Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add stellarshenson/claude-code-plugins/plugin install project-managementWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/stellarshenson/claude-code-plugins/report)<a href="https://agentmods.dev/skills/stellarshenson/claude-code-plugins/report"><img src="https://agentmods.dev/badge/skills/stellarshenson/claude-code-plugins/report/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/stellarshenson/claude-code-plugins/report"><img src="https://agentmods.dev/badge/skills/stellarshenson/claude-code-plugins/report.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.01610 |
| Opus 5.5 | $0.00022 | $0.00644 |
| Sonnet 5.5 | $0.00011 | $0.00322 |
| Haiku 4.5 | $0.00006 | $0.00161 |
Grade A, and why
report scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 40 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Report
Read the project-management skill first - it is the single source of truth for what the sections mean and how the tables are read. Do NOT duplicate its content here. skills/project-management/references/reports.md carries the section shapes, the filter semantics and --detail.
Toolchain gate (MANDATORY - run before anything else)
Run this first, every session, before any other work. The upgrade always runs; a version mismatch blocks.
python3 -m pip install --user --upgrade stellars-claude-code-plugins 2>&1 | tail -1
LIB=$(python3 -c "import importlib.metadata as m;print(m.version('stellars-claude-code-plugins'))" 2>/dev/null) || { echo "FATAL: toolkit unavailable"; exit 1; }
PLUG=$(grep -m1 '"version"' "${CLAUDE_PLUGIN_ROOT}/.claude-plugin/plugin.json" 2>/dev/null | cut -d'"' -f4)
OLDER=$(printf '%s\n%s\n' "$LIB" "$PLUG" | sort -V | head -1)
[ -n "$PLUG" ] && [ "$LIB" != "$PLUG" ] && [ "$OLDER" = "$LIB" ] && { echo "STALE: library $LIB older than plugin $PLUG - refusing to run on an outdated CLI; re-run the upgrade"; exit 1; }
echo "toolkit $LIB"
Run the CLI without touching the caller's project. The gate above puts it on PATH, so the bare command name is the whole invocation. uv run instead resolves whatever project the working directory sits in and writes uv.lock and .venv into it, so if you reach for uv pass --no-project (uv run --no-project <cli> ...) - it skips project discovery, leaves the tree untouched and still finds the same PATH binary. --no-sync and --frozen are not substitutes; both still create .venv.
Both branches exit non-zero and neither is advisory: an absent library (FATAL) and a version mismatch (STALE). A mismatch means the CLI is not the one this file was written against, so its documented flags and rules are unverified. Report the line and stop; do not work around it.
What to do
- Read the
project-managementskill, thenskills/project-management/references/reports.md - Run
pm-tools reporton the store -docsscans for both disciplines, a path narrows to one - Map a filtered ask onto flags; never filter by hand. "The open defects only" is
--status open, "the critical defects" is--severity CRITICAL, "what @kj has left in AUTH" is--author @kj --category AUTH, "what closed in August" is--dates closed --since 2026-08-01 --until 2026-08-31, "the critical criteria" is--importance CRITICAL, "the regressions" is--regressions, "what is blocked" is--blocked, "everything around DEF-LNCH-3" is--related-to DEF-LNCH-3, "anything whose title, body, evidence or log mentions the token" is--grep token, "what is being worked on" is--lockedand "what @kj is working on" is--locked-by @kj. Flags combine. Every filter narrows the whole report except--status, which narrows ITEMS alone;--detailswaps the ITEMS tables for one block per item. Reading the document and filtering inside the answer is the failure this tool exists to prevent - Asked about test coverage, run
pm-tools coverage- the grid of categories by tags (UNIT,INTEGRATION,FUNCTIONAL,E2E,MANUAL, any other tag,NO-TESTlast), counting open and closed items alike; it takes the same filters - A question no report section answers is a
listor apivot, still a table. Who owns what by severity ispivot --rows author --cols severity; the open work oldest first with owners islist --status open --columns id,title,author,age --sort=-age; regressions per defect ispivot --rows root --regressions --values ids. "Is there already an item about X" issearch "X"- a ranked table, pasted like any other, never a reading of the file. The ask-to-command table and the FIELDS vocabulary are inreferences/reports.md. Never tabulate by hand from the document - shape the table with the tools and paste it - Asked for a summary, run
--summary- it stops at the SUMMARY grid and lists no items, and it is plain by itself. Asked for something plain or short of a full report,--plaingives the grids and the queue with no icons and no CATEGORIES. The grids are plain counts - status per category, then the open items per level - and need no legend - A
wip @xx until <stamp>on an ITEMS row is a soft lock - the item'slock:line; @xx is likely working on that item, and the SUMMARYWorked oncolumn counts them. Ask before picking a locked item up; lock one you pick up yourself withpm-tools lock FILE --id ID --author @xx. The lock never blocks a write, expired locks clear themselves on the next write, andpm-tools unlockclears one at will.report,list,searchandrefsalso printN item(s) currently worked on: DEF-X by @xx until <stamp>on stderr before the table whenever a shown item is locked - read that line before choosing what to work on; taking or clearing an active lock held by another handle is a transfer -lockandunlockprintTRANSFER: DEF-X was locked by @yy until <stamp> - you are taking it over; ask @yyand proceed, and a takeover with no--noterecordstaken over from @yy - Paste the tables verbatim - they are the deliverable. Do not re-type them, do not restate them in prose beside the table, do not summarise a table the user can read. A collection of items is always a table, never a bulleted list
- Add at most one line of your own: what the reader should do next, if anything is obvious from the queue. After a
--summary, add nothing - naming the items, the clusters or the row count underneath puts back what the flag removed - Audit mode - asked to audit rather than report, run
pm-tools check docs --strictfirst and lead with its errors and warnings; the report follows underneath.checkreports, it does not repair: a dangling relation is an errorunrelateremoves, a blocked-by or override cycle and a one-sided override are errors that name therelatecall which repairs them, an open item that is overridden or blocked by finished work is a warning
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed 120f7797fb97
- 16d ago Changed 09003291b968
- 1mo ago Changed b6fe1695b26b
- 1mo ago First seen · 40 lines · 56 tokens per session scan A 442e35267c97
report is a skill published in the GitHub repository stellarshenson/claude-code-plugins (4 stars, last pushed today), licensed MIT. It adds 56 tokens to every session and 1,610 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
team-qa
Orchestrate the QA team through a full testing cycle — qa-lead strategy and test plan, qa-tester case writing, execution, sign-off.
scaffold-dotnet-test-project
MUST USE when an existing .NET test project was excluded from a .slnf/CI solution filter, disappeared from .sln/.slnx discovery, or lost its production ProjectReference; also for requests to set up, create, reuse, add, register, include, or repair a test project. Handles "tests pass directly but CI discovers zero"…
conductor-implement
Execute tasks from a track's implementation plan following TDD workflow.
test-result-feedback
Close the acceptance loop for a tested change — consume the apc test TierResult, map EACH acceptance criterion to a pass/fail outcome from structured fields (never chat text), attach an evidence ref, and write it back to the task. A SUT red is a finding, never softened to green.
cy-execute-task
Implement and verify an existing CompozyOS spec task, then update its tracking. Excludes review remediation.
implement-feature
Implement an approved feature plan with fresh-context slices, TDD, revision-bound evidence, and PR-ready output.