registry / pm-claude-skills / 55.0.0

pm-claude-skills@55.0.0

526 professional Agent Skills (SKILL.md) + subagents + slash commands for Claude, ChatGPT, Gemini, Cursor, Codex & Hermes. It's a CLI, not a library: run `npx pm-claude-skills add --agent <tool>` to install into your AI tool — no `npm install` needed. Or

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 24 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 49 file(s), 412 KB of source, external domains: aistudio.google.com, api.anthropic.com, api.github.com, api.openai.com, cdn.jsdelivr.net, console.anthropic.com, esm.run, generativelanguage.googleapis.com, github.com, img.shields.io, mohitagw15856.github.io, ollama.com, platform.openai.com, pm-skills-mcp.pm-claude-skills.workers.dev, raw.githubusercontent.com, www.apple.com, www.w3.org

Source & flagged code

17 flagged

package.jsonView file

Lines 42-82json

42 },

43 "files": [

44 "icon.svg",

45 "bin/",

46 "mcp/",

47 "skills/",

48 "agents/",

49 "commands/",

50 "output-styles/",

51 "exports/",

52 "templates/",

53 "connectors/",

54 "skill-tiers.json",

55 "skill-sources.json",

56 "workflows.json",

57 "org/",

58 "web/",

59 "!web/docs-assets/"

60 ],

61 "scripts": {

62 "postinstall": "node bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L62

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L62

63 "new-skill": "node scripts/new-skill.mjs",

64 "new-bundle": "node scripts/new-bundle.mjs",

65 "skillcheck": "node scripts/skillcheck.mjs",

66 "build:exports": "node scripts/build-exports.mjs",

67 "build:web": "node web/build-skills.mjs",

68 "build:workflows": "node scripts/build-workflows.mjs",

69 "build:samples": "node scripts/build-samples.mjs",

70 "build:pages": "node scripts/build-skill-pages.mjs",

71 "build:community": "node scripts/build-community.mjs",

72 "build:og": "node scripts/build-og-images.mjs",

73 "build:star": "node scripts/build-star-history.mjs",

74 "build:deck": "node scripts/build-deck.mjs",

75 "build:show": "node scripts/build-morning-show.mjs",

76 "grow": "node scripts/mine-gaps.mjs",

77 "build:modelbench": "node scripts/build-modelbench.mjs",

78 "skill-of-the-week": "node scripts/skill-of-the-week.mjs",

79 "check": "node scripts/skillcheck.mjs && node scripts/check-drift.mjs && node scripts/build-exports.mjs --check && node scripts/build-workflows.mjs --check && node web/build-skills.mjs && node scripts/build-samples.mjs && node scripts/build-skills-md.mjs && node tests/exports-lint.mjs && node tests/i18n-parity.mjs && git diff --exit-code -- web/skills.json web/samples.json SKILLS.md",

80 "improve": "node scripts/improve-skill.mjs",

81 "eval:gen-cases": "node scripts/gen-eval-cases.mjs",

82 "eval:all": "node scripts/gen-eval-cases.mjs && node evals/run-evals.mjs --cases evals/cases.full.json --models claude-haiku-4-5-20251001 --judge claude-haiku-4-5-20251001",

bin/lib/scheduler.mjsView file

Lines 1-21javascript

1// Local job scheduling for the Nightwatch and standing-skill subscriptions.

2// macOS: launchd plists in ~/Library/LaunchAgents; Linux: user crontab lines.

3// Everything is inspectable, labeled, and uninstallable by name.

