跳到主要内容
知仓学习社ZHICANG

utility-pm-skill-auditor

Run a repo-wide cross-cutting governance audit via the pm-skill-auditor sub-agent. Aggregates the enforcing validator suite, re-derives aggregate co…

改身份文件严重 0 · 高危 1product-on-purpose/pm-skills

它会碰到什么

扫了多少5 个文本文件,24 KB
它会碰到什么改身份文件
命中总数1 处
命中统计严重 0 · 高 1 · 中 0 · 低 0
逐条看命中(1 条严重或高危)
  • evals/trigger-fixtures.json:13identity-write
    "q": "Can you check whether the skill counts declared in AGENTS.md and README still match what's actually in the skills folder?",

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

<!-- PM-Skills | https://github.com/product-on-purpose/pm-skills | Apache 2.0 -->

PM Skill Auditor (Dispatch Skill)

Cross-client dispatch wrapper for the pm-skill-auditor sub-agent. Detects runtime; dispatches to the native sub-agent on Claude Code; reads agents/pm-skill-auditor.md and executes inline on non-Claude clients.

When to Use

  • You need a repo-wide audit pass: all enforcing validators, cross-cutting checks (skill-without-command, sample gaps, family contract orphans, etc.), and aggregate counter re-derivation against declared values in CONTEXT.md + AGENTS.md + README.md
  • You are running on a non-Claude AI client without native pm-skill-auditor sub-agent support
  • You are running on Claude Code and prefer skill-invocation semantics (e.g., for chaining inside a workflow that also uses other dispatch skills)

When NOT to Use

  • You want to review a specific PM artifact (PRD, OKR, persona) -> use utility-pm-critic instead
  • You want to draft a CHANGELOG entry -> use utility-pm-changelog-curator (ships in Phase 4)
  • You want to ship a release -> use utility-pm-release-conductor (ships in Phase 5)
  • You want to FIX issues found in an audit -> the auditor is detection-only; remediation is maintainer judgment or future pm-frontmatter-doctor (v2.17+)
  • You want a deep, single-skill check against the authoring conventions -> use utility-pm-skill-validate. The auditor goes wide across the catalog; it does not go deep on one skill.

Instructions

Runtime detection step. Determine which AI client is invoking this skill.

If you are running in Claude Code with the pm-skills plugin installed

Invoke @agent-pm-skills:pm-skill-auditor on the repo. Pass any scope arguments from $ARGUMENTS (e.g., --scope changed, --since-tag v2.15.0, --severity-floor P1). Return the sub-agent's audit report to the user.

If you are running in any other AI client

Codex CLI, Cursor, Windsurf, Copilot, Gemini CLI, or any other client without native pm-skills plugin sub-agent support:

  1. Read the canonical sub-agent definition at agents/pm-skill-auditor.md
  2. Execute the system prompt body in that file as your operating instructions for this turn
  3. Run the four-step audit flow:
  • Step 1: Invoke validators via Bash (prefer bash scripts/pre-tag-validate.sh as canonical entry point)
  • Step 2: Run cross-cutting checks from the catalog at docs/internal/release-plans/v2.16.0/spec_pm-skill-auditor.md#cross-cutting-check-catalog
  • Step 3: Re-derive aggregate counters from filesystem and compare to declared values
  • Step 4: Compose layered output report
  1. Apply scope and severity-floor arguments from $ARGUMENTS
  2. Return the layered output per master plan D26 (full report + Status Summary + Status YAML)

Cross-Client Notes

See [Sub-Agent Compatibility Matrix](../../docs/reference/sub-agent-compatibility.md) for the canonical cross-client status. Summary for this skill as of v2.16.0: PRODUCTION on Claude Code + Codex CLI (Codex CLI successfully invoked the validator suite via Bash + produced a layered audit report with re-derived aggregate counters); EXPERIMENTAL on Cursor / Windsurf / Copilot CLI / Gemini CLI.

The "read canonical agent definition and execute inline" pattern depends on the AI client being able to:

  1. Read a referenced file path
  2. Execute Bash to invoke validator scripts
  3. Treat the agent definition body as operating instructions for the current turn

Most AI clients support all three. If any are unreliable on a specific client, that client falls back to manual validator invocation + manual cross-cutting checks.

Reference Files

  • Canonical sub-agent definition: [agents/pm-skill-auditor.md](../../agents/pm-skill-auditor.md)
  • Behavioral spec: [docs/internal/release-plans/v2.16.0/spec_pm-skill-auditor.md](../../docs/internal/release-plans/v2.16.0/spec_pm-skill-auditor.md)
  • Runtime components catalog: [docs/reference/runtime-components.md](../../docs/reference/runtime-components.md)
  • Cross-cutting check catalog: docs/internal/release-plans/v2.16.0/spec_pm-skill-auditor.md#cross-cutting-check-catalog
  • Pre-tag validator bundle: scripts/pre-tag-validate.{sh,ps1}
  • Output template: references/TEMPLATE.md
  • Worked example: references/EXAMPLE.md

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。