pm-skills
Warn
Audited by Gen Agent Trust Hub on Mar 19, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script
scripts/setup.shperforms agit clonefromhttps://github.com/phuryn/pm-skillsto fetch plugin components from an external, non-author-owned repository. - [COMMAND_EXECUTION]: The installation process involves executing shell commands in
scripts/setup.shto create directories and copy files into the agent's local environment (~/.claude/skills/). - [COMMAND_EXECUTION]: The
SKILL.mdinstructions recommend usingnpx skills add pm-skills, which downloads and runs code from the npm registry. - [COMMAND_EXECUTION]: The setup script programmatically interacts with the agent's platform using
claude plugin marketplace addandclaude plugin installcommands to modify agent capabilities.
Audit Metadata