registry  /  pm-claude-skills  /  48.0.0

pm-claude-skills@48.0.0

466 professional Agent Skills (SKILL.md) + subagents + slash commands for Claude, ChatGPT, Gemini, Cursor, Codex & Hermes. It's a CLI, not a library: run `npx pm-claude-skills add --agent <tool>` to install into your AI tool — no `npm install` needed. Or

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 22 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 20 file(s), 130 KB of source, external domains: api.anthropic.com, api.github.com, api.openai.com, generativelanguage.googleapis.com, github.com, mohitagw15856.github.io, raw.githubusercontent.com, www.apple.com

Source & flagged code

15 flagged · loading source
package.jsonView file
•scripts.postinstall = node bin/postinstall.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node bin/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
bin/lib/scheduler.mjsView file
1// Local job scheduling for the Nightwatch and standing-skill subscriptions. L2: // macOS: launchd plists in ~/Library/LaunchAgents; Linux: user crontab lines. L3: // Everything is inspectable, labeled, and uninstallable by name. ... L6: import { homedir, platform } from 'node:os'; L7: import { execSync } from 'node:child_process'; L8: ... L19: <key>StartCalendarInterval</key><dict><key>Hour</key><integer>${hour}</integer><key>Minute</key><integer>${minute}</integer></dict> L20: <key>WorkingDirectory</key><string>${process.cwd()}</string> L21: <key>StandardOutPath</key><string>${join(process.cwd(), '.pm-skills', name + '.log')}</string>
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/lib/scheduler.mjsView on unpkg · L1
templates/pm-launch-agent/orchestrate.shView file
•path = templates/pm-launch-agent/orchestrate.sh kind = build_helper sizeBytes = 9939 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/pm-launch-agent/orchestrate.shView on unpkg
exports/cline/pm-engineering/load-testing-plan/load-testing-plan.mdView file
206patternName = generic_password severity = medium line = 206 matchedText = password...D]',
Medium
Secret Pattern

Hardcoded password in exports/cline/pm-engineering/load-testing-plan/load-testing-plan.md

exports/cline/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L206
exports/aider/pm-engineering/load-testing-plan/load-testing-plan.mdView file
206patternName = generic_password severity = medium line = 206 matchedText = password...D]',
Medium
Secret Pattern

Hardcoded password in exports/aider/pm-engineering/load-testing-plan/load-testing-plan.md

exports/aider/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L206
exports/zed/pm-engineering/load-testing-plan/load-testing-plan.mdView file
206patternName = generic_password severity = medium line = 206 matchedText = password...D]',
Medium
Secret Pattern

Hardcoded password in exports/zed/pm-engineering/load-testing-plan/load-testing-plan.md

exports/zed/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L206
exports/roo/pm-engineering/load-testing-plan/load-testing-plan.mdView file
206patternName = generic_password severity = medium line = 206 matchedText = password...D]',
Medium
Secret Pattern

Hardcoded password in exports/roo/pm-engineering/load-testing-plan/load-testing-plan.md

exports/roo/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L206
exports/gemini/pm-engineering/load-testing-plan/GEM_INSTRUCTIONS.mdView file
210patternName = generic_password severity = medium line = 210 matchedText = password...D]',
Medium
Secret Pattern

Hardcoded password in exports/gemini/pm-engineering/load-testing-plan/GEM_INSTRUCTIONS.md

exports/gemini/pm-engineering/load-testing-plan/GEM_INSTRUCTIONS.mdView on unpkg · L210
exports/kilocode/pm-engineering/load-testing-plan/load-testing-plan.mdView file
206patternName = generic_password severity = medium line = 206 matchedText = password...D]',
Medium
Secret Pattern

Hardcoded password in exports/kilocode/pm-engineering/load-testing-plan/load-testing-plan.md

exports/kilocode/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L206
exports/windsurf/pm-engineering/load-testing-plan/load-testing-plan.mdView file
211patternName = generic_password severity = medium line = 211 matchedText = password...D]',
Medium
Secret Pattern

Hardcoded password in exports/windsurf/pm-engineering/load-testing-plan/load-testing-plan.md

exports/windsurf/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L211
exports/obsidian/pm-engineering/load-testing-plan/load-testing-plan.mdView file
213patternName = generic_password severity = medium line = 213 matchedText = password...D]',
Medium
Secret Pattern

Hardcoded password in exports/obsidian/pm-engineering/load-testing-plan/load-testing-plan.md

exports/obsidian/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L213
exports/chatgpt/pm-engineering/load-testing-plan/SYSTEM_PROMPT.mdView file
206patternName = generic_password severity = medium line = 206 matchedText = password...D]',
Medium
Secret Pattern

Hardcoded password in exports/chatgpt/pm-engineering/load-testing-plan/SYSTEM_PROMPT.md

exports/chatgpt/pm-engineering/load-testing-plan/SYSTEM_PROMPT.mdView on unpkg · L206
exports/continue/pm-engineering/load-testing-plan/load-testing-plan.mdView file
211patternName = generic_password severity = medium line = 211 matchedText = password...D]',
Medium
Secret Pattern

Hardcoded password in exports/continue/pm-engineering/load-testing-plan/load-testing-plan.md

exports/continue/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L211
skills/load-testing-plan/SKILL.mdView file
211patternName = generic_password severity = medium line = 211 matchedText = password...D]',
Medium
Secret Pattern

Hardcoded password in skills/load-testing-plan/SKILL.md

skills/load-testing-plan/SKILL.mdView on unpkg · L211

Findings

1 High17 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencebin/lib/scheduler.mjs
MediumShips Build Helpertemplates/pm-launch-agent/orchestrate.sh
MediumStructural Risk Force Deep Review
MediumSecret Patternexports/cline/pm-engineering/load-testing-plan/load-testing-plan.md
MediumSecret Patternexports/aider/pm-engineering/load-testing-plan/load-testing-plan.md
MediumSecret Patternexports/zed/pm-engineering/load-testing-plan/load-testing-plan.md
MediumSecret Patternexports/roo/pm-engineering/load-testing-plan/load-testing-plan.md
MediumSecret Patternexports/gemini/pm-engineering/load-testing-plan/GEM_INSTRUCTIONS.md
MediumSecret Patternexports/kilocode/pm-engineering/load-testing-plan/load-testing-plan.md
MediumSecret Patternexports/windsurf/pm-engineering/load-testing-plan/load-testing-plan.md
MediumSecret Patternexports/obsidian/pm-engineering/load-testing-plan/load-testing-plan.md
MediumSecret Patternexports/chatgpt/pm-engineering/load-testing-plan/SYSTEM_PROMPT.md
MediumSecret Patternexports/continue/pm-engineering/load-testing-plan/load-testing-plan.md
MediumSecret Patternskills/load-testing-plan/SKILL.md
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings