registry / pm-claude-skills / 47.0.0

pm-claude-skills@47.0.0

466 professional Agent Skills (SKILL.md) + subagents + slash commands for Claude, ChatGPT, Gemini, Cursor, Codex & Hermes. It's a CLI, not a library: run `npx pm-claude-skills add --agent <tool>` to install into your AI tool — no `npm install` needed. Or

Static Scan Results

scanned 8h ago · by rust-scanner

Static analysis flagged 23 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 130 KB of source, external domains: api.anthropic.com, api.github.com, api.openai.com, generativelanguage.googleapis.com, github.com, mohitagw15856.github.io, raw.githubusercontent.com, www.apple.com

Source & flagged code

16 flagged

package.jsonView file

Lines 39-79json

39 "bin": {

40 "pm-claude-skills": "bin/cli.mjs",

41 "pm-claude-skills-mcp": "mcp/server.mjs"

42 },

43 "files": [

44 "icon.svg",

45 "bin/",

46 "mcp/",

47 "skills/",

48 "agents/",

49 "commands/",

50 "output-styles/",

51 "exports/",

52 "templates/",

53 "connectors/",

54 "skill-tiers.json",

55 "skill-sources.json",

56 "workflows.json"

57 ],

58 "scripts": {

59 "postinstall": "node bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L59

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L59

60 "new-skill": "node scripts/new-skill.mjs",

61 "new-bundle": "node scripts/new-bundle.mjs",

62 "skillcheck": "node scripts/skillcheck.mjs",

63 "build:exports": "node scripts/build-exports.mjs",

64 "build:web": "node web/build-skills.mjs",

65 "build:workflows": "node scripts/build-workflows.mjs",

66 "build:samples": "node scripts/build-samples.mjs",

67 "build:pages": "node scripts/build-skill-pages.mjs",

68 "build:community": "node scripts/build-community.mjs",

69 "build:og": "node scripts/build-og-images.mjs",

70 "build:deck": "node scripts/build-deck.mjs",

71 "build:show": "node scripts/build-morning-show.mjs",

72 "skill-of-the-week": "node scripts/skill-of-the-week.mjs",

73 "check": "node scripts/skillcheck.mjs && node scripts/build-exports.mjs --check && node scripts/build-workflows.mjs --check && node web/build-skills.mjs && node scripts/build-samples.mjs && node scripts/build-skills-md.mjs && git diff --exit-code -- web/skills.json web/samples.json SKILLS.md",

74 "improve": "node scripts/improve-skill.mjs",

75 "eval:gen-cases": "node scripts/gen-eval-cases.mjs",

76 "eval:all": "node scripts/gen-eval-cases.mjs && node evals/run-evals.mjs --cases evals/cases.full.json --models claude-haiku-4-5-20251001 --judge claude-haiku-4-5-20251001"

77 },

78 "devDependencies": {

79 "qrcode": "^1.5.4"

bin/lib/scheduler.mjsView file

Lines 1-21javascript

1// Local job scheduling for the Nightwatch and standing-skill subscriptions.

2// macOS: launchd plists in ~/Library/LaunchAgents; Linux: user crontab lines.

3// Everything is inspectable, labeled, and uninstallable by name.

4import { writeFileSync, existsSync, unlinkSync, readdirSync } from 'node:fs';

5import { join } from 'node:path';

6import { homedir, platform } from 'node:os';

