pm-claude-skills 35.0.0 → 36.0.0

package/README.md

@@ -1,4 +1,4 @@
-# 🧠 PM Skills — 400 Professional Agent Skills for Claude, ChatGPT, Gemini, Cursor, Codex & Hermes
+# 🧠 PM Skills — 411 Professional Agent Skills for Claude, ChatGPT, Gemini, Cursor, Codex & Hermes
 
 [![In the official Anthropic plugin directory](https://img.shields.io/badge/Anthropic%20Plugin%20Directory-Published-D97757?logo=anthropic&logoColor=white)](#-quick-install-2-minutes)
 [![Stars](https://img.shields.io/github/stars/mohitagw15856/pm-claude-skills?style=social)](https://github.com/mohitagw15856/pm-claude-skills/stargazers)
@@ -9,7 +9,7 @@
 [![MCP](https://img.shields.io/badge/MCP-registry-0098FF?logo=modelcontextprotocol&logoColor=white)](https://github.com/mohitagw15856/pm-claude-skills#-use-it-anywhere--the-ai-ecosystem)
 [![Remote MCP](https://img.shields.io/badge/ChatGPT%20%C2%B7%20Claude.ai-connector-10A37F)](mcp-remote/)
 [![Smithery](https://smithery.ai/badge/mohit15856/pm-skills)](https://smithery.ai/servers/mohit15856/pm-skills)
-[![Skills](https://img.shields.io/badge/skills-400-blue)](https://github.com/mohitagw15856/pm-claude-skills)
+[![Skills](https://img.shields.io/badge/skills-411-blue)](https://github.com/mohitagw15856/pm-claude-skills)
 [![eval](https://img.shields.io/badge/eval--scored-208%20%C2%B7%20avg%204.8%2F5-brightgreen)](https://mohitagw15856.github.io/pm-claude-skills/leaderboard.html)
 [![Subagents](https://img.shields.io/badge/subagents-4-blueviolet)](agents/)
 [![Commands](https://img.shields.io/badge/slash%20commands-19-blueviolet)](commands/)
@@ -25,7 +25,7 @@
 
 <p align="center">
   <a href="https://mohitagw15856.github.io/pm-claude-skills/">
-    <img src="https://readme-typing-svg.demolab.com?font=Inter&weight=600&size=24&pause=900&color=D97757&center=true&vCenter=true&width=720&lines=400+pro+AI+skills;PRDs%2C+roadmaps%2C+launches+%E2%80%94+done+right;Run+any+one+free+in+your+browser" alt="PM Skills" />
+    <img src="https://readme-typing-svg.demolab.com?font=Inter&weight=600&size=24&pause=900&color=D97757&center=true&vCenter=true&width=720&lines=411+pro+AI+skills;PRDs%2C+roadmaps%2C+launches+%E2%80%94+done+right;Run+any+one+free+in+your+browser" alt="PM Skills" />
   </a>
 </p>
 
@@ -56,11 +56,11 @@
 *Not sure? Start with the Playground.* This is a **CLI, not a library** — you don't need `npm install`; `npx pm-claude-skills …` always runs the latest. Browse everything first with `npx pm-claude-skills list`.
 
 > **PM stands for Professional, not just Product Management.**
-> 400 professional skills + 4 agent templates across 57 bundles covering 25 professions. Built for Claude Code — and now portable to ChatGPT, Gemini, and Hermes Agent. Built by a PM, used by everyone.
+> 411 professional skills + 4 agent templates across 59 bundles covering 25 professions. Built for Claude Code — and now portable to ChatGPT, Gemini, and Hermes Agent. Built by a PM, used by everyone.
 
 A community-built library of professional skills for every field — product management, engineering, customer success, marketing, social media, writers, design, legal, finance, HR, sales, operations, research, and more. Each skill is a structured `SKILL.md` file that teaches an AI assistant how to produce professional-grade outputs for your workflows. Skills run natively in **Claude Code** and **Hermes Agent** (same open `SKILL.md` standard), and ship as ready-to-paste exports for **ChatGPT** and **Gemini** — see [Works With](#-works-with--cross-tool-compatibility).
 
