Borrowing it
Nothing to install: this file belongs to bex-co/bex. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/bex-co/bex/main/.claude/skills/pm-brainstorm/SKILL.mdgit clone --depth 1 https://github.com/bex-co/bexWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bex-co/bex/pm-brainstorm)<a href="https://agentmods.dev/skills/bex-co/bex/pm-brainstorm"><img src="https://agentmods.dev/badge/skills/bex-co/bex/pm-brainstorm/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bex-co/bex/pm-brainstorm"><img src="https://agentmods.dev/badge/skills/bex-co/bex/pm-brainstorm.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Agent Snooping · line 14 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 18 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.01501 |
| Opus 5.5 | $0.00021 | $0.00600 |
| Sonnet 5.5 | $0.00010 | $0.00300 |
| Haiku 4.5 | $0.00005 | $0.00150 |
Grade A, and why
pm-brainstorm scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 40 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Task: Propose milestones and tasks
/pm-brainstorm is the divergent half of the pair: it thinks a topic through, proposes work, and hands orchestration and materialization to /pm. It writes nothing — the output is a text proposal. $ARGUMENTS is the topic/goal.
The board conventions — hierarchy, sizing rule, milestone quality gate, standing closing tasks, templates — live canonically in .claude/skills/pm/SKILL.md. Read that file and apply its rules; do not restate or diverge from them here.
Proposal count
Propose five distinct, meaningful items per run unless the user explicitly requests a different count. An item is a milestone or an inbox note, not an implementation task or a standing closing task. Each item must have concrete evidence, project-goal linkage, an observable outcome, and a why-now rationale.
Do not stop after restating the target workstream's existing inbox. Research enough candidates to select five that survive the anti-goal, deduplication, and quality gates. For a workstream-only request such as w4, look across the project for work that can be scheduled there; for a specific topic, stay within that topic. Existing board work may be reused or reshaped with explicit references, but must not be presented as a new discovery or filed twice.
Do not pad the count by splitting one outcome into artificial items, inflating sub-hour fixes into milestones, inventing gaps, or reopening deferred decisions. If substantive research still yields fewer than five eligible items, explain the specific evidence or scope constraints and the candidates rejected; never count rejected or speculative filler as meaningful proposals.
Steps
- Load the canon and the anti-goals. Read
.claude/skills/pm/SKILL.md(conventions) and.pm/DO_NOT_DO.md(hard constraint). If a proposed item conflicts with an anti-goal, reject it explicitly and explain why. - Sync autonomously and keep going. Run
git fetch origin mainandgit status. On localmain, rungit pull --ff-only origin mainwhen behind; a dirty tree or untracked files alone are not a reason to stop — Git will refuse a fast-forward that would overwrite them. Preserve local work: do not reset, clean, stash, commit, or rebase to make brainstorming possible. If the pull is refused, the branch has diverged, or another branch is checked out, read the latest fetchedorigin/mainboard and source withgit show origin/main:<path>andgit ls-tree, comparing relevant local changes withgit diffas needed. If fetching fails, use the available checkout and state that freshness could not be verified. Resolve routine issues yourself, briefly report the source revision and any fallback, and always continue to the proposal without asking the user how to proceed. - Load context. Read the relevant
.pmboard state (workstreamREADME.mds, open milestones, inbox notes —find .pm -name README.md, plus loose notes) so proposals fit the existing roadmap and reuse its numbering/naming. Choose any existingwNusing available capacity, dependency locality, and collision avoidance; every worker is general-purpose, and prior milestone topics do not create a specialty or ownership claim. Propose a newwNonly when more independent queue capacity is useful. Also checkwN/done/and any nesteddone/folders (find .pm -type d -name done) for milestones that already shipped the same capability — read their titles/READMEs before proposing, and drop or reshape any candidate that duplicates completed work instead of proposing it fresh. For any Render-parity topic, also readdocs/ADR018-render-parity.md— the parity ledger already maps each REST/GraphQL/MCP/UI gap to✅/◐/✖/—and to an owning milestone/inbox note; reuse its assessment and cross-references (don't re-derive them), cite the matrix row a proposal closes, and don't propose work for a cell it marks—(deliberate non-goal) without re-opening that decision. - Analyze & decompose without pausing. Infer scope from the request and current board, pressure-test it, surface dependencies and risks, and break it into candidate tasks, each with a rough estimate and
