bex: Skill for Claude Code

.claude/skills/pm-brainstorm/SKILL.md

pm-brainstorm is a skill for Claude Code, Codex from bex-co/bex. It costs 52 tokens per session (1,501 once invoked), scanned A, original, Apache-2.0.

A text-based product-planning aid that breaks a topic into proposed milestones and tasks for a repository’s .pm planning board. It prepares the commands needed to add the proposal but does not write to the board.

In plain words
What is it for?
For pressure-testing product plans, designing milestones, identifying dependencies, and preparing exact planning-board commands.
Why use it?
It helps turn a broad product idea into smaller, ordered pieces of work while checking scope, size, dependencies, and planning rules.

Skill for Claude CodeCodex

Written for Claude Code and Codex: allowed-tools in frontmatter, but also agents/openai.yaml present. Also seen: reads .claude/ paths.

This is bex-co/bex's own configuration. It tells Claude Code and Codex how to work on bex itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything bex configures →

Reuse

Borrowing it

Nothing to install: this file belongs to bex-co/bex. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/bex-co/bex/main/.claude/skills/pm-brainstorm/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/bex-co/bex

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for pm-brainstorm

README.md
[![agentmods](https://agentmods.dev/badge/skills/bex-co/bex/pm-brainstorm/github.svg)](https://agentmods.dev/skills/bex-co/bex/pm-brainstorm)
Your own site
<a href="https://agentmods.dev/skills/bex-co/bex/pm-brainstorm"><img src="https://agentmods.dev/badge/skills/bex-co/bex/pm-brainstorm/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for pm-brainstorm

Your own site · 80×15
<a href="https://agentmods.dev/skills/bex-co/bex/pm-brainstorm"><img src="https://agentmods.dev/badge/skills/bex-co/bex/pm-brainstorm.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 52 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,501 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 2 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • medium Agent Snooping · line 14
    Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
    Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
  • medium Agent Snooping · line 18
    Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
    Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00052 $0.01501
Opus 5.5 $0.00021 $0.00600
Sonnet 5.5 $0.00010 $0.00300
Haiku 4.5 $0.00005 $0.00150

Measured 1mo ago against content hash 0a734023e4bd, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

pm-brainstorm scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/pm-brainstorm/SKILL.md · 40 lines

How it starts

The opening of the file, as written. The whole thing — 40 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Task: Propose milestones and tasks

/pm-brainstorm is the divergent half of the pair: it thinks a topic through, proposes work, and hands orchestration and materialization to /pm. It writes nothing — the output is a text proposal. $ARGUMENTS is the topic/goal.

The board conventions — hierarchy, sizing rule, milestone quality gate, standing closing tasks, templates — live canonically in .claude/skills/pm/SKILL.md. Read that file and apply its rules; do not restate or diverge from them here.

Proposal count

Propose five distinct, meaningful items per run unless the user explicitly requests a different count. An item is a milestone or an inbox note, not an implementation task or a standing closing task. Each item must have concrete evidence, project-goal linkage, an observable outcome, and a why-now rationale.

Do not stop after restating the target workstream's existing inbox. Research enough candidates to select five that survive the anti-goal, deduplication, and quality gates. For a workstream-only request such as w4, look across the project for work that can be scheduled there; for a specific topic, stay within that topic. Existing board work may be reused or reshaped with explicit references, but must not be presented as a new discovery or filed twice.

Do not pad the count by splitting one outcome into artificial items, inflating sub-hour fixes into milestones, inventing gaps, or reopening deferred decisions. If substantive research still yields fewer than five eligible items, explain the specific evidence or scope constraints and the candidates rejected; never count rejected or speculative filler as meaningful proposals.

Steps

  1. Load the canon and the anti-goals. Read .claude/skills/pm/SKILL.md (conventions) and .pm/DO_NOT_DO.md (hard constraint). If a proposed item conflicts with an anti-goal, reject it explicitly and explain why.
  2. Sync autonomously and keep going. Run git fetch origin main and git status. On local main, run git pull --ff-only origin main when behind; a dirty tree or untracked files alone are not a reason to stop — Git will refuse a fast-forward that would overwrite them. Preserve local work: do not reset, clean, stash, commit, or rebase to make brainstorming possible. If the pull is refused, the branch has diverged, or another branch is checked out, read the latest fetched origin/main board and source with git show origin/main:<path> and git ls-tree, comparing relevant local changes with git diff as needed. If fetching fails, use the available checkout and state that freshness could not be verified. Resolve routine issues yourself, briefly report the source revision and any fallback, and always continue to the proposal without asking the user how to proceed.
  3. Load context. Read the relevant .pm board state (workstream README.mds, open milestones, inbox notes — find .pm -name README.md, plus loose notes) so proposals fit the existing roadmap and reuse its numbering/naming. Choose any existing wN using available capacity, dependency locality, and collision avoidance; every worker is general-purpose, and prior milestone topics do not create a specialty or ownership claim. Propose a new wN only when more independent queue capacity is useful. Also check wN/done/ and any nested done/ folders (find .pm -type d -name done) for milestones that already shipped the same capability — read their titles/READMEs before proposing, and drop or reshape any candidate that duplicates completed work instead of proposing it fresh. For any Render-parity topic, also read docs/ADR018-render-parity.md — the parity ledger already maps each REST/GraphQL/MCP/UI gap to ✅/◐/✖/— and to an owning milestone/inbox note; reuse its assessment and cross-references (don't re-derive them), cite the matrix row a proposal closes, and don't propose work for a cell it marks — (deliberate non-goal) without re-opening that decision.
  4. Analyze & decompose without pausing. Infer scope from the request and current board, pressure-test it, surface dependencies and risks, and break it into candidate tasks, each with a rough estimate and depends_on links. State reasonable assumptions in the proposal instead of asking clarifying questions. Where a product decision is unresolved, recommend an option or give conditional alternatives; do not treat brainstorming as authorization to implement them. Always deliver the text proposal in the same run.
  5. Size and gate each cluster of work using /pm's sizing rule and milestone quality gate. Undersized work → propose an inbox note instead of a milestone, and say so. Work that fails the quality gate → mark it not meaningful, do not propose it as a milestone, and suggest a better-scoped alternative.
  6. Emit the proposal as text only. Give the full detail first: the target workstream, each proposed milestone (task table + definition of done + source + goal linkage + expected outcome + why-now rationale) and/or inbox note, numbered in proposed priority order. Propose implementation tasks only: /pm appends the standing closing tasks (Render parity when the milestone is feature dev/a fix touching REST/GraphQL/MCP/UI, then Simplify, then Test coverage, then Closeout) itself when it materializes, so do not include them — but do flag in the proposal whether you expect Render parity to apply, so /pm and the user aren't guessing. Close with a "Summary (priority order)" section: a numbered list of every candidate (milestones and inbox notes together) using the same numbers as above — one line each: N. <title> (wN, ~size) — one-line outcome — so the user can scan and pick by number without rereading the detail. Do not write files.
  7. Hand off to /pm. End by giving the exact /pm command(s) to materialize the proposal, e.g.:
    • /pm new milestone w1 <title> (then the tasks), or
    • /pm add w1 <idea> for sub-hour work, or
    • /pm promote w1/NNN to promote an existing inbox note.

Read the full file on GitHub · 40 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago Changed · +8 lines 0a734023e4bd
  2. 1mo ago First seen · 32 lines · 52 tokens per session scan A 3e85c7f50707

Subscribe to this mod's changes

pm-brainstorm is a skill published in the GitHub repository bex-co/bex (574 stars, last pushed today), licensed Apache-2.0. It adds 52 tokens to every session and 1,501 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

golang-testing

Go testing best practices including table-driven tests, test helpers, benchmarking, race detection, coverage analysis, and integration testing patterns. Use when writing or improving Go tests.

affaan-m/ECC · 37 tokens

network-rca

Kubernetes network root cause analysis skill powered by Kubeshark MCP. Use this skill whenever the user wants to investigate past incidents, perform retrospective traffic analysis, take or manage traffic snapshots, extract PCAPs, dissect L7 API calls from historical captures, compare traffic patterns over time, detect…

kubeshark/kubeshark · 163 tokens

kfl

KFL2 (Kubeshark Filter Language) reference. This skill MUST be loaded before writing, constructing, or suggesting any KFL filter expression. KFL is statically typed — incorrect field names or syntax will fail silently or error. Do not guess at KFL syntax without this skill loaded. Trigger on any mention of KFL, CEL…

kubeshark/kubeshark · 203 tokens

mirrord-prev-env

Help users create and manage mirrord preview environments — running a modified service as an isolated pod in a shared Kubernetes cluster, scoped by an environment key and HTTP/queue traffic filtering, so teams can validate and review changes against real traffic without affecting live services. Use when a developer…

metalbear-co/mirrord · 122 tokens

ci

Configure Ginkgo for continuous integration — the recommended CLI flag set and the rationale for each flag (-r -p --randomize-all --randomize-suites --fail-on-pending --fail-on-empty --keep-going --cover --race --trace --json-report --timeout --poll-progress-after/-interval), invoking via go run to pin the CLI to…

onsi/ginkgo · 151 tokens

debugging-failures

Diagnose a failing Ginkgo suite as an agent — always run with --json-report into a predictable temp/gitignored location, read the terminal verdict line, then use jq to extract structured failure details (name, message, file:line, panic value, captured logs). Covers the panicked-vs-failed trap, panic locations pointing…

onsi/ginkgo · 122 tokens