-**🆕 Latest — v34.0.0 (Engineering craft, a "grill me" brief-builder & marketing depth):** a new **🛠️ `pm-craft` bundle** of *how-to-work* discipline for coding agents — `tdd-workflow`, `bug-diagnosis`, `refactoring-plan`, `session-handoff`, `pr-description`, `code-review-guide` (process, not just artifacts). A new **`brief-builder`** skill that *interviews you* with sharp questions to build a tight brief before producing — the one interaction pattern the library was missing. Plus 6 marketing skills filling real gaps: `programmatic-seo`, `schema-markup`, `marketing-psychology`, `referral-program`, `co-marketing`, `paywall-optimization`. *Earlier (v33.0):* `pm-money` + `pm-devrel` bundles, the ✨ Visualize button, and the constellation Galaxy. **400 skills across 57 bundles.** → **[Full release history & notes](https://github.com/mohitagw15856/pm-claude-skills/releases)**.
+**🆕 Latest — v36.0.0 (Security & Government bundles, Fable 5 & an always-current catalog):** two new professional domains — **🔒 `pm-security`** (hands-on appsec: `threat-model` STRIDE, `security-review`, `vuln-triage` CVSS, `security-incident-response`, `pentest-report` — defensive & authorized-testing framing) and **🏛️ `pm-gov`** (`rfp-response`, `policy-memo`, `public-comment`, `briefing-note`, `foia-request`, `regulatory-impact-analysis`). The playground now offers **Fable 5 ✨**, the newest model, as the default. And **`SKILLS.md` is auto-generated** from the catalog (grouped by domain), so the full listing can never go stale again. *Earlier (v35.0):* the `pm-pmm` Product Marketing bundle, Custom GPT / Gemini Gem, and Raycast/Alfred launchers. **411 skills across 59 bundles.** → **[Full release history & notes](https://github.com/mohitagw15856/pm-claude-skills/releases)**.
 
 ### ▶ See it in action — [try the live Skill Playground](https://mohitagw15856.github.io/pm-claude-skills/)
 
@@ -89,7 +89,7 @@ A community-built library of professional skills for every field — product man
 | 🔭 [Competitor Teardown](skills/competitor-teardown) | "what are rivals up to?" | a positioning map, feature gaps & strategy |
 | 📝 [Meeting Notes](skills/meeting-notes) | a raw transcript | decisions, owners & next steps |
 
-→ Want proof first? See [**real sample outputs**](https://mohitagw15856.github.io/pm-claude-skills/examples.html) from each skill. Like what you see? [**Install in 2 minutes**](#-quick-install-2-minutes) · [browse all 400 skills](#️-all-400-skills) · [**⭐ star the repo**](https://github.com/mohitagw15856/pm-claude-skills/stargazers) so others find it.
+→ Want proof first? See [**real sample outputs**](https://mohitagw15856.github.io/pm-claude-skills/examples.html) from each skill. Like what you see? [**Install in 2 minutes**](#-quick-install-2-minutes) · [browse all 411 skills](#️-all-411-skills) · [**⭐ star the repo**](https://github.com/mohitagw15856/pm-claude-skills/stargazers) so others find it.
 
 ---
 
@@ -112,7 +112,7 @@ It's not just text — the playground exports every result as a **professionally
   </tr>
 </table>
 
-> Generate yours: run a skill in the [Playground](https://mohitagw15856.github.io/pm-claude-skills/), then **Download → PDF · Paper / Modern / Technical**. Add a `Brand color: #hex` line to your context and it tints to match (last tile). Personal documents live in the [`pm-personal`](#️-all-400-skills) bundle (résumé, cover letter, bio, LinkedIn, portfolio, one-pager).
+> Generate yours: run a skill in the [Playground](https://mohitagw15856.github.io/pm-claude-skills/), then **Download → PDF · Paper / Modern / Technical**. Add a `Brand color: #hex` line to your context and it tints to match (last tile). Personal documents live in the [`pm-personal`](#️-all-411-skills) bundle (résumé, cover letter, bio, LinkedIn, portfolio, one-pager).
 