4import { writeFileSync, existsSync, unlinkSync, readdirSync } from 'node:fs';

5import { join } from 'node:path';

6import { homedir, platform } from

templates/pm-launch-agent/orchestrate.shView file

•path = templates/pm-launch-agent/orchestrate.sh kind = build_helper sizeBytes = 9939 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/pm-launch-agent/orchestrate.shView on unpkg

bin/cli.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = pm-claude-skills@53.0.0 matchedIdentity = npm:cG0tY2xhdWRlLXNraWxscw:53.0.0 similarity = 0.905 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.mjsView on unpkg

exports/cline/pm-engineering/load-testing-plan/load-testing-plan.mdView file

Lines 186-226markdown

186 { duration: '2m', target: [BASELINE_VUS] },

187 { duration: '8m', target: [BASELINE_VUS] },

188 { duration: '1m', target: 0 },

189 ],

190 },

191 },

192 thresholds: {

193 http_req_duration: [

194 'p(95)<[Y_MS]',

exports/aider/pm-engineering/load-testing-plan/load-testing-plan.mdView file

Lines 186-226markdown

186 { duration: '2m', target: [BASELINE_VUS] },

187 { duration: '8m', target: [BASELINE_VUS] },

188 { duration: '1m', target: 0 },

189 ],

190 },

191 },

192 thresholds: {

193 http_req_duration: [

194 'p(95)<[Y_MS]',

exports/zed/pm-engineering/load-testing-plan/load-testing-plan.mdView file

Lines 186-226markdown

186 { duration: '2m', target: [BASELINE_VUS] },

187 { duration: '8m', target: [BASELINE_VUS] },

188 { duration: '1m', target: 0 },

189 ],

190 },

191 },

192 thresholds: {

193 http_req_duration: [

194 'p(95)<[Y_MS]',

195

exports/roo/pm-engineering/load-testing-plan/load-testing-plan.mdView file

Lines 186-226markdown

186 { duration: '2m', target: [BASELINE_VUS] },

187 { duration: '8m', target: [BASELINE_VUS] },

188 { duration: '1m', target: 0 },

189 ],

190 },

191 },

192 thresholds: {

193 http_req_duration: [

194 'p(95)<[Y_MS]',

195

exports/gemini/pm-engineering/load-testing-plan/GEM_INSTRUCTIONS.mdView file

Lines 190-230markdown

190 { duration: '2m', target: [BASELINE_VUS] },

191 { duration: '8m', target: [BASELINE_VUS] },

192 { duration: '1m', target: 0 },

193 ],

194 },

195 },

196 thresholds: {

197 http_req_duration: [

198 'p(95)<[Y_MS]',

exports/openclaw/load-testing-plan/SKILL.mdView file

216patternName = generic_password severity = medium line = 216 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/openclaw/load-testing-plan/SKILL.md

exports/openclaw/load-testing-plan/SKILL.mdView on unpkg · L216

exports/kilocode/pm-engineering/load-testing-plan/load-testing-plan.mdView file

206patternName = generic_password severity = medium line = 206 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/kilocode/pm-engineering/load-testing-plan/load-testing-plan.md

exports/kilocode/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L206

exports/windsurf/pm-engineering/load-testing-plan/load-testing-plan.mdView file

211patternName = generic_password severity = medium line = 211 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/windsurf/pm-engineering/load-testing-plan/load-testing-plan.md

exports/windsurf/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L211

exports/obsidian/pm-engineering/load-testing-plan/load-testing-plan.mdView file

213patternName = generic_password severity = medium line = 213 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/obsidian/pm-engineering/load-testing-plan/load-testing-plan.md

exports/obsidian/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L213

exports/chatgpt/pm-engineering/load-testing-plan/SYSTEM_PROMPT.mdView file

206patternName = generic_password severity = medium line = 206 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/chatgpt/pm-engineering/load-testing-plan/SYSTEM_PROMPT.md

exports/chatgpt/pm-engineering/load-testing-plan/SYSTEM_PROMPT.mdView on unpkg · L206

exports/continue/pm-engineering/load-testing-plan/load-testing-plan.mdView file

211patternName = generic_password severity = medium line = 211 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in exports/continue/pm-engineering/load-testing-plan/load-testing-plan.md

exports/continue/pm-engineering/load-testing-plan/load-testing-plan.mdView on unpkg · L211

skills/load-testing-plan/SKILL.mdView file

211patternName = generic_password severity = medium line = 211 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in skills/load-testing-plan/SKILL.md

skills/load-testing-plan/SKILL.mdView on unpkg · L211

Source & flagged code

17 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code