{
  "slug": "pm-skills",
  "repo": "product-on-purpose/pm-skills",
  "name": "pm-skills",
  "tagline": "68 plug-and-play, best-practice product management skills for AI agents: 30 Triple Diamond phase + 11 foundation + 12 utility + 15 tool (Foundation Sprint + Design Sprint). Plus 6 sub-agents, workflows, 200+ output samples, guides, and CI-enforced contracts. Apache 2.0.",
  "category": "ai-agents",
  "license_spdx": "Apache-2.0",
  "stars": 788,
  "contributors": 9,
  "last_push_days": 2,
  "latest_release": "main",
  "safety_score": 85.5,
  "verdict": "healthy",
  "risk_reasons": [
    "Active developer activity and positive OpenSSF Scorecard evaluation."
  ],
  "scorecard": 8.6,
  "components": {
    "security_health": 88,
    "maintenance": 94,
    "community": 68,
    "releases": 86
  },
  "language": "JavaScript",
  "self_host_difficulty": "Medium",
  "install_commands": {
    "clone": "git clone https://github.com/product-on-purpose/pm-skills.git"
  },
  "website_url": "https://product-on-purpose.github.io/pm-skills/",
  "ai_report": "### Autonomous Evaluation Report: pm-skills\n\n**Category:** ai-agents | **Self-Host Difficulty:** Medium | **Safety Score:** 86/100 (HEALTHY)\n\n#### 1. Architecture & Maintenance Cadence\npm-skills is an active open-source software project tracked under `product-on-purpose/pm-skills`. Maintenance telemetry scores 94/100 and community trust scores 68/100 based on repository activity and contributor adoption. The codebase is distributed under the `Apache-2.0` open-source license.\n\n#### 2. Security Health & Supply-Chain Signals\nSecurity health is rated at 88/100 based on licensing compliance, commit hygiene, and issue response indicators. Release cadence discipline is evaluated at 86/100.\n\n#### 3. Key Observations & Operational Risk\n- **Notice:** Autonomous execution surface: inspect prompt injection boundaries and tool privileges before granting shell/network access.\n\n#### 4. Deployment Guidance\nRecommended for production deployment and self-hosting. Run containerized with unprivileged user permissions (non-root UID) and enforce reverse proxy authentication.",
  "ai_report_status": "approved",
  "scanned_at": "2026-11-06T09:00:44.520Z",
  "unlisted": false,
  "archived": false,
  "advisories_count": 0,
  "provenance": "Autonomous Heuristic Audit: Security Health 88 · Maintenance 94",
  "permission_model": {
    "asks_before_destructive": true,
    "approval_prompt_detail": "Requires explicit user confirmation before destructive execution.",
    "execution_environment": "Containerized Sandbox Runtime",
    "filesystem_access": "Scoped Workspace Only",
    "network_access": "Outbound HTTPS to configured LLM provider and tool endpoints",
    "verdict": "pm-skills implements standard agent safety controls with isolated process execution.",
    "review_status": "approved"
  },
  "use_cases": [
    "Deploy pm-skills in secure environments",
    "Integrate with developer and agent workflows"
  ],
  "audience": {
    "perfectFor": [
      "DevSecOps teams",
      "Homelab administrators",
      "Software engineers"
    ],
    "skipIf": [
      "Teams requiring proprietary vendor warranties"
    ]
  },
  "skill_check": {
    "ok": true,
    "findings": [],
    "checked_at": "2026-11-05T21:14:03.161Z"
  }
}