 ---
 
@@ -121,11 +121,11 @@ It's not just text — the playground exports every result as a **professionally
 <details>
 <summary>Read more ↓</summary>
 
-The whole library on one page — install, all 400 skills by profession, the Professional Brain, the REST API, integrations, and quality tooling. Great to **print, share, or drop into a slide**.
+The whole library on one page — install, all 411 skills by profession, the Professional Brain, the REST API, integrations, and quality tooling. Great to **print, share, or drop into a slide**.
 
 <p align="center">
   <a href="CHEATSHEET.md">
-    <img src="web/docs-assets/cheatsheet.png" width="80%" alt="PM Skills one-page cheatsheet — 400 skills, the Professional Brain, REST API, integrations, and tooling at a glance." />
+    <img src="web/docs-assets/cheatsheet.png" width="80%" alt="PM Skills one-page cheatsheet — 411 skills, the Professional Brain, REST API, integrations, and tooling at a glance." />
   </a>
 </p>
 
@@ -156,7 +156,7 @@ Generic AI forgets everything between sessions, so you re-paste context forever
 <details>
 <summary>Read more ↓</summary>
 
-These 400 skills aren't a random catalog — they cover the **full arc of professional work**, end to end. Wherever you are in the loop, there's a skill for it:
+These 411 skills aren't a random catalog — they cover the **full arc of professional work**, end to end. Wherever you are in the loop, there's a skill for it:
 
 ```mermaid
 flowchart LR
@@ -175,7 +175,7 @@ flowchart LR
 | **📊 Measure** | Track outcomes & analyse | `metrics-framework` · `cohort-analysis` · `ab-test-planner` · `churn-analysis` |
 | **📣 Communicate** | Report up and out | `executive-update` · `board-deck-narrative` · `stakeholder-update` · `qbr-deck` |
 
-> New here? Start with the [**top-tier skills**](#️-skill-tiers--start-with-the-strongest), or jump straight to [**all 400 skills**](#️-all-400-skills) grouped by profession.
+> New here? Start with the [**top-tier skills**](#️-skill-tiers--start-with-the-strongest), or jump straight to [**all 411 skills**](#️-all-411-skills) grouped by profession.
 
 </details>
 
@@ -298,7 +298,7 @@ Most skill repos are a folder of prompts. This one is a **system** — measured,
 
 | | **PM Skills** | Typical skill repo |
 |---|:---:|:---:|
-| Skills | **400**, across 25 professions | a handful → dozens, usually one domain |
+| Skills | **411**, across 25 professions | a handful → dozens, usually one domain |
 | Quality | **eval-scored** on a rubric + a public [benchmark](https://mohitagw15856.github.io/pm-claude-skills/benchmark.html) | trust the README |
 | Improves itself | ✅ eval → critique → rewrite (kept only if it scores higher) | ✗ |
 | Grounded in frameworks | ✅ each cites its source (RICE, JTBD, Pyramid Principle…) | rarely |
@@ -323,13 +323,13 @@ Most skill repos are a folder of prompts. This one is a **system** — measured,
 >
 > ⚠️ **You don't need `npm install pm-claude-skills`** — it's a CLI, not a library, so there's nothing to import. Use `npx pm-claude-skills …` (it always runs the latest). `npm install` just downloads it and does nothing on its own.
 
-**With the [`skills`](https://github.com/vercel-labs/skills) CLI** (the open agent-skills installer that works across Claude Code, Cursor, Codex, OpenCode & 60+ agents) — pick from all 400 interactively:
+**With the [`skills`](https://github.com/vercel-labs/skills) CLI** (the open agent-skills installer that works across Claude Code, Cursor, Codex, OpenCode & 60+ agents) — pick from all 411 interactively:
 
