Borrowing it
Nothing to install: this file belongs to bex-co/bex-security. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/bex-co/bex-security/main/.claude/skills/pm/SKILL.mdgit clone --depth 1 https://github.com/bex-co/bex-securityWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bex-co/bex-security/pm)<a href="https://agentmods.dev/skills/bex-co/bex-security/pm"><img src="https://agentmods.dev/badge/skills/bex-co/bex-security/pm/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bex-co/bex-security/pm"><img src="https://agentmods.dev/badge/skills/bex-co/bex-security/pm.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00048 | $0.02591 |
| Opus 5.5 | $0.00019 | $0.01036 |
| Sonnet 5.5 | $0.00010 | $0.00518 |
| Haiku 4.5 | $0.00005 | $0.00259 |
Grade A, and why
pm scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
94% identical to pm — 33 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 172 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Task: Arrange the .pm board
/pm is the only skill that writes to .pm/. It arranges milestones and tasks under the conventions below. /pm-brainstorm proposes; /pm materializes. This file is the canonical definition of the board conventions — hierarchy, sizing rule, quality gate, standing closing tasks, templates. /pm-brainstorm reads it at runtime and must not restate or diverge from it. Parse the subcommand from $ARGUMENTS (default = status).
The .pm hierarchy
| Level | Path | Meaning | Effort |
|---|---|---|---|
| Workstream | wN/ (w1, w2, …) |
a general-purpose worker queue; README.md + inbox notes |
— |
| Inbox note | wN/NNN.md (w1/005.md) |
one idea or a sub-hour unit of work, plain markdown | ≤ ~1h |
| Milestone | wN/mN/ (m1, m2, …) |
a shippable chunk: README.md + task files |
> ~1h, multiple tasks |
| Task | wN/mN/tNNN.md |
a single unit | tens of minutes |
Rules (enforce every time)
- Respect the anti-goals. Read
.pm/DO_NOT_DO.mdbefore proposing or materializing work. Do not create milestones/tasks that conflict with it. - Workers are general-purpose. Every
wNmay take work anywhere in the bex-security project. Workstream placement records scheduling and history, not a permanent mission, specialty, component boundary, or ownership claim. Do not assign themes or missions to workstreams, and do not use prior milestones to reject otherwise appropriate work. - Sizing rule. A milestone must be > ~1 hour of work across more than one task. If a chunk is ≤ ~1h (tens of minutes, a task or two), do NOT create an
mN/directory — record it as a loose inbox notewN/NNN.md. Tasks take tens of minutes; milestones take hours. - IDs must match the path. A task's
id: wN/mN/tNNNfrontmatter must equal the directory it lives in. Never create a milestone dir whose path disagrees with the IDs inside it — if you find such drift, flag/repair it, don't copy it. - Keep status in sync across all three places it lives: the workstream
README.mdmilestone checkbox, the milestoneREADME.md**Status:**line + the— DONEmarker in the task table, and each task'sstatus:frontmatter. - Numbering: next free zero-padded 3-digit for inbox notes (
NNN) and tasks (tNNN); next freewN/mN. Scan the tree first; don't reuse a number. - Use
worker: worker1unless the workstream README names another worker. - Milestones must be meaningful. Every milestone must include direct project-goal linkage, an observable expected outcome, and why this work matters now (dependency/risk/sequence rationale).
- Every board item briefly explains why. Milestones carry it in the milestone
README.md(## Source + Goal linkage). Single tasks — inbox noteswN/NNN.md— carry it in the note itself: a one-lineWhy: …directly under the title (a sentence on the motivation/payoff is enough). - Every milestone ends with standing closing tasks, appended after the implementation tasks whenever a milestone is materialized:
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 172 lines · 48 tokens per session scan A 343854209592
pm is a skill published in the GitHub repository bex-co/bex-security (53 stars, last pushed yesterday), licensed Apache-2.0. It adds 48 tokens to every session and 2,591 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 94% identical to pm, differing in 33 lines, and is treated as a copy.
Other skills, from other repositories
enterprise-vpn-attack
External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure / Ivanti Connect Secure, SonicWall, F5 Big-IP. Covers version fingerprinting, CVE matrix (2018-2026), AAA backend identification, default credentials…
hunt-api-misconfig
Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering. Mass assignment: send {isadmin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies. JWT signature/crypto forging (alg:none, key confusion, kid/jku) is owned by hunt-jwt-crypto; this…
hunt-ato
Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/numeric token, Referer leak, no-expiry/reuse), (2) email change without re-auth, (3) OAuth account-link CSRF, (4) MFA bypass (per hunt-mfa-bypass), (5) session…
cloud-iam-deep
Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Covers IAM enumeration (aws iam, az role, gcloud iam), STS/AssumeRole chaining, Azure Managed Identity abuse (via SSRF/leak), GCP service account JSON abuse, IMDSv1/v2…
integrate-arcjet-guard-claude-agent-sdk
Integrate Arcjet security into a Claude Agent SDK agent using @arcjet/guard — wrap tool() handlers, screen inbound prompts with UserPromptSubmit, and deny unwrapped built-in/MCP tools with PreToolUse. Use when asked to add Arcjet to a Claude Agent SDK or Claude Code agent, rate limit its tools, screen inbound…
integrate-arcjet-guard-langchain
Integrate Arcjet security into a LangChain JS createAgent using @arcjet/guard — wrap tool() / StructuredTool, put guardMiddleware on createAgent({ middleware }) for MCP / unwrapped tools, and read configurable.threadid for correlation. Use when asked to add Arcjet to langchain createAgent, rate limit its tools, screen…