phuryn/pm-skills is a marketplace of reusable skills, commands, and plugins that guide AI assistants through product-management work such as discovery, strategy, planning, metrics, launches, and growth. It is for product managers and teams using Claude Code, Cowork, or compatible assistants. The catalogue entries are the project's own workflows and extensions.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add phuryn/pm-skills --skill code-reviewgit clone --depth 1 https://github.com/phuryn/pm-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/phuryn/pm-skills/code-review)<a href="https://agentmods.dev/skills/phuryn/pm-skills/code-review"><img src="https://agentmods.dev/badge/skills/phuryn/pm-skills/code-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/phuryn/pm-skills/code-review"><img src="https://agentmods.dev/badge/skills/phuryn/pm-skills/code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00074 | $0.03009 |
| Opus 5.5 | $0.00030 | $0.01204 |
| Sonnet 5.5 | $0.00015 | $0.00602 |
| Haiku 4.5 | $0.00007 | $0.00301 |
Grade A, and why
code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 254 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Review
Purpose
Most review output is noise: a list of things that look wrong, unranked, unrefuted, and impossible to act on. This skill produces the opposite — a small number of findings, each with a required behaviour, a feasible trigger, a concrete contradiction, an observable consequence, and the strongest counterargument already checked.
Its central bet: the defects reviewers miss are rarely visible inside one file. They are disagreements between two participants that each look reasonable alone — a caller and a callee, a producer and a consumer, a writer and a later reader, two branches that should establish the same state. A checklist applied file-by-file cannot see those, because the two halves are never in view at the same time. So the unit of review here is the agreement, not the file.
Structure: one engine, three anchors
Code review is the skill. Correctness is its core — the dimension generic tooling covers worst, and the one described in full below. Performance and security are sub-cases: the same engine, the same refutation discipline, the same report contract, with a different anchor and one or two extra rules each.
| Sub-case | Anchor | Where its rules live |
|---|---|---|
| Correctness (core, default) | Agreements between participants across a boundary | This file + references/correctness-taxonomy.md |
| Performance | Workload → resource demand → growth or contention → consequence | references/performance-review.md |
| Security | Source → trust boundary → sink, with an attacker controlling the source | references/security-review.md |
Read a sub-case's file only when that sub-case is selected. Each is short on purpose: it states what differs, and the rest of this file still applies.
Sub-cases are independently activated, not mutually exclusive. One root cause can carry correctness and security impact — report it once, with both impacts.
Invocation
/pm-ai-shipping:code-review
/pm-ai-shipping:code-review dimensions=correctness scope=changes
/pm-ai-shipping:code-review dimensions=performance,security
/pm-ai-shipping:code-review dimensions=all
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 254 lines · 74 tokens per session scan A d542b88452e3
code-review is a skill published in the GitHub repository phuryn/pm-skills (27,091 stars, last pushed yesterday), licensed MIT. It adds 74 tokens to every session and 3,009 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-15.
Other skills, from other repositories
meta-review
Audits any SKILL.md in this repo against SKILL-SPEC.md, the skill authoring standard — checks frontmatter, the seven required sections, tier-appropriate sections, and quality-gate structure, then returns a scored checklist with prioritized fixes. Trigger on: "review this skill", "audit this SKILL.md", "does this skill…
meta-verify
Runs a second-pass quality check on a skill's output before it goes out — re-checks it against the originating skill's own Quality Gate and Operating Rules, and returns specific fixes rather than a pass/fail verdict alone. Trigger on: "verify this", "check this before I send it", "second-pass this brief", "did that…
roslyn-query
Query .NET/C# codebases using Roslyn AST analysis via dotnet run file. Use for tracing data flow, auditing API usage, finding pattern violations, or ad-hoc codebase queries.
pmm-resume
Resume reviewer and tailoring engine for Product Marketing Managers (IC to VP, including AI PMM roles). Takes baseline resume + job description → dissects JD → ranks bullets by impact fit → rebuilds complete resume in one pass. Trigger on: resume + JD paste, "tailor this", "which bullets for this role", "rebuild for…
product-marketing-context
Build and maintain the shared GTM brain — product context, ICP, positioning, voice, market context, proof points, plus optional strategy and execution, and the deal-reality fields (objections, switching forces, customer language, anti-persona) — that every other skill in this stack reads before producing output. Works…
workflow-orchestrator
Orchestrates multi-skill PMM programs end-to-end — chains positioning, competitive, GTM strategy, campaign briefs, stakeholder maps, and retros into one coherent program with a master document and brain updates. Trigger on: "run full GTM workflow", "run a full launch", "launch [product] end to end", "positioning…