7import { execSync } from

templates/pm-launch-agent/orchestrate.shView file

•path = templates/pm-launch-agent/orchestrate.sh kind = build_helper sizeBytes = 9939 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/pm-launch-agent/orchestrate.shView on unpkg

bin/cli.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = pm-claude-skills@43.0.0 matchedIdentity = npm:cG0tY2xhdWRlLXNraWxscw:43.0.0 similarity = 0.714 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.mjsView on unpkg

exports/cline/pm-engineering/load-testing-plan/load-testing-plan.mdView file

Lines 186-226markdown

186 { duration: '2m', target: [BASELINE_VUS] },

187 { duration: '8m', target: [BASELINE_VUS] },

188 { duration: '1m', target: 0 },

189 ],

190 },

191 },

192 thresholds: {

193 http_req_duration: [

194 'p(95)<[Y_MS]',

195 'p(99)<[Z_MS]',

exports/aider/pm-engineering/load-testing-plan/load-testing-plan.mdView file

Lines 186-226markdown

186 { duration: '2m', target: [BASELINE_VUS] },

187 { duration: '8m', target: [BASELINE_VUS] },

188 { duration: '1m', target: 0 },

189 ],

190 },

191 },

192 thresholds: {

193 http_req_duration: [

194 'p(95)<[Y_MS]',

195 'p(99)<[Z_MS]',

exports/zed/pm-engineering/load-testing-plan/load-testing-plan.mdView file

Lines 186-226markdown

186 { duration: '2m', target: [BASELINE_VUS] },

187 { duration: '8m', target: [BASELINE_VUS] },

188 { duration: '1m', target: 0 },

189 ],

190 },

191 },

192 thresholds: {

193 http_req_duration: [

194 'p(95)<[Y_MS]',

195 'p(99)<[Z_MS]',

exports/roo/pm-engineering/load-testing-plan/load-testing-plan.mdView file

Lines 186-226markdown

186 { duration: '2m', target: [BASELINE_VUS] },

187 { duration: '8m', target: [BASELINE_VUS] },

188 { duration: '1m', target: 0 },

189 ],

190 },

191 },

192 thresholds: {

193 http_req_duration: [

194 'p(95)<[Y_MS]',

195 'p(99)<[Z_MS]',

exports/gemini/pm-engineering/load-testing-plan/GEM_INSTRUCTIONS.mdView file

Lines 190-230markdown

190 { duration: '2m', target: [BASELINE_VUS] },

191 { duration: '8m', target: [BASELINE_VUS] },

192 { duration: '1m', target: 0 },

193 ],

194 },

195 },

196 thresholds: {

197 http_req_duration: [

198 'p(95)<[Y_MS]',

199 'p(99)<[Z_MS]',

exports/kilocode/pm-engineering/load-testing-plan/load-testing-plan.mdView file

206patternName = generic_password severity = medium line = 206 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/kilocode/pm-engineering/load-testing-plan/load-testing-plan.md

exports/kilocode/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L206

exports/windsurf/pm-engineering/load-testing-plan/load-testing-plan.mdView file

211patternName = generic_password severity = medium line = 211 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/windsurf/pm-engineering/load-testing-plan/load-testing-plan.md

exports/windsurf/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L211

exports/obsidian/pm-engineering/load-testing-plan/load-testing-plan.mdView file

213patternName = generic_password severity = medium line = 213 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/obsidian/pm-engineering/load-testing-plan/load-testing-plan.md

exports/obsidian/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L213

exports/chatgpt/pm-engineering/load-testing-plan/SYSTEM_PROMPT.mdView file

206patternName = generic_password severity = medium line = 206 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/chatgpt/pm-engineering/load-testing-plan/SYSTEM_PROMPT.md

exports/chatgpt/pm-engineering/load-testing-plan/SYSTEM_PROMPT.mdView on unpkg · L206

exports/continue/pm-engineering/load-testing-plan/load-testing-plan.mdView file

211patternName = generic_password severity = medium line = 211 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/continue/pm-engineering/load-testing-plan/load-testing-plan.md

exports/continue/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L211

skills/load-testing-plan/SKILL.mdView file

211patternName = generic_password severity = medium line = 211 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in skills/load-testing-plan/SKILL.md

