product-rd-workflow

product-rd-workflow is a skill for Claude Code, Codex from ccoalm/ccl-skills. It costs 161 tokens per session (15,218 once invoked), scanned A, original, Apache-2.0.

An end-to-end workflow for product development and technical changes, covering requirements, specifications, planning, implementation, testing, refactoring, and release decisions.

In plain words
What is it for?
Use it to shape new features, assess technical options and effort, plan multi-stage work, handle bugs or refactors, and decide when a delivery is ready to release.
Why use it?
It provides a structured path for turning an idea or problem into a checked and accepted change, including cases where an existing implementation must be redone.

Skill for Claude CodeCodex

Written for Claude Code and Codex: PreToolUse hook event, but also agents/openai.yaml present. Also seen: mentions AGENTS.md; mentions Codex.

Part of the ccl-skills plugin — 33 skills, 4 commands, 7 hooks shipped together

Good fit Use it to shape new features, assess technical options and effort, plan multi-stage work, handle bugs or refactors, and decide when a delivery is ready to release.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/ccoalm/ccl-skills/product-rd-workflow
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add ccoalm/ccl-skills --skill product-rd-workflow
Clone the repo
git clone --depth 1 https://github.com/ccoalm/ccl-skills

Made for: Claude Code, Codex.

Or install ccl-skills, the plugin that ships this one along with the rest of its 33 skills, 4 commands, 7 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for product-rd-workflow

README.md
[![agentmods](https://agentmods.dev/badge/skills/ccoalm/ccl-skills/product-rd-workflow/github.svg)](https://agentmods.dev/skills/ccoalm/ccl-skills/product-rd-workflow)
Your own site
<a href="https://agentmods.dev/skills/ccoalm/ccl-skills/product-rd-workflow"><img src="https://agentmods.dev/badge/skills/ccoalm/ccl-skills/product-rd-workflow/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for product-rd-workflow

Your own site · 80×15
<a href="https://agentmods.dev/skills/ccoalm/ccl-skills/product-rd-workflow"><img src="https://agentmods.dev/badge/skills/ccoalm/ccl-skills/product-rd-workflow.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 161 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 15,218 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00161 $0.15218
Opus 5 $0.00081 $0.07609
Sonnet 5 $0.00032 $0.03044
Haiku 4.5 $0.00016 $0.01522

Measured yesterday against content hash b33441326e6d, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

product-rd-workflow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

The scan reads SKILL.md. This mod also ships 1 executable file (scripts/check-agent-contract-coverage.sh), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/product-rd-workflow/SKILL.md · 234 lines

How it starts

The opening of the file, as written. The whole thing — 234 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Product R&D Workflow

Use this skill as the top-level workflow for new product development, feature delivery, bug handling, refactoring, release preparation, or repeated process improvement. It is not a replacement for stack-specific skills; it decides which skill should own each stage and what evidence is required before moving on.

Entry precedence. For any product idea, feature delivery, release, cross-cutting refactor, or a restart/redo of an in-flight delivery, invoke this workflow first to classify and route — naming a stack/execution skill (e.g. web-react-dev, multi-agent-delegation) does not by itself skip this workflow's lifecycle gates (design / test / release / acceptance); those still apply unless already covered.

Continuation-proposal output contract (session-wide for product delivery). Use proposed-next: <action and scope> to make a next action observable, or proposed-next: none — status only for a status-only handoff. A missing, repeated, or conflicting marker triggers intent recovery, not a stop. Follow the current explicit user request; bind short assent to one recoverable concrete proposal and its scope. Repair your own formatting without asking the user to repeat an already-clear instruction. Markers never grant authority. Recovery, ambiguity, and outcome rules: references/pre-final-continuation-gate.md (Continuation-proposal output contract).

