PM skills for Claude Code: red-teaming a PRD instead of polishing it
By Maximo Correa · Updated 2026-08-22
phuryn/pm-skills is a Claude Code plugin with 110 indexed components for product management. Its distinguishing commands are adversarial: red-team-prd attacks the load bearing assumptions in a PRD or strategy and returns the cheapest way to test them, and pre-mortem asks what would have gone wrong.
The problem this solves
Product management work is mostly documents that argue for something. A PRD, a roadmap, a set of OKRs, a launch plan. The failure mode is not bad writing. It is a document that reads well and rests on an assumption nobody tested.
Most AI writing help makes that worse, because a model asked to improve a document makes it more persuasive, not more true.
This plugin is built around the opposite instinct, and two of its commands are the reason to install it.
The two that attack your own work
red-team-prd takes a PRD, roadmap, or strategy and attacks its load bearing
assumptions, returning the cheapest way to test them. pre-mortem runs a risk
analysis on a PRD, launch plan, or feature by asking what would have gone wrong.
Both are adversarial by design. You are not asking for a better draft, you are asking what is wrong with the one you have, which is the question that actually changes decisions.
If you install this plugin and only ever use these two, it has paid for itself.
The shipping packet, for code you did not write
A second cluster addresses a specific modern situation: you have a working application that an AI built, and now somebody has to review it.
document-appreverse engineers the codebase into the system documents reviewers and auditors needderive-teststurns documented intent into a test coverage map, inventorying what tests exist todaysecurity-audit-staticmaps trust boundaries and cross references them against documented intentperformance-audit-staticfinds N plus 1 queries, request waterfalls, and over fetchingship-checkruns the whole sequence into a reviewer ready packet
The ordering is the useful part. document-app runs first because the audits
cross reference documented intent, and you cannot check code against an
intention nobody wrote down.
The routine work
The rest is the ordinary PM calendar, and it is competently covered:
| Command | When it fires |
|---|---|
plan-okrs | brainstorming team OKRs against company objectives |
sprint | planning a sprint, running a retro, or generating release notes |
analyze-cohorts | retention curves, feature adoption, engagement trends |
analyze-test | A/B results, significance, and a ship or stop call |
write-query | SQL from natural language across BigQuery, PostgreSQL, MySQL |
generate-data | realistic dummy datasets as CSV, JSON, SQL, or Python |
meeting-notes | a transcript into decisions, action items, and follow ups |
analyze-test is the one to watch. It validates sample size and significance
before returning a ship, extend, or stop recommendation, which is the check most
teams skip when a result looks good.
What it is not
There are no agents and no MCP servers here. Every component is a skill or a
command, which means nothing connects to a live data source. analyze-cohorts
and write-query operate on data you bring, they do not go and fetch it.
That is a reasonable design for PM work, where the data usually arrives as an export. It does mean this pairs well with a plugin that does have a live connection rather than replacing one.
Getting it
Install from the listing page linked at the top of this guide. Flowy indexes every command so you can read the full set before installing.
Common questions
- What does red-team-prd actually do?
- It attacks the load bearing assumptions in a PRD, roadmap or strategy and returns the cheapest way to test them. It is deliberately not a rewriting tool. Asking a model to improve a document makes it more persuasive, which is the opposite of what a weak assumption needs.
- Can it help review an application an AI wrote?
- That is what the shipping packet cluster is for. document-app reverse engineers the codebase into system documents, derive-tests builds a coverage map from documented intent, and the static security and performance audits cross reference against that intent. ship-check runs the sequence.
- Does it connect to my analytics?
- No. Every component is a skill or a command, with no agents and no MCP servers, so nothing fetches data. analyze-cohorts and write-query operate on data you bring. It pairs with a plugin that has a live connection rather than replacing one.