depends_onlinks. State reasonable assumptions in the proposal instead of asking clarifying questions. Where a product decision is unresolved, recommend an option or give conditional alternatives; do not treat brainstorming as authorization to implement them. Always deliver the text proposal in the same run. - Size and gate each cluster of work using
/pm's sizing rule and milestone quality gate. Undersized work → propose an inbox note instead of a milestone, and say so. Work that fails the quality gate → mark it not meaningful, do not propose it as a milestone, and suggest a better-scoped alternative. - Emit the proposal as text only. Give the full detail first: the target workstream, each proposed milestone (task table + definition of done + source + goal linkage + expected outcome + why-now rationale) and/or inbox note, numbered in proposed priority order. Propose implementation tasks only:
/pmappends the standing closing tasks (Render parity when the milestone is feature dev/a fix touching REST/GraphQL/MCP/UI, then Simplify, then Test coverage, then Closeout) itself when it materializes, so do not include them — but do flag in the proposal whether you expect Render parity to apply, so/pmand the user aren't guessing. Close with a "Summary (priority order)" section: a numbered list of every candidate (milestones and inbox notes together) using the same numbers as above — one line each:N. <title> (wN, ~size) — one-line outcome— so the user can scan and pick by number without rereading the detail. Do not write files. - Hand off to
/pm. End by giving the exact/pmcommand(s) to materialize the proposal, e.g.:/pm new milestone w1 <title>(then the tasks), or/pm add w1 <idea>for sub-hour work, or/pm promote w1/NNNto promote an existing inbox note.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +8 lines 0a734023e4bd
- 1mo ago First seen · 32 lines · 52 tokens per session scan A 3e85c7f50707
pm-brainstorm is a skill published in the GitHub repository bex-co/bex (574 stars, last pushed today), licensed Apache-2.0. It adds 52 tokens to every session and 1,501 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
golang-testing
Go testing best practices including table-driven tests, test helpers, benchmarking, race detection, coverage analysis, and integration testing patterns. Use when writing or improving Go tests.
network-rca
Kubernetes network root cause analysis skill powered by Kubeshark MCP. Use this skill whenever the user wants to investigate past incidents, perform retrospective traffic analysis, take or manage traffic snapshots, extract PCAPs, dissect L7 API calls from historical captures, compare traffic patterns over time, detect…
kfl
KFL2 (Kubeshark Filter Language) reference. This skill MUST be loaded before writing, constructing, or suggesting any KFL filter expression. KFL is statically typed — incorrect field names or syntax will fail silently or error. Do not guess at KFL syntax without this skill loaded. Trigger on any mention of KFL, CEL…
mirrord-prev-env
Help users create and manage mirrord preview environments — running a modified service as an isolated pod in a shared Kubernetes cluster, scoped by an environment key and HTTP/queue traffic filtering, so teams can validate and review changes against real traffic without affecting live services. Use when a developer…
ci
Configure Ginkgo for continuous integration — the recommended CLI flag set and the rationale for each flag (-r -p --randomize-all --randomize-suites --fail-on-pending --fail-on-empty --keep-going --cover --race --trace --json-report --timeout --poll-progress-after/-interval), invoking via go run to pin the CLI to…
debugging-failures
Diagnose a failing Ginkgo suite as an agent — always run with --json-report into a predictable temp/gitignored location, read the terminal verdict line, then use jq to extract structured failure details (name, message, file:line, panic value, captured logs). Covers the panicked-vs-failed trap, panic locations pointing…