 ```bash
 npx skills add mohitagw15856/pm-claude-skills            # browse & pick (auto-detects your agent)
 npx skills add mohitagw15856/pm-claude-skills --list     # just preview the catalog
 npx skills add mohitagw15856/pm-claude-skills --skill prd-template   # grab one
-npx skills add mohitagw15856/pm-claude-skills --skill '*'            # install all 400
+npx skills add mohitagw15856/pm-claude-skills --skill '*'            # install all 411
 ```
 
 **Or our own installer** — via the [`pm-claude-skills`](https://www.npmjs.com/package/pm-claude-skills) npm package (Windows/macOS/Linux, needs Node), which also installs subagents, slash commands & cross-tool exports:
@@ -338,7 +338,7 @@ npx skills add mohitagw15856/pm-claude-skills --skill '*'            # install a
 npx pm-claude-skills add --agent claude     # or: codex · cursor · hermes · openclaw
 ```
 
-**Or one-line MCP** — make all 400 skills + 5 workflow recipes available in *every* session of any MCP client (Claude Code, Claude Desktop, Cursor, Windsurf), no per-file install:
+**Or one-line MCP** — make all 411 skills + 5 workflow recipes available in *every* session of any MCP client (Claude Code, Claude Desktop, Cursor, Windsurf), no per-file install:
 
 ```bash
 claude mcp add pm-skills -- npx -y pm-claude-skills-mcp
@@ -399,7 +399,7 @@ ln -s ~/pm-claude-skills/skills/* ~/.claude/skills/
 <details>
 <summary>Read more ↓</summary>
 
-The same 400 skills reach you through every channel — pick whatever fits your stack:
+The same 411 skills reach you through every channel — pick whatever fits your stack:
 
 | Channel | Get it |
 |---|---|
@@ -412,10 +412,11 @@ The same 400 skills reach you through every channel — pick whatever fits your
 | 🧩 **Browser extension** | A skill picker inside ChatGPT, Claude.ai & Gemini — [`extension/`](extension/) |
 | 🚀 **Raycast / Alfred** | Search every skill from your launcher, then open, run, or install it — [`integrations/raycast/`](integrations/raycast/) · [`integrations/alfred/`](integrations/alfred/) |
 | 🤖 **Custom GPT / Gemini Gem** | Publish the library as a GPT (live Actions API) or a Gem — copy-paste setup in [`integrations/custom-gpt/`](integrations/custom-gpt/) · [`integrations/gemini-gem/`](integrations/gemini-gem/) |
+| 💬 **Slack / Discord** | A `/pmskill` slash command in your team chat — one signature-verified Worker for both — [`integrations/chatops/`](integrations/chatops/) |
 | 🖥️ **IDE rules** | Generated exports for **Cursor, Windsurf, Aider, Cline, Continue, Zed, Roo, Kilo Code** — [`exports/`](exports/) |
 | 🤖 **Agents & answer engines** | [`llms.txt`](https://mohitagw15856.github.io/pm-claude-skills/llms.txt) makes the whole library discoverable & citable |
 
-> **208 of 400 skills are eval-scored, averaging 4.8/5** — see the [leaderboard](https://mohitagw15856.github.io/pm-claude-skills/leaderboard.html).
+> **208 of 411 skills are eval-scored, averaging 4.8/5** — see the [leaderboard](https://mohitagw15856.github.io/pm-claude-skills/leaderboard.html).
 
 > 🧠 **Give your skills memory:** the [Professional Brain](BRAIN.md) is a local markdown folder skills read, write back to, and act on. It's a folder + one file to start — **[5-minute Quickstart](BRAIN_QUICKSTART.md)**.
 
@@ -437,7 +438,7 @@ There are two kinds of support. **Native `SKILL.md` agents** read the file as-is
 auto-discover skills from the `description` frontmatter. **Other tools** take the markdown
 body as a system prompt — for those we ship ready-made [exports](#ready-to-use-exports).
 
-**In your editor (VS Code / Cursor):** the [**`vscode-extension/`**](vscode-extension/) brings all 400 skills into the Command Palette — search and *insert a skill as context* for Copilot/Cursor chat, copy it, or open it in the Playground.
+**In your editor (VS Code / Cursor):** the [**`vscode-extension/`**](vscode-extension/) brings all 411 skills into the Command Palette — search and *insert a skill as context* for Copilot/Cursor chat, copy it, or open it in the Playground.
 
 | Platform | How it works | Auto-trigger? |
 |---|---|---|
@@ -599,7 +600,7 @@ ANTHROPIC_API_KEY=sk-ant-… npx pm-claude-skills generate --from ./team-process
 
 **🏆 Skill Leaderboard — [evals](evals/).** An LLM-as-judge harness scores each skill across Claude models on structure, completeness, usefulness, and grounding. **[View the leaderboard →](https://mohitagw15856.github.io/pm-claude-skills/leaderboard.html)**
 
-> **Score the *whole* library, cheaply.** `npm run eval:gen-cases` writes a representative input for **all 400 skills** (curated cases kept verbatim; the rest auto-generated), then `npm run eval:all` runs the full pass on Haiku for **~$2** total. The weakest scorers can then be auto-rewritten with **`npm run improve -- <skill>`** (`/improve`), which keeps a change only if the score goes up.