skills/load-testing-plan/SKILL.mdView on unpkg · L211

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/lib/scheduler.mjsView file

1// Local job scheduling for the Nightwatch and standing-skill subscriptions. L2: // macOS: launchd plists in ~/Library/LaunchAgents; Linux: user crontab lines. L3: // Everything is inspectable, labeled, and uninstallable by name. ... L6: import { homedir, platform } from 'node:os'; L7: import { execSync } from 'node:child_process'; L8: ... L19: <key>StartCalendarInterval</key><dict><key>Hour</key><integer>${hour}</integer><key>Minute</key><integer>${minute}</integer></dict> L20: <key>WorkingDirectory</key><string>${process.cwd()}</string> L21: <key>StandardOutPath</key><string>${join(process.cwd(), '.pm-skills', name + '.log')}</string>

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/lib/scheduler.mjsView on unpkg · L1

templates/pm-launch-agent/orchestrate.shView file

•path = templates/pm-launch-agent/orchestrate.sh kind = build_helper sizeBytes = 9939 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/pm-launch-agent/orchestrate.shView on unpkg

bin/cli.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.mjsView on unpkg

exports/cline/pm-engineering/load-testing-plan/load-testing-plan.mdView file

206patternName = generic_password severity = medium line = 206 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/cline/pm-engineering/load-testing-plan/load-testing-plan.md

exports/cline/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L206

exports/aider/pm-engineering/load-testing-plan/load-testing-plan.mdView file

206patternName = generic_password severity = medium line = 206 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/aider/pm-engineering/load-testing-plan/load-testing-plan.md

exports/aider/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L206

exports/zed/pm-engineering/load-testing-plan/load-testing-plan.mdView file

206patternName = generic_password severity = medium line = 206 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/zed/pm-engineering/load-testing-plan/load-testing-plan.md

exports/zed/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L206

exports/roo/pm-engineering/load-testing-plan/load-testing-plan.mdView file

206patternName = generic_password severity = medium line = 206 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/roo/pm-engineering/load-testing-plan/load-testing-plan.md

exports/roo/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L206

exports/gemini/pm-engineering/load-testing-plan/GEM_INSTRUCTIONS.mdView file

210patternName = generic_password severity = medium line = 210 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/gemini/pm-engineering/load-testing-plan/GEM_INSTRUCTIONS.md

exports/gemini/pm-engineering/load-testing-plan/GEM_INSTRUCTIONS.mdView on unpkg · L210

exports/kilocode/pm-engineering/load-testing-plan/load-testing-plan.mdView file

206patternName = generic_password severity = medium line = 206 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/kilocode/pm-engineering/load-testing-plan/load-testing-plan.md

exports/kilocode/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L206

exports/windsurf/pm-engineering/load-testing-plan/load-testing-plan.mdView file

211patternName = generic_password severity = medium line = 211 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/windsurf/pm-engineering/load-testing-plan/load-testing-plan.md

exports/windsurf/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L211

exports/obsidian/pm-engineering/load-testing-plan/load-testing-plan.mdView file

213patternName = generic_password severity = medium line = 213 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/obsidian/pm-engineering/load-testing-plan/load-testing-plan.md

exports/obsidian/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L213

exports/chatgpt/pm-engineering/load-testing-plan/SYSTEM_PROMPT.mdView file

206patternName = generic_password severity = medium line = 206 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/chatgpt/pm-engineering/load-testing-plan/SYSTEM_PROMPT.md

exports/chatgpt/pm-engineering/load-testing-plan/SYSTEM_PROMPT.mdView on unpkg · L206

exports/continue/pm-engineering/load-testing-plan/load-testing-plan.mdView file

211patternName = generic_password severity = medium line = 211 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/continue/pm-engineering/load-testing-plan/load-testing-plan.md

exports/continue/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L211

skills/load-testing-plan/SKILL.mdView file

211patternName = generic_password severity = medium line = 211 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in skills/load-testing-plan/SKILL.md

skills/load-testing-plan/SKILL.mdView on unpkg · L211

Findings

2 High17 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltabin/cli.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/lib/scheduler.mjs

