Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add naderelewa/Product-to-Prod/plugin install product2prodWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/naderelewa/product-to-prod/pm-start)<a href="https://agentmods.dev/skills/naderelewa/product-to-prod/pm-start"><img src="https://agentmods.dev/badge/skills/naderelewa/product-to-prod/pm-start/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/naderelewa/product-to-prod/pm-start"><img src="https://agentmods.dev/badge/skills/naderelewa/product-to-prod/pm-start.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00142 | $0.02114 |
| Opus 5 | $0.00071 | $0.01057 |
| Sonnet 5 | $0.00028 | $0.00423 |
| Haiku 4.5 | $0.00014 | $0.00211 |
Grade A, and why
pm-start scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 139 lines — stays where its author put it; the contents beside it link to each section on GitHub.
pm-start, the product front door (dispatcher only)
You are the DISPATCHER. You do not research, write specs, score backlogs, plan go-to-market, or verify releases yourself. You interview, you lock the context, you route. The verb you route to does the work under its own gates, and it re-echoes what it inherited before it starts.
Why a dispatcher exists at all: every verb here opens by locking constants, and a run that locks the wrong company, the wrong output, or the wrong destination wastes the whole cycle rather than one question. Four questions up front is the cheapest gate in the system.
Step 0, no preflight here, deliberately
pm-start needs no capabilities of its own: it reads nothing and writes nothing. The ROUTED verb runs
its own job-scoped preflight against config/dependencies.json, because required capabilities differ
per verb and a front door that probed for all of them would block on things this ask never needs.
Two situations do call for a check before you route:
PKG_ROOT="${CLAUDE_PLUGIN_ROOT:-${PKG_ROOT:-}}"
[ -n "$PKG_ROOT" ] && [ -r "$PKG_ROOT/.claude-plugin/plugin.json" ] || { echo "STOP: set PKG_ROOT to this package's root directory, the one holding .claude-plugin/plugin.json, then re-run."; exit 2; }
bash "$PKG_ROOT/scripts/hostcheck.sh" # BEFORE installing/enabling this plugin on a host
bash "$PKG_ROOT/scripts/preflight.sh" --help # what each verb requires, and its stack keys
bash "$PKG_ROOT/scripts/update-check.sh" # advisory: one line if a newer release exists, silent otherwise
hostcheck.sh is report-only: it inventories the tool servers this host already runs, diffs them
against what this plugin brings, and prints a plan you approve and execute yourself. It never
installs, removes or enables anything, and it writes no file of its own. One qualifier, because
that promise is about this script's own writes: when the default harness CLI is present it calls
that CLI to list servers, and that tool may create its own configuration in your home directory on
a machine where it has never run. Run it on a new host, and any time duplicated tools are
suspected.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 139 lines · 142 tokens per session scan A 23de2e5731d2
pm-start is a skill published in the GitHub repository naderelewa/Product-to-Prod (42 stars, last pushed yesterday), licensed MIT. It adds 142 tokens to every session and 2,114 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
catchup
Summarize and review what changed while you were away. Use after a weekend, vacation, or flight to check missed PRs, git commits, Linear tickets, and meetings — one prioritized brief, not a firehose.
plan
Plan features spanning multiple domains: billing (Stripe), auth (RBAC), real-time (Presence), webhooks, jobs (Oban). Use when designing interconnected systems or converting review findings into tasks.
work
Execute Elixir/Phoenix plan tasks with progress tracking. Use after /phx:plan to implement features with mix compile and mix test verification after each step, or --continue to resume interrupted work.
phx-deps-update
Bump outdated Hex deps — inventory, snapshot changelogs, update, fix breaks, split reviewable PRs (patches bundled, majors solo). Use to upgrade/bump Elixir dependencies or when versions fall behind. NOT for deps.get failures (phx-investigate).
new-work
Create and manage todo tracking documents for features, bugs, and multi-step tasks. Use when starting new work that benefits from a persistent record of decisions, progress, and context.
chief-operating-officer
Owns execution: how work actually gets done across the organization, including process, program management, capacity, vendors, supply chain, and service delivery. Use this when execution is the problem rather than strategy, to design or fix a process, to resolve cross-functional handoff failures, to plan capacity, to…