+> **Score the *whole* library, cheaply.** `npm run eval:gen-cases` writes a representative input for **all 411 skills** (curated cases kept verbatim; the rest auto-generated), then `npm run eval:all` runs the full pass on Haiku for **~$2** total. The weakest scorers can then be auto-rewritten with **`npm run improve -- <skill>`** (`/improve`), which keeps a change only if the score goes up.
 
 </details>
 
@@ -695,7 +696,7 @@ Not sure which plugin to install? Here's what each one covers:
 
 On May 5, 2026, Anthropic [released their first agent templates](https://www.anthropic.com/news/finance-agents) — pre-packaged Claude agents that combine **skills, connectors, and subagents** into ready-to-run workflows for financial services.
 
-This library is the largest open-source collection of professional skills available — covering 20 professions beyond financial services. **The 400 skills here are the building blocks for agent templates outside of finance.**
+This library is the largest open-source collection of professional skills available — covering 20 professions beyond financial services. **The 411 skills here are the building blocks for agent templates outside of finance.**
 
 ### What is an agent template?
 
@@ -775,7 +776,7 @@ More templates will follow. If you want to contribute one, see the [template con
 <details>
 <summary>Read more ↓</summary>
 
-**Latest: v32.0.0 — 4 new bundles, 24 skills (E-commerce, UX Writing, Recruiting, Accounting).** 400 skills across 57 bundles, 25 professions. Every tagged release has complete notes on the **[Releases page](https://github.com/mohitagw15856/pm-claude-skills/releases)**.
+**Latest: v32.0.0 — 4 new bundles, 24 skills (E-commerce, UX Writing, Recruiting, Accounting).** 411 skills across 59 bundles, 25 professions. Every tagged release has complete notes on the **[Releases page](https://github.com/mohitagw15856/pm-claude-skills/releases)**.
 
 Full [Keep a Changelog](https://keepachangelog.com/)-format history — every release back to the start — is in **[CHANGELOG.md](CHANGELOG.md)**.
 
@@ -823,7 +824,7 @@ This repo was built alongside a published 16-part article series on Medium.
 <details>
 <summary>Read more ↓</summary>
 
-A 400-skill library doesn't have 400 equally-mature skills, and pretending otherwise
+A 411-skill library doesn't have 411 equally-mature skills, and pretending otherwise
 wastes your time. Skills are tiered honestly so you can start with the best work:
 
 - 🟢 **Production-Ready (50)** — battle-tested, stable output, used in real work. Includes the three skills with computed Python helpers (sprint planning, RICE, customer health). **Start here.**
@@ -838,7 +839,7 @@ If you're new, install `pm-essentials` and try a couple of Production-Ready skil
 
 ---
 
-## 🗂️ All 400 Skills
+## 🗂️ All 411 Skills
 
 <details>
 <summary>Read more ↓</summary>
@@ -872,8 +873,10 @@ Every skill, grouped by profession. **[Browse the full per-skill catalog → SKI
 | 💰 Personal Finance | `pm-money` 🆕 | 6 | `budget-builder` · `debt-payoff-plan` · `net-worth-statement` |
 | 🛠️ Developer Relations | `pm-devrel` 🆕 | 6 | `launch-post` · `readme-writer` · `changelog-writer` |
 | 🧑‍🔧 Engineering Craft | `pm-craft` 🆕 | 6 | `tdd-workflow` · `bug-diagnosis` · `code-review-guide` |
+| 🔒 Security | `pm-security` 🆕 | 5 | `threat-model` · `security-review` · `vuln-triage` |
+| 🏛️ Government & Policy | `pm-gov` 🆕 | 6 | `policy-memo` · `rfp-response` · `public-comment` |
 
-> Full per-skill detail (folder paths, descriptions, "🆕" markers) lives in **[SKILLS.md](SKILLS.md)**.
+> Full per-skill detail (folder paths, descriptions, "🆕" markers) lives in **[SKILLS.md](SKILLS.md)** — auto-generated, always current.
 
 </details>
 
@@ -884,7 +887,7 @@ Every skill, grouped by profession. **[Browse the full per-skill catalog → SKI
 <details>
 <summary>Read more ↓</summary>
 
-Building and maintaining 400 skills across 57 bundles takes real time — testing skills against new model releases, building new ones from community requests, writing the article series, and keeping documentation current.
+Building and maintaining 411 skills across 59 bundles takes real time — testing skills against new model releases, building new ones from community requests, writing the article series, and keeping documentation current.
 
 If these skills save you time at work — or you're a company that wants your logo in front of the PMs, engineers, and operators who use them daily — **[become a sponsor →](https://github.com/sponsors/mohitagw15856)** (or [☕ buy me a coffee](https://www.buymeacoffee.com/mohit15856)).
 
@@ -916,7 +919,7 @@ pull request**, and once it's merged you earn a badge to show off in your own re
 ```
 
