Skip to content

PM skills for Claude Code: red-teaming a PRD instead of polishing it

By Maximo Correa · Updated 2026-08-22

phuryn/pm-skills is a Claude Code plugin with 110 indexed components for product management. Its distinguishing commands are adversarial: red-team-prd attacks the load bearing assumptions in a PRD or strategy and returns the cheapest way to test them, and pre-mortem asks what would have gone wrong.

The problem this solves

Product management work is mostly documents that argue for something. A PRD, a roadmap, a set of OKRs, a launch plan. The failure mode is not bad writing. It is a document that reads well and rests on an assumption nobody tested.

Most AI writing help makes that worse, because a model asked to improve a document makes it more persuasive, not more true.

This plugin is built around the opposite instinct, and two of its commands are the reason to install it.

The two that attack your own work

red-team-prd takes a PRD, roadmap, or strategy and attacks its load bearing assumptions, returning the cheapest way to test them. pre-mortem runs a risk analysis on a PRD, launch plan, or feature by asking what would have gone wrong.

Both are adversarial by design. You are not asking for a better draft, you are asking what is wrong with the one you have, which is the question that actually changes decisions.

If you install this plugin and only ever use these two, it has paid for itself.

The shipping packet, for code you did not write

A second cluster addresses a specific modern situation: you have a working application that an AI built, and now somebody has to review it.

  • document-app reverse engineers the codebase into the system documents reviewers and auditors need
  • derive-tests turns documented intent into a test coverage map, inventorying what tests exist today
  • security-audit-static maps trust boundaries and cross references them against documented intent
  • performance-audit-static finds N plus 1 queries, request waterfalls, and over fetching
  • ship-check runs the whole sequence into a reviewer ready packet

The ordering is the useful part. document-app runs first because the audits cross reference documented intent, and you cannot check code against an intention nobody wrote down.

The routine work

The rest is the ordinary PM calendar, and it is competently covered:

CommandWhen it fires
plan-okrsbrainstorming team OKRs against company objectives
sprintplanning a sprint, running a retro, or generating release notes
analyze-cohortsretention curves, feature adoption, engagement trends
analyze-testA/B results, significance, and a ship or stop call
write-querySQL from natural language across BigQuery, PostgreSQL, MySQL
generate-datarealistic dummy datasets as CSV, JSON, SQL, or Python
meeting-notesa transcript into decisions, action items, and follow ups

analyze-test is the one to watch. It validates sample size and significance before returning a ship, extend, or stop recommendation, which is the check most teams skip when a result looks good.

What it is not

There are no agents and no MCP servers here. Every component is a skill or a command, which means nothing connects to a live data source. analyze-cohorts and write-query operate on data you bring, they do not go and fetch it.

That is a reasonable design for PM work, where the data usually arrives as an export. It does mean this pairs well with a plugin that does have a live connection rather than replacing one.

Getting it

Install from the listing page linked at the top of this guide. Flowy indexes every command so you can read the full set before installing.

Common questions

What does red-team-prd actually do?
It attacks the load bearing assumptions in a PRD, roadmap or strategy and returns the cheapest way to test them. It is deliberately not a rewriting tool. Asking a model to improve a document makes it more persuasive, which is the opposite of what a weak assumption needs.
Can it help review an application an AI wrote?
That is what the shipping packet cluster is for. document-app reverse engineers the codebase into system documents, derive-tests builds a coverage map from documented intent, and the static security and performance audits cross reference against that intent. ship-check runs the sequence.
Does it connect to my analytics?
No. Every component is a skill or a command, with no agents and no MCP servers, so nothing fetches data. analyze-cohorts and write-query operate on data you bring. It pairs with a plugin that has a live connection rather than replacing one.