Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/pr-pm/prpmnpx agentmods add skills/pr-pm/prpm/prpm-developmentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pr-pm/prpm/prpm-development)<a href="https://agentmods.dev/skills/pr-pm/prpm/prpm-development"><img src="https://agentmods.dev/badge/skills/pr-pm/prpm/prpm-development/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pr-pm/prpm/prpm-development"><img src="https://agentmods.dev/badge/skills/pr-pm/prpm/prpm-development.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.07170 |
| Opus 5.5 | $0.00014 | $0.02868 |
| Sonnet 5.5 | $0.00007 | $0.01434 |
| Haiku 4.5 | $0.00004 | $0.00717 |
Grade A, and why
prpm-development scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 901 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PRPM Development Knowledge Base
Complete knowledge base for developing PRPM - the universal package manager for AI prompts, agents, and rules.
Mission
Build the npm/cargo/pip equivalent for AI development artifacts. Enable developers to discover, install, share, and manage prompts across Cursor, Claude Code, Continue, Windsurf, and future AI editors.
Core Architecture
Universal Format Philosophy
- Canonical Format: All packages stored in normalized JSON structure
- Smart Conversion: Server-side format conversion with quality scoring
- Zero Lock-In: Users convert between any format without data loss
- Format-Specific Optimization: IDE-specific variants (e.g., Claude with MCP)
Package Manager Best Practices
- Semantic Versioning: Strict semver for all packages
- Dependency Resolution: Smart conflict resolution like npm/cargo
- Lock Files: Reproducible installs (prpm-lock.json)
- Registry-First: All operations through central registry API
- Caching: Redis caching for converted packages (1-hour TTL)
Developer Experience
- One Command Install:
prpm install @collection/nextjs-progets everything - Auto-Detection: Detect IDE from directory structure (.cursor/, .claude/)
- Format Override:
--as claudeto force specific format - Telemetry Opt-Out: Privacy-first with easy opt-out
- Beautiful CLI: Clear progress indicators and colored output
Git Workflow - CRITICAL RULES
⚠️ NEVER PUSH DIRECTLY TO MAIN ⚠️
PRPM uses a branch-based workflow with CI/CD automation. Direct pushes to main bypass all safety checks and can break production.
ALWAYS follow this workflow:
-
Create a branch for your changes:
git checkout -b feature/your-feature-name # or git checkout -b fix/bug-description -
Make commits on your branch using conventional commit format:
git add [files] git commit -m "feat: add OpenCode format support"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 901 lines · 36 tokens per session scan A 8bcde8d837c8
prpm-development is a skill published in the GitHub repository pr-pm/prpm (124 stars, last pushed 25d ago), licensed MIT. It adds 36 tokens to every session and 7,170 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
prpm-development compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| prpm-developmentpr-pm/prpm | Skill | 124 | 25d ago | MIT | A | 36 | Claude Code |
| best-practicesMoizIbnYousaf/Ai-Agent-Skills | Skill | 1.2k | 1mo ago | MIT | A | 35 | Claude Code, Codex |
| testing-for-system-prompt-leakageadriannoes/awesome-agentic-ai | Skill | 96 | 6d ago | MIT | A | 21 | Claude Code, Codex |
| red-teaming-llms-with-garakadriannoes/awesome-agentic-ai | Skill | 96 | 6d ago | MIT | B | 49 | Claude Code, Codex |
| llm-prompt-optimizertmolavi/mcp-agent-skills-hub | Skill | 9 | 1mo ago | MIT | A | 35 | Claude Code, Codex |
| openrouternateslabach/skills | Skill | 6 | 1mo ago | MIT | A | 60 | Claude Code, Codex |
| prompt-pilotsavasturkoglu1/promptpilot-plugin | Skill | 3 | 1mo ago | MIT | A | 63 | Claude Code, Codex |