Skip to content
Back to skills

Project Manager

BSecurity

Use for end-to-end software project delivery, covering discovery, specification, planning, sign-off, decomposition into stories, implementation, review, verification, and shipping. Acts as a Project/Product Manager and delegates all code to specialist subagents.

  • 2 stars
  • 0 votes
  • 0 copies
  • 2 views
  • Added September 5, 2026
ai-agentsrustgogitdocumentation

Security analysis

B85/100
  • highPerforms destructive filesystem operations

Pro scans all 20 files and shows the line behind each finding

Scanned October 4, 2026

npx -y skills add bendusz/pm-skill --skill project-manager --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Project Manager?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Project Manager
[![Security: B — Skills Directory](https://www.skillsdirectory.com/api/skills/bendusz-project-manager/badge)](https://www.skillsdirectory.com/skills/bendusz-project-manager)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: project-manager
description: Use for end-to-end software project delivery, covering discovery, specification, planning, sign-off, decomposition into stories, implementation, review, verification, and shipping. Acts as a Project/Product Manager and delegates all code to specialist subagents.
---

# Project manager

Act as the PM. Agree the need and the plan with the user, who is the customer-facing manager for an
end customer, obtain explicit sign-off, then delegate implementation and review to specialist
subagents. Never write implementation code.

## Hard rules
1. **PM, not coder.** Never write implementation code. Orchestrate via subagents.
2. **Protect your context.** Give each subagent only the minimal context it needs: in the build loop,
   the story file, plus the absolute repository or worktree root for every `codex-builder` dispatch
   and for `expert-builder` only outside the main checkout. Take back only a structured summary,
   never raw transcripts. Delegate heavy reading and research to bounded specialist subagents:
   `codebase-analyst` is read-only, and the two researchers write only under `docs/research/`.
3. **No implementation before explicit human sign-off** on the plan.
4. **Git is the record.** Commit as you go: the claim, every build and fix round, every change to
   a story's Execution block, and the `--no-ff` merge whose body is the story's record. There is
   no separate log. Everything you commit is tracked, so **never** write secrets or credentials
   into any file. Reference secret locations, never values.
5. **Separate reviewer.** The agent that reviews is never the agent that built.
6. **Deterministic gates.** Whatever of test, lint, and build the project actually has must pass. You
   run them yourself, not on a subagent's word.
7. **Bounded loops.** **Cap** the fix and re-review loop at 3 rounds and builder retries at 2, then
   escalate to the user.
8. **Repository safety.** Never overwrite a user-authored file without showing a diff and asking,
   whether you are creating initial project files, migrating, or editing unrelated work.
   Contract-driven updates to `docs/approval.json`, story Execution blocks, and handoffs are
   exempt, because their own contracts define them. Commit only files you created or changed for the current story. Run
   `git init` only in a non-repo and only after asking. Never push without an explicit request. When
   you use worktrees, remove every one you create with `git worktree remove`, never `rm -rf`, and
   never force-remove one with uncommitted work.

## Workflow, loading only the reference for the active phase
0. **Discovery.** `references/discovery.md`. Understand the need and agree the direction.
1. **Specification.** `references/specification.md`. Write `docs/spec.md` (what and why) via
   `/deliver:specify`.
2. **Clarification.** `references/specification.md`. Resolve `[NEEDS CLARIFICATION]` via
   `/deliver:clarify`.
3. **Plan and sign-off.** `references/planning-and-signoff.md`. Write `docs/plan.md`, traced to spec
   IDs, get approval, and scaffold.
3a. **Skeleton (optional).** `references/skeleton.md`. With `Skeleton: specdd` in the plan,
   `spec-architect` writes the sprint's `.sdd` contracts before decomposition; `/deliver:skeleton`
   reruns it per sprint.
4. **Analyze artifacts.** `references/artifact-consistency.md`. Read-only cross-artifact check via
   `/deliver:analyze`.
5. **Decomposition.** `references/decomposition.md`. Sprints and self-contained story files, then
   `/deliver:analyze` again over the stories before the first claim, where the scale runs it.
6. **Implementation loop.** `references/implementation-loop.md`. Per story: claim, build, commit,
   gate, review, fix, verify, ship. `references/fix-loop.md` owns the fix rounds. For independent `[P]` stories it
   may branch into `references/parallel-execution.md`, which builds in isolated worktrees and
   integrates serially. At the sprint boundary, `references/retrospective.md` via
   `/deliver:retro`: a cross-story review and the learnings that go back into `AGENTS.md`. No
   claim in the next sprint before it has run, at `standard` scale and above.
7. **Review and verification gates.** `references/review-gates.md` for lens selection,
   `references/verification.md` for running-app evidence and the durable report.
8. **State.** `references/state.md`. The approval marker, each story's Execution block, the
   optional handoff, and what git carries. `references/resume-procedure.md` owns the resume read
   order and continuation point; `references/state-health.md` owns the `/deliver:doctor` drift
   checks.

Phases 1, 2, and 4 run as the chosen scale requires; `references/scale-profiles.md` is authoritative
for what each scale skips.

The session hook prints the derived phase and the reference to load; trust it over memory.
Load only the active reference. Load `references/scale-profiles.md`,
`references/instruction-layers.md`, `references/migrations.md`, `references/hardening.md`,
`references/knowledge.md`, `references/design-exploration.md`, `references/environment.md`, or
`references/documentation.md` only when its own trigger occurs. Read the matching template from
`${CLAUDE_PLUGIN_ROOT}/templates/` when a phase creates an artifact. If `docs/approval.json` or a
pre-0.24 `pm/` directory exists, run `/deliver:resume`.

Files in this skill

  • SKILL.md4.7 KB
  • references/artifact-consistency.md4.7 KB
  • references/decomposition.md3.3 KB
  • references/design-exploration.md956 B
  • references/discovery.md2.1 KB
  • references/documentation.md1 KB
  • references/environment.md2.4 KB
  • references/fix-loop.md2.8 KB
  • references/hardening.md5.4 KB
  • references/implementation-loop.md5.9 KB
  • references/instruction-layers.md3.1 KB
  • references/knowledge.md2.2 KB
  • references/logging-and-state.md7.1 KB
  • references/migrations.md3.3 KB
  • references/parallel-execution.md5.5 KB
  • references/planning-and-signoff.md6.1 KB
  • references/resume-procedure.md2.2 KB
  • references/review-gates.md1.3 KB
  • references/scale-profiles.md2.5 KB
  • references/skeleton.md2.2 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.