Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add naderelewa/Product-to-Prod/plugin install product2prodWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/naderelewa/product-to-prod/pm-requirements-v1)<a href="https://agentmods.dev/skills/naderelewa/product-to-prod/pm-requirements-v1"><img src="https://agentmods.dev/badge/skills/naderelewa/product-to-prod/pm-requirements-v1/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/naderelewa/product-to-prod/pm-requirements-v1"><img src="https://agentmods.dev/badge/skills/naderelewa/product-to-prod/pm-requirements-v1.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00207 | $0.04766 |
| Opus 5 | $0.00103 | $0.02383 |
| Sonnet 5 | $0.00041 | $0.00953 |
| Haiku 4.5 | $0.00021 | $0.00477 |
Grade B, and why
pm-requirements-v1 scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks the agent to reveal its instructionsmediumSystem prompt leakage
Directions to print, repeat or translate the system prompt extract configuration the operator did not intend to expose.
(`--setup` performs the installable ones; authentication flows print instructions and are never How it starts
The opening of the file, as written. The whole thing — 328 lines — stays where its author put it; the contents beside it link to each section on GitHub.
pm-requirements-v1, strategy statement → handoff package
Build a rigorous, evidence-tagged requirements case for ONE release scope and close it as a handoff package: a directory a sceptical reviewer can verify in minutes and an engineering toolchain can consume without a single paste.
This verb is the product-and-strategy half of the loop. It produces documents and the design-gate scaffold. It writes no code, runs no tests, merges nothing, and authors no engineering records.
The boundary is hard. Downstream of the final gate, everything belongs to whoever builds it.
Where an engineering toolchain is configured, its surface registry is READ-ONLY ground truth, read
surface names from it, never edit it, never hardcode its values. Where none is configured this verb
runs in standalone mode and says so; see references/eng-handoff-adapter.md at the plugin root.
Preflight (run first)
PKG_ROOT="${CLAUDE_PLUGIN_ROOT:-${PKG_ROOT:-}}"
[ -n "$PKG_ROOT" ] && [ -r "$PKG_ROOT/.claude-plugin/plugin.json" ] || { echo "STOP: set PKG_ROOT to this package's root directory, the one holding .claude-plugin/plugin.json, then re-run."; exit 2; }
bash "$PKG_ROOT/scripts/preflight.sh" pm-requirements-v1 [--stack <keys>]
A job-scoped capability check against config/dependencies.json. Run it BEFORE P0 with no --stack.
A miss on a required capability blocks the run, and every miss prints its exact one-time fix
(--setup performs the installable ones; authentication flows print instructions and are never
auto-run). Conditional capabilities are resolved at right-sizing: once the stack is locked, re-run
with the matching keys. A selected-conditional miss blocks exactly like a required one. A missing
capability notifies and blocks, it never silently degrades into a quieter, wronger answer.
What a run delivers, standalone vs supercharged (projected from config/dependencies.json;
the miss discipline above is unchanged):
- STANDALONE (required only,
python3, andshasumorsha256sum): the full P0→P4 cycle over run-supplied and pack evidence: locked constants, a tagged evidence ledger, the classified spec, the assembled handoff package. Claims that would need live analytics or a docs workspace ride NEEDS-CONFIRMATION rows instead of being measured. This is a complete deliverable, not a stub. - SUPERCHARGED, each locked
--stackkey adds its capability rows, one or more:eng-handoff(the downstream registry + contract check) ·analytics-verification(measured funnel and behaviour claims instead of NEEDS-CONFIRMATION rows) ·design-extraction(design-kit parity reads) ·backlog-sync(issue-tracker cross-checks) ·workspace-docs(workspace pages as citable sources) ·repo-state(repository and change-request state reads).
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 328 lines · 207 tokens per session scan B 647588ee7d02
pm-requirements-v1 is a skill published in the GitHub repository naderelewa/Product-to-Prod (43 stars, last pushed yesterday), licensed MIT. It adds 207 tokens to every session and 4,766 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it B with 1 finding (asks the agent to reveal its instructions). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
catchup
Summarize and review what changed while you were away. Use after a weekend, vacation, or flight to check missed PRs, git commits, Linear tickets, and meetings — one prioritized brief, not a firehose.
plan
Plan features spanning multiple domains: billing (Stripe), auth (RBAC), real-time (Presence), webhooks, jobs (Oban). Use when designing interconnected systems or converting review findings into tasks.
work
Execute Elixir/Phoenix plan tasks with progress tracking. Use after /phx:plan to implement features with mix compile and mix test verification after each step, or --continue to resume interrupted work.
phx-deps-update
Bump outdated Hex deps — inventory, snapshot changelogs, update, fix breaks, split reviewable PRs (patches bundled, majors solo). Use to upgrade/bump Elixir dependencies or when versions fall behind. NOT for deps.get failures (phx-investigate).
new-work
Create and manage todo tracking documents for features, bugs, and multi-step tasks. Use when starting new work that benefits from a persistent record of decisions, progress, and context.
chief-operating-officer
Owns execution: how work actually gets done across the organization, including process, program management, capacity, vendors, supply chain, and service delivery. Use this when execution is the problem rather than strategy, to design or fix a process, to resolve cross-functional handoff failures, to plan capacity, to…