/badge/commands/phuryn/pm-skills/document-app/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/phuryn/pm-skills/document-app"><img src="https://agentmods.dev/badge/commands/phuryn/pm-skills/document-app.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00061 | $0.01326 |
| Opus 5.5 | $0.00024 | $0.00530 |
| Sonnet 5.5 | $0.00012 | $0.00265 |
| Haiku 4.5 | $0.00006 | $0.00133 |
Grade A, and why
document-app scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 97 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/document-app -- Make the System Reviewable
Produce the durable documentation an AI-built app is missing: an honest map of what the system is, who can do what, and where the risk lives. These docs are the foundation every later audit compares the code against.
Invocation
/document-app
/document-app supabase/functions
/document-app the backend
/document-app check
/document-app check supabase/functions
A first argument of check runs check-only mode (below) on the scope that follows it.
Workflow
Step 1: Scope
Audit $ARGUMENTS. If it starts with check, skip to Check-only mode with the rest as the scope. If empty, document the whole repository, prioritizing backend code, auth, data access, background jobs, and anything that sends, schedules, or exposes data.
Step 2: Reverse-Engineer the Docs
Apply the shipping-artifacts skill. Reading the code as the source of truth, produce the applicable documents. Where they go and what they are called follow its Locations and names rule: the repo's own docs location and existing equivalents first, the names below (in documentation/ at the repo root) only where the repo has none. For large scopes, fan out with parallel subagents — one per core document, each reading the code slice its doc describes — then reconcile the cross-references yourself.
Core (always):
architecture.md— system overview, stack, auth flow, trust boundariesflows.md— the permission-relevant journeys: each protected step's authz check, the trust-boundary crossings, and the side effects each flow causespermissions.md— roles, scope derivation, resource × operation × role matrix, RLS vs. code-enforced checksvariables.md— config & secrets mapped to risk and rotation
Conditional (only if the capability exists — otherwise note its absence in one line):
emails.md— notification path, templates, retry/backoff, failure visibilitycron.md— scheduled-work inventory, idempotency, internal-call authseo.md— SPA preview approach, route coverage, metadata sanitizationautomation.md— embedded agents/automations: trigger, tool surface, steering vs. hard guardrails, output contract, app-owned side effects, approval gates
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago Changed · +35 lines · +17 tokens per session 6ad71fe173dc
- 1mo ago First seen · 62 lines · 44 tokens per session scan A f1940d24a4f2
document-app is a command published in the GitHub repository phuryn/pm-skills (27,175 stars, last pushed 2d ago), licensed MIT. It adds 61 tokens to every session and 1,326 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
product-messaging-playbook
Assemble a Sales/CS-ready messaging playbook for a new product or feature — problem, story, one named competitive comparison, discovery questions, objection handling.
customer-stories
Kick off, interview for, draft, send for customer review or audit a B2B customer story in one fixed structure, with stats and named quotes checked.
experiment-ideas
Generate several concrete, brain-grounded growth ideas — channel, message, rationale, cost-efficiency — ranked by effort vs. impact.
value-prop-statements
Fan an existing positioning statement out into segment- and channel-specific value-prop copy variants, trace-checked against drift.
brand-voice
Build a persona-adaptive voice guide — brand attributes, tone by buyer and channel, forbidden language — then deepen brain Section 4.
pmm-metrics
Define a North Star Metric and capped scorecard, or audit an existing metrics list for sprawl and vanity metrics.