MediumShips Build Helpertemplates/pm-launch-agent/orchestrate.sh

MediumStructural Risk Force Deep Review

MediumSecret Patternexports/cline/pm-engineering/load-testing-plan/load-testing-plan.md

MediumSecret Patternexports/aider/pm-engineering/load-testing-plan/load-testing-plan.md

MediumSecret Patternexports/zed/pm-engineering/load-testing-plan/load-testing-plan.md

MediumSecret Patternexports/roo/pm-engineering/load-testing-plan/load-testing-plan.md

MediumSecret Patternexports/gemini/pm-engineering/load-testing-plan/GEM_INSTRUCTIONS.md

MediumSecret Patternexports/kilocode/pm-engineering/load-testing-plan/load-testing-plan.md

MediumSecret Patternexports/windsurf/pm-engineering/load-testing-plan/load-testing-plan.md

MediumSecret Patternexports/obsidian/pm-engineering/load-testing-plan/load-testing-plan.md

MediumSecret Patternexports/chatgpt/pm-engineering/load-testing-plan/SYSTEM_PROMPT.md

MediumSecret Patternexports/continue/pm-engineering/load-testing-plan/load-testing-plan.md

MediumSecret Patternskills/load-testing-plan/SKILL.md

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

16 flagged

package.jsonView file

Lines 39-79json

39 "bin": {

40 "pm-claude-skills": "bin/cli.mjs",

41 "pm-claude-skills-mcp": "mcp/server.mjs"

42 },

43 "files": [

44 "icon.svg",

45 "bin/",

46 "mcp/",

47 "skills/",

48 "agents/",

49 "commands/",

50 "output-styles/",

51 "exports/",

52 "templates/",

53 "connectors/",

54 "skill-tiers.json",

55 "skill-sources.json",

56 "workflows.json"

57 ],

58 "scripts": {

59 "postinstall": "node bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L59

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L59

60 "new-skill": "node scripts/new-skill.mjs",

61 "new-bundle": "node scripts/new-bundle.mjs",

62 "skillcheck": "node scripts/skillcheck.mjs",

63 "build:exports": "node scripts/build-exports.mjs",

64 "build:web": "node web/build-skills.mjs",

65 "build:workflows": "node scripts/build-workflows.mjs",

66 "build:samples": "node scripts/build-samples.mjs",

67 "build:pages": "node scripts/build-skill-pages.mjs",

68 "build:community": "node scripts/build-community.mjs",

69 "build:og": "node scripts/build-og-images.mjs",

70 "build:deck": "node scripts/build-deck.mjs",

71 "build:show": "node scripts/build-morning-show.mjs",

72 "skill-of-the-week": "node scripts/skill-of-the-week.mjs",

74 "improve": "node scripts/improve-skill.mjs",

75 "eval:gen-cases": "node scripts/gen-eval-cases.mjs",

76 "eval:all": "node scripts/gen-eval-cases.mjs && node evals/run-evals.mjs --cases evals/cases.full.json --models claude-haiku-4-5-20251001 --judge claude-haiku-4-5-20251001"

77 },

78 "devDependencies": {

79 "qrcode": "^1.5.4"

bin/lib/scheduler.mjsView file

Lines 1-21javascript

1// Local job scheduling for the Nightwatch and standing-skill subscriptions.

2// macOS: launchd plists in ~/Library/LaunchAgents; Linux: user crontab lines.

3// Everything is inspectable, labeled, and uninstallable by name.