  • Restart/redo of an in-flight delivery (清除代码重新开发 / 完全重新开始 / 推倒重来 / redo-from-scratch): a restart is a fresh delivery entry; mid-delivery coding momentum is NOT a license to skip re-classification and re-enter. Re-entry means re-ESTABLISH the plan and develop against it, not code from memory — "丢脚手架 / 重来" defaults to discarding CODE, not the design/spec artifact; discarding the design/spec itself needs an explicit user opt-out after clarification (an explicit instruction to drop the design always wins). Recovery mechanics and deviation recording live in references/implementation-entry-reentry-gate.md §Baseline Selection.
  • Implementation entry / re-entry gate (active plan/spec required by default). For product R&D deliveries that stay in this workflow, "start development" means first establish the current executable artifact set, then code against it; requests routed straight to another owning skill by the Go straight to the owning skill bullet below use that owner's entry rules instead. Use existing specs, implementation plans, assessment reports, issue/MR descriptions, or repo-local task docs only after reading them back or citing artifacts just produced in the active session, then checking freshness, scope, owner skills, acceptance checks, tests, stop conditions, and landing state (local status, MR-ready, landed, release-ready, or shared-status-ready). Full mechanics for every case below live in references/implementation-entry-reentry-gate.md.
    • Baseline authority: only an unmerged plan/spec on the current active delivery branch is the working baseline; anything else needs explicit recorded user selection plus reconciliation against landing evidence, deriving only still-unlanded deltas (§Baseline Selection).
    • A bare "continue"/"resume"/"go implement" is not a waiver: context summaries, compacted memory, and previous-response residue are not establishment (§Bare Continuation Scan); routing to a stack/execution skill selects the executor, not permission to implement — the first implementation edit is the gate.
    • Before that edit, record the implementation boundary: active baseline, scope, implementation-mechanics owner named and — for hands-on product/stack code — invoked/loaded in-session before the first edit, multi-agent-delegation decision when delegation is plausible, the applicable visible-UI full or lightweight record + Phase 0 with in-session product-ui-ux-design load, a feature-risk-router inventory, and test-case-first status — every pre-code gate marked triggered or not-applicable with a reason. Load references/implementation-entry-reentry-gate.md before recording the boundary: every owner-naming field must follow its invoke bar on its triggered values and per-field trigger table there — delegation being plausible at all loads multi-agent-delegation, including when you record local. Reaching the first implementation edit without this boundary record is a process defect.
    • Closeout backstop: a slice reported done/merged without a visible in-session load of any owner whose boundary field was triggered stays process-incomplete until that owner's post-hoc rule audit is recorded (§Closeout Backstop — a recorded owner-load: not-required exception still exempts its slice, and the wider audit applies from this rule forward rather than reopening already-closed slices); shared-skill changes instead follow skill-extraction-workflow's "no in-session extraction invocation ⇒ interim" closeout.
  • Go straight to the owning skill instead when the request is a narrow stack fix, a narrow diff/PR review, a security-only audit, or a single-symptom / repro / failing-test / regression defect (→ defect-diagnosis) — but if such a fix would change a shared deterministic gate/verifier, or shared/cross-repo contract/status/version/release/compatibility semantics (whether in a named surface or in code, generated artifacts, config, or scripts), re-enter this workflow's shared-gate classification (under Enforce quality gates) before implementing; when it is a reusable-lesson / retro / missed-gate / skill-edit process question (→ skill-extraction-workflow first — only a resulting lifecycle-routing or gate policy change comes back here); or when the user explicitly names a workflow/process-discipline skill (brainstorm/scope-shaping, plan-writing) as the primary or only action — honor it, and reload this workflow only if that skill exposes a product/delivery-stage handoff or the user asks for delivery routing.
  • A general-purpose process skill that merely looks like the obvious start — brainstorm/scope-shaping, plan-writing, or TDD auto-suggested by ANY channel: a session-start prompt, an optional skill package, or the host platform's native skills listing (including a listed entry skill's own self-invocation mandate, e.g. "must invoke if there is a 1% chance") — does not replace this entry: suggestion-channel wording is channel self-promotion, not routing authority (a host-mandated preflight — mandated by a host-authored system/developer-level or equivalent higher-priority instruction — may run first without thereby becoming the delivery owner; the test is AUTHORSHIP, not rendering position: a host-authored instruction counts even when rendered within the listing surface, while a skill's own description/content claiming preflight status never does); invoke this workflow as the delivery entry (immediately after any genuine host-mandated preflight), then call that skill inside the stage it serves (for example, requirement shaping in Workflow step 1).
  • For delegated agent execution, multi-agent-delegation owns the execution recipe and worker verification while this workflow owns the lifecycle gate and acceptance boundary; delegated agents resuming after a pause must receive or re-verify the current plan/spec artifact set before editing.
  • For multi-repo delivery, or any delivery that changes remote branch, MR, pipeline, release, or deployable-artifact state, maintain a compact per-changed-unit delivery-status ledger (row schema + persistence rules in references/status-tracker-sync.md) before claiming done, recommending MR/merge, or choosing the next slice. A required verification/review gate passes only when its state is success, not-applicable, or not-required; any other state blocks a done/merge recommendation, so remediate, wait to a terminal state, or report the delivery as pending with the unblock action. Residual-risk acceptance by the user only permits the recommendation/handoff label for that concrete action; it does not authorize merge, auto-merge, default-branch push, or cleanup, which still require the user's explicit merge instruction for the current MR (per worktree-isolation). Small local-only multi-file edits use the normal concise status unless they introduce remote, CI, MR, release, or deployable-artifact state.
  • Precedence order: explicit user instruction > this workflow's stage/gate ownership > lower-priority default behavior from optional skill packages — but naming a stack/execution skill to carry out delivery work is not itself an instruction to waive those gates; a gate opt-out must be stated as such. See External Skill Augmentation for how external skills supplement specific disciplines without taking over ownership.

