mirror of
https://github.com/phuryn/pm-skills.git
synced 2026-09-20 22:35:53 +03:00
Pawel HurynandClaude Opus 5
18032bc9f7
Restructure, per the ask that code review be the parent and the other two dimensions its sub-cases: - SKILL.md gains a "one engine, three anchors" section. Correctness is the core and stays inline; performance and security move to their own reference files, loaded only when selected. - references/performance-review.md (new) — a universal, stack-agnostic core (repeated work, growth relationships, retention, copying, contention, amplification) plus the three-part bar for a performance finding. Defers the database/web checklist to /performance-audit-static instead of restating it. - references/security-review.md (new) — trust boundaries and sinks for code with no web surface, and the one rule that INVERTS relative to correctness: attacker-equals-victim refutes a security finding but never a correctness one. Defers the full procedure to /security-audit-static. - Both audit commands now say they are the specialisation behind their sub-case, so the narrow entry points still lead back to the skill. ship-check gains two stages it was missing: - Step 3, correctness review — the pass neither audit performs: logic and state defects that compile clean and pass the suite. - Step 6, independent unsteered review — a fresh session of a second model (Codex or equivalent), given no checklist and no prior findings, with the subject computed from a diff rather than described. Every finding is hand-verified against the code before it enters the packet, since an unsteered reviewer carries no refutation discipline of its own. The packet reports whether it ran clean or did not run at all - those are different signals. Also carries the working-tree edits already in progress: model-and-orchestration guidance on both audits, the OWASP A02/A06/A09 backstop, CSP in the output-encoding bullet, the prompt-injection/agent-abuse bullet, and the Audit Provenance section (now also naming the second model). No version bump - not tested against the benchmark yet. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G42vsxSKL7je39AsHZ5aJm
24 lines
676 B
JSON
24 lines
676 B
JSON
{
|
|
"name": "pm-ai-shipping",
|
|
"version": "2.0.0",
|
|
"description": "AI Shipping Kit — for PMs and founders accountable for AI-built code. Document a vibe-coded app, review it for correctness, security and performance defects, and produce a reviewer-ready shipping packet.",
|
|
"author": {
|
|
"name": "Paweł Huryn",
|
|
"email": "pawel@productcompass.pm",
|
|
"url": "https://www.productcompass.pm"
|
|
},
|
|
"keywords": [
|
|
"product-management",
|
|
"ai-shipping",
|
|
"vibe-coding",
|
|
"security-audit",
|
|
"performance-audit",
|
|
"code-review",
|
|
"documentation",
|
|
"owasp",
|
|
"shipping"
|
|
],
|
|
"homepage": "https://www.productcompass.pm",
|
|
"license": "MIT"
|
|
}
|