Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/bestagentkits/agency-skillsnpx agentmods add skills/bestagentkits/agency-skills/cpo-reviewWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bestagentkits/agency-skills/cpo-review)<a href="https://agentmods.dev/skills/bestagentkits/agency-skills/cpo-review"><img src="https://agentmods.dev/badge/skills/bestagentkits/agency-skills/cpo-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bestagentkits/agency-skills/cpo-review"><img src="https://agentmods.dev/badge/skills/bestagentkits/agency-skills/cpo-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00053 | $0.00836 |
| Opus 5 | $0.00026 | $0.00418 |
| Sonnet 5 | $0.00011 | $0.00167 |
| Haiku 4.5 | $0.00005 | $0.00084 |
Grade A, and why
cpo-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 111 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/cs:cpo-review — CPO Forcing Questions
Command: /cs:cpo-review <plan>
The JTBD-driven builder cuts the roadmap in half. Six questions to surface what to ship and what to kill.
When to Run
- Before quarterly roadmap commitment
- Before launching a new product line
- Before adding > 3 features to a release
- When retention is flat or declining
- When the team is debating "should we build X?"
The Six CPO Questions
1. JTBD
What job is this feature hired to do, in the user's words?
- Not "improve onboarding." "Help a new ops manager get their first deal closed within 7 days."
- Job ≠ feature. Hire ≠ try.
2. North Star Metric
What user behavior does this move, and how does that ladder to the North Star?
- The metric must be leading, behavior-based, and value-correlated.
- If you can't trace the feature to the North Star, don't build it.
3. PMF Signal
What's the retention curve for users who hire this job — is it flat, decaying, or smiling?
- Flat or smiling = PMF signal. Decaying = no PMF.
- "Users like it in surveys" is not a signal.
4. RICE Score
Reach, Impact, Confidence, Effort — what's the score and where does this rank in the queue?
python product-team/skills/product-manager-toolkit/scripts/rice_prioritizer.py
5. Opportunity Cost
What gets cut if this ships? Name the specific initiative or feature.
- Headcount and time are zero-sum. The cut list is the focus list.
6. Kill Criteria
What signal would tell you in 90 days that this was the wrong bet?
- Define the metric and threshold in writing, before launch.
- If you can't define a kill criterion, you can't ship responsibly.
Workflow
- Run the analyses:
python ../../../skills/cpo-advisor/scripts/pmf_scorer.py python ../../../skills/cpo-advisor/scripts/portfolio_analyzer.py - Answer the six questions.
- Apply the verdict.
Output Format
# CPO Review: <feature/plan>
**Date:** YYYY-MM-DD
## JTBD
> <one sentence in user voice>
## North Star Link
- Metric moved: <name>
- Expected delta: <%>
## PMF Signal
- Retention curve shape: flat / smiling / decaying
- Cohort sample size: N
## Score
- RICE: <number>
- Rank in queue: #N of M
## Cut List
- Cut: <initiative>
- Reason: <why this matters more>
## Kill Criteria (90 days)
- Metric: <name>
- Threshold: <value>
- Action if missed: <kill | iterate>
## Verdict
🟢 SHIP | 🟡 SHARPEN | 🔴 KILL
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 111 lines · 53 tokens per session scan A 38c4bc0d4003
cpo-review is a skill published in the GitHub repository bestagentkits/agency-skills (12 stars, last pushed 2mo ago), licensed MIT. It adds 53 tokens to every session and 836 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
curate-collection
Build and maintain a library collection through acquisitions, weeding (deaccessioning), collection assessment, reader advisory, and interlibrary loan coordination. Covers selection criteria, collection development policies, the CREW/MUSTIE method for weeding, usage analysis, and responsive collection management. Use…
design-training-program
Design a GxP training programme covering training needs analysis by role, curriculum design (regulatory awareness, system-specific, data integrity), competency assessment criteria, training record retention, and retraining triggers for SOP revisions and incidents. Use when a new validated system requires user training…
design-on-call-rotation
Design sustainable on-call rotations with balanced schedules, clear escalation policies, fatigue management, and handoff procedures. Minimize burnout while maintaining incident response coverage. Use when setting up on-call for the first time, scaling a team from 2-3 to 5+ engineers, addressing on-call burnout or…
conduct-retrospective
Conduct a project or sprint retrospective by gathering data from status reports and velocity metrics, structuring what went well and what needs improvement, and generating actionable improvement items with owners and due dates. Use at the end of a sprint, after a project phase or milestone, following a significant…
create-github-issues
Structured GitHub issue creation from review findings or task breakdowns. Groups related findings into logical issues, applies labels, and produces issues with standard templates including summary, findings, and acceptance criteria. Designed to consume output from review-codebase or similar review skills.
create-work-breakdown-structure
Create a Work Breakdown Structure (WBS) and WBS Dictionary from project charter deliverables. Covers hierarchical decomposition, WBS coding, effort estimation, dependency identification, and critical path candidates. Use after a project charter is approved, when planning a classic or waterfall project with defined…