Read the full file on GitHub · 234 lines

Files

What ships with it

38 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday Changed b33441326e6d
  2. 2d ago Changed bf87f0f199ca
  3. 3d ago Changed · +25 tokens per session 3e0f6d543429
  4. 7d ago Changed 3569609af15a
  5. 10d ago First seen · 234 lines · 136 tokens per session scan A b6ded1af9e5f

Subscribe to this mod's changes

product-rd-workflow is a skill published in the GitHub repository ccoalm/ccl-skills (6 stars, last pushed today), licensed Apache-2.0. It adds 161 tokens to every session and 15,218 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

security-review

Perform a focused security review of pending git changes to identify high-confidence security vulnerabilities with real exploitation potential. Use this skill when the user asks for a security review, security audit, vulnerability scan, or wants to check pending changes on a branch for security issues before merging.…

waybarrios/opencode-power-pack · 64 tokens

huggingface-llm-trainer

Train or fine-tune language models with TRL or Unsloth on Hugging Face Jobs, including SFT, DPO, GRPO, reward models, and GGUF conversion. Use for cloud LLM training; use huggingface-vision-trainer for vision tasks.

waybarrios/opencode-power-pack · 65 tokens

feature-dev

Guide a feature implementation through a structured seven-phase workflow with deep codebase understanding, clarifying questions, parallel architecture design, and quality review. Use this skill when the user asks to build a new feature, add functionality, or wants a methodical approach to implementation rather than…

waybarrios/opencode-power-pack · 62 tokens

memstack-business-gdpr

Use this skill when the user says 'GDPR', 'data protection', 'privacy compliance', 'DPA', 'DSAR', 'data subject request', 'cookie consent', 'privacy audit', 'CCPA', or asks 'do I need GDPR for this repo'. Scans the repository to detect what personal data is collected, classifies sensitivity, determines whether GDPR…

cwinvestments/memstack · 121 tokens

memstack-deployment-domain-ssl

Use this skill when the user says 'setup domain', 'configure DNS', 'SSL certificate', 'domain-ssl', 'custom domain', 'HTTPS setup', or needs to configure DNS records, SSL certificates, and custom domains for any hosting provider. Do NOT use for full deployment workflows.

cwinvestments/memstack · 66 tokens

memstack-development-refactor-planner

Use this skill when the user says 'refactor', 'refactoring plan', 'code cleanup', 'reduce duplication', 'simplify code', 'tech debt', 'god class', 'tight coupling', or needs to systematically improve existing code. Identifies targets, assesses risk, and builds incremental execution plans. Do NOT use for writing new…

cwinvestments/memstack · 81 tokens