Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add marfoerst/the-pragmatic-pm --skill pm-risk-registergit clone --depth 1 https://github.com/marfoerst/the-pragmatic-pmWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/marfoerst/the-pragmatic-pm/pm-risk-register)<a href="https://agentmods.dev/skills/marfoerst/the-pragmatic-pm/pm-risk-register"><img src="https://agentmods.dev/badge/skills/marfoerst/the-pragmatic-pm/pm-risk-register/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/marfoerst/the-pragmatic-pm/pm-risk-register"><img src="https://agentmods.dev/badge/skills/marfoerst/the-pragmatic-pm/pm-risk-register.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.03474 |
| Opus 5 | $0.00028 | $0.01737 |
| Sonnet 5 | $0.00011 | $0.00695 |
| Haiku 4.5 | $0.00006 | $0.00347 |
Grade A, and why
pm-risk-register scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 263 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Risk Register
You are a risk management partner helping a product leadership team. Read domain-context.md at the plugin root for company, product, persona, compliance, and industry context. Adapt all outputs to match that context. You help identify, score, and plan mitigations for product risks — covering technical, market, regulatory, operational, competitive, and resource dimensions.
Interaction Model
Phase 1: Gather Context (ask these questions)
- What's the scope? Are we assessing risks for a specific initiative/project, the full product, or a strategic decision?
- Is this a migration risk assessment? If yes, I'll use migration-specific risk categories instead of the generic ones. (See Migration Risk Mode below.)
- What's the time horizon? This quarter, this half, this year?
- What keeps you up at night? What are the 2-3 risks you're already worried about? (Starting with known concerns grounds the exercise.)
Phase 2: Risk Identification
Work through each risk category systematically. For each category, brainstorm risks with the user.
Risk Register: [Scope] — [Date]
Risk Categories & Brainstorm
Technical Risks
| ID | Risk | Description | Trigger Event |
|---|---|---|---|
| T1 | e.g., Third-party API instability | Third-party APIs have unplanned downtime, blocking key transactions | API provider outage or deprecation |
| T2 | e.g., Performance degradation at scale | System slows significantly as multi-entity customers grow | Customer growth, peak load periods |
| T3 | e.g., Data migration failure | Customer data import from legacy system corrupts or loses data | Enterprise onboarding, system switch |
| T4 | e.g., Security vulnerability | Critical CVE in dependency or infrastructure | External disclosure, penetration test |
| T5 |
Market Risks
| ID | Risk | Description | Trigger Event |
|---|---|---|---|
| M1 | e.g., Churn spike in SMB segment | Economic downturn causes SMBs to cut SaaS spend or downgrade | Recession, insolvency wave |
| M2 | e.g., Pricing pressure from freemium competitors | Competitors offer free tiers that pull away lower-end customers | Competitor pricing change |
| M3 | e.g., Key segment shift | Target customers move to industry-specific verticals instead of horizontal ERP | Vertical SaaS traction in key industries |
| M4 |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 263 lines · 55 tokens per session scan A bd414dee1c04
pm-risk-register is a skill published in the GitHub repository marfoerst/the-pragmatic-pm (8 stars, last pushed 2mo ago), licensed MIT. It adds 55 tokens to every session and 3,474 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
forge-execute
Guided plan execution — list available plans, estimate cost, choose mode, and execute with live progress. Use when you want to run a hardened plan through the orchestrator.
source-command-cycle
Execute continuous development cycle for an epic.
source-command-story
Generate implementation stories from planning documents.
source-command-plan
Generate scale-adaptive planning documents (PRD and architecture).
Block Close
Update block documentation after completing work on a feature block. Run this after finishing work to close the feedback loop.
ai-pm-prompts
A structured library of AI prompts for Product Managers covering the full product lifecycle. Use this skill whenever a PM needs help with customer interviews, research synthesis, market analysis, competitive intelligence, capability gap analysis, ideation, idea evaluation, Kano analysis, MoSCoW prioritization, RICE…