product-on-purpose/utility-pm-skill-auditor
skills/utility-pm-skill-auditor/SKILL.md
Run a repo-wide cross-cutting governance audit via the pm-skill-auditor sub-agent. Aggregates the enforcing validator suite, re-derives aggregate counters, and surfaces cross-cutting issues no single validator catches, graded P0/P1/P2/P3 with a machine-readable status. Use for pre-release readiness checks or a periodic repo health audit.
$ install --global
skillsauthnpx skillsauth add product-on-purpose/pm-skills utility-pm-skill-auditorInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 11, 2026, 5:13 AM363.9s4 files scanned
SKILL.md
- name:
- utility-pm-skill-auditor
- description:
- Run a repo-wide cross-cutting governance audit via the pm-skill-auditor sub-agent. Aggregates the enforcing validator suite, re-derives aggregate counters, and surfaces cross-cutting issues no single validator catches, graded P0/P1/P2/P3 with a machine-readable status. Use for pre-release readiness checks or a periodic repo health audit.
- license:
- Apache-2.0
- classification:
- utility
- version:
- 1.0.1
- updated:
- 2026-06-10
- category:
- governance
- frameworks:
- [triple-diamond]
- author:
- product-on-purpose
<!-- PM-Skills | https://github.com/product-on-purpose/pm-skills | Apache 2.0 -->
PM Skill Auditor (Dispatch Skill)
Cross-client dispatch wrapper for the pm-skill-auditor sub-agent. Detects runtime; dispatches to the native sub-agent on Claude Code; reads agents/pm-skill-auditor.md and executes inline on non-Claude clients.
When to Use
- You need a repo-wide audit pass: all enforcing validators, cross-cutting checks (skill-without-command, sample gaps, family contract orphans, etc.), and aggregate counter re-derivation against declared values in CONTEXT.md + AGENTS.md + README.md
- You are running on a non-Claude AI client without native pm-skill-auditor sub-agent support
- You are running on Claude Code and prefer skill-invocation semantics (e.g., for chaining inside a workflow that also uses other dispatch skills)
When NOT to Use
- You want to review a specific PM artifact (PRD, OKR, persona) -> use
utility-pm-criticinstead - You want to draft a CHANGELOG entry -> use
utility-pm-changelog-curator(ships in Phase 4) - You want to ship a release -> use
utility-pm-release-conductor(ships in Phase 5) - You want to FIX issues found in an audit -> the auditor is detection-only; remediation is maintainer judgment or future
pm-frontmatter-doctor(v2.17+)
Instructions
Runtime detection step. Determine which AI client is invoking this skill.
If you are running in Claude Code with the pm-skills plugin installed
Invoke @agent-pm-skills:pm-skill-auditor on the repo. Pass any scope arguments from $ARGUMENTS (e.g., --scope changed, --since-tag v2.15.0, --severity-floor P1). Return the sub-agent's audit report to the user.
If you are running in any other AI client
Codex CLI, Cursor, Windsurf, Copilot, Gemini CLI, or any other client without native pm-skills plugin sub-agent support:
- Read the canonical sub-agent definition at
agents/pm-skill-auditor.md - Execute the system prompt body in that file as your operating instructions for this turn
- Run the four-step audit flow:
- Step 1: Invoke validators via Bash (prefer
bash scripts/pre-tag-validate.shas canonical entry point) - Step 2: Run cross-cutting checks from the catalog at
docs/internal/release-plans/v2.16.0/spec_pm-skill-auditor.md#cross-cutting-check-catalog - Step 3: Re-derive aggregate counters from filesystem and compare to declared values
- Step 4: Compose layered output report
- Step 1: Invoke validators via Bash (prefer
- Apply scope and severity-floor arguments from
$ARGUMENTS - Return the layered output per master plan D26 (full report + Status Summary + Status YAML)
Cross-Client Notes
See Sub-Agent Compatibility Matrix for the canonical cross-client status. Summary for this skill as of v2.16.0: PRODUCTION on Claude Code + Codex CLI (Codex CLI successfully invoked the validator suite via Bash + produced a layered audit report with re-derived aggregate counters); EXPERIMENTAL on Cursor / Windsurf / Copilot CLI / Gemini CLI.
The "read canonical agent definition and execute inline" pattern depends on the AI client being able to:
- Read a referenced file path
- Execute Bash to invoke validator scripts
- Treat the agent definition body as operating instructions for the current turn
Most AI clients support all three. If any are unreliable on a specific client, that client falls back to manual validator invocation + manual cross-cutting checks.
Reference Files
- Canonical sub-agent definition:
agents/pm-skill-auditor.md - Behavioral spec:
docs/internal/release-plans/v2.16.0/spec_pm-skill-auditor.md - Runtime components catalog:
docs/reference/runtime-components.md - Cross-cutting check catalog:
docs/internal/release-plans/v2.16.0/spec_pm-skill-auditor.md#cross-cutting-check-catalog - Pre-tag validator bundle:
scripts/pre-tag-validate.{sh,ps1} - Output template:
references/TEMPLATE.md - Worked example:
references/EXAMPLE.md
Related Skills
product-on-purpose/utility-pm-workflow-builder
tools
VerifiedTrustedCommunity
Guides a contributor from a workflow idea to a complete Workflow Implementation Packet (draft workflow file, draft workflow command, cross-cutting update checklist) in a staging area for review. Runs overlap analysis against the existing workflows with a Why Gate, then helps select and sequence skills with authored handoffs. Use when creating a new multi-skill workflow or promoting a repeated ad-hoc chain into a durable one. To build a single skill instead, use utility-pm-skill-builder; to run a sequence without authoring anything, use the chain command or utility-pm-workflow-orchestrator.
287SKILL.mdUpdated Jun 11, 2026
product-on-purpose/utility-pm-workflow-orchestrator
tools
VerifiedTrustedCommunity
Run an ordered sequence of pm-skills against one input, pausing for go/no-go and stopping on a failed or empty step. Accepts a saved prioritized action plan (Mode A) or an ad-hoc named chain (Mode B; the chain command routes here). Explicit invocation only; run --dry-run first while the native path is EXPERIMENTAL. To author a durable workflow instead, use utility-pm-workflow-builder.
287SKILL.mdUpdated Jun 4, 2026
product-on-purpose/utility-pm-release-conductor
tools
VerifiedTrustedCommunity
Walk the guided 6-gate release runbook (G0 readiness, G1 adversarial review, G2 version bump and CHANGELOG, G2.5 commit and re-verify, G3 tag and push, G4 post-tag hygiene) via the pm-release-conductor sub-agent. Refuses gate bypasses and tags only the re-verified SHA. Use when cutting a pm-skills release.
287SKILL.mdUpdated May 18, 2026
product-on-purpose/utility-pm-critic
tools
VerifiedTrustedCommunity
Run adversarial review on a PM artifact via the pm-critic sub-agent. Returns findings graded P0/P1/P2/P3 with a concrete fix suggestion per finding and a machine-readable status block. Use after producing a PRD, meeting recap, OKR set, persona, or any PM artifact you want stress-tested before it ships.
287SKILL.mdUpdated May 18, 2026