4import { writeFileSync, existsSync, unlinkSync, readdirSync } from 'node:fs';

5import { join } from 'node:path';

6import { homedir, platform } from 'node:os';

7import { execSync } from

templates/pm-launch-agent/orchestrate.shView file

•path = templates/pm-launch-agent/orchestrate.sh kind = build_helper sizeBytes = 9939 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/pm-launch-agent/orchestrate.shView on unpkg

bin/cli.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.mjsView on unpkg

exports/cline/pm-engineering/load-testing-plan/load-testing-plan.mdView file

Lines 186-226markdown

186 { duration: '2m', target: [BASELINE_VUS] },

187 { duration: '8m', target: [BASELINE_VUS] },

188 { duration: '1m', target: 0 },

189 ],

190 },

191 },

192 thresholds: {

193 http_req_duration: [

194 'p(95)<[Y_MS]',

195 'p(99)<[Z_MS]',

exports/aider/pm-engineering/load-testing-plan/load-testing-plan.mdView file

Lines 186-226markdown

186 { duration: '2m', target: [BASELINE_VUS] },

187 { duration: '8m', target: [BASELINE_VUS] },

188 { duration: '1m', target: 0 },

189 ],

190 },

191 },

192 thresholds: {

193 http_req_duration: [

194 'p(95)<[Y_MS]',

195 'p(99)<[Z_MS]',

exports/zed/pm-engineering/load-testing-plan/load-testing-plan.mdView file

Lines 186-226markdown

186 { duration: '2m', target: [BASELINE_VUS] },

187 { duration: '8m', target: [BASELINE_VUS] },

188 { duration: '1m', target: 0 },

189 ],

190 },

191 },

192 thresholds: {

193 http_req_duration: [

194 'p(95)<[Y_MS]',

195 'p(99)<[Z_MS]',

exports/roo/pm-engineering/load-testing-plan/load-testing-plan.mdView file

Lines 186-226markdown

186 { duration: '2m', target: [BASELINE_VUS] },

187 { duration: '8m', target: [BASELINE_VUS] },

188 { duration: '1m', target: 0 },

189 ],

190 },

191 },

192 thresholds: {

193 http_req_duration: [

194 'p(95)<[Y_MS]',

195 'p(99)<[Z_MS]',

exports/gemini/pm-engineering/load-testing-plan/GEM_INSTRUCTIONS.mdView file

Lines 190-230markdown

190 { duration: '2m', target: [BASELINE_VUS] },

191 { duration: '8m', target: [BASELINE_VUS] },

192 { duration: '1m', target: 0 },

193 ],

194 },

195 },

196 thresholds: {

197 http_req_duration: [

198 'p(95)<[Y_MS]',

199 'p(99)<[Z_MS]',

exports/kilocode/pm-engineering/load-testing-plan/load-testing-plan.mdView file

206patternName = generic_password severity = medium line = 206 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/kilocode/pm-engineering/load-testing-plan/load-testing-plan.md

exports/kilocode/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L206

exports/windsurf/pm-engineering/load-testing-plan/load-testing-plan.mdView file

211patternName = generic_password severity = medium line = 211 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/windsurf/pm-engineering/load-testing-plan/load-testing-plan.md

exports/windsurf/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L211

exports/obsidian/pm-engineering/load-testing-plan/load-testing-plan.mdView file

213patternName = generic_password severity = medium line = 213 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/obsidian/pm-engineering/load-testing-plan/load-testing-plan.md

exports/obsidian/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L213

exports/chatgpt/pm-engineering/load-testing-plan/SYSTEM_PROMPT.mdView file

206patternName = generic_password severity = medium line = 206 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/chatgpt/pm-engineering/load-testing-plan/SYSTEM_PROMPT.md

exports/chatgpt/pm-engineering/load-testing-plan/SYSTEM_PROMPT.mdView on unpkg · L206

exports/continue/pm-engineering/load-testing-plan/load-testing-plan.mdView file

211patternName = generic_password severity = medium line = 211 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/continue/pm-engineering/load-testing-plan/load-testing-plan.md

exports/continue/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L211

skills/load-testing-plan/SKILL.mdView file

211patternName = generic_password severity = medium line = 211 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in skills/load-testing-plan/SKILL.md

skills/load-testing-plan/SKILL.mdView on unpkg · L211