 Community listings live in their authors' own repos and are **community-maintained — not
-eval-scored or security-audited** (that's the [curated library](#️-all-400-skills) above). Want
+eval-scored or security-audited** (that's the [curated library](#️-all-411-skills) above). Want
 your skill *in* the curated library instead? See **Contributing** below.
 
 ---
@@ -1146,7 +1149,7 @@ Stars unlock the next wave of skills and features. We've hit every milestone so
 | 1,000 ⭐ | Startup Founder kit — *delivered, and then some: the Founders **and** Educators bundles + a browser extension for ChatGPT/Claude.ai/Gemini* | ✅ Shipped (v24.0.0) |
 | **2,000 ⭐** | 2 community-voted profession bundles + the browser & VS Code extensions published to their stores | 🔓 **Current goal** |
 | 3,500 ⭐ | Community **skill packs** (curated role/industry bundles) + internationalised skill descriptions | 🔒 Locked |
-| 5,000 ⭐ | Public **contributor leaderboard** + the push to 400 skills | 🔒 Locked |
+| 5,000 ⭐ | Public **contributor leaderboard** + the push to 411 skills | 🔒 Locked |
 
 **[⭐ Star this repo to unlock the next milestone →](https://github.com/mohitagw15856/pm-claude-skills)** — we're at **2,000⭐** next.
 

package/exports/README.md

@@ -8,7 +8,7 @@ by hand; edit the source skill and run:
 node scripts/build-exports.mjs
 ```
 
-Currently exporting **400 skills** to:
+Currently exporting **411 skills** to:
 
 - **ChatGPT — Custom GPT instructions** → `exports/chatgpt/`
 - **Google Gemini — Gem instructions** → `exports/gemini/`

package/exports/aider/README.md

@@ -3,7 +3,7 @@
 > Auto-generated from `skills/*/SKILL.md` by `scripts/build-exports.mjs`.
 > **Do not edit these files by hand** — edit the source skill and regenerate.
 
-400 skills exported. Copy a `.mdc rule` into the tool to use it.
+411 skills exported. Copy a `.mdc rule` into the tool to use it.
 
 | Skill | Bundle | Path |
 |---|---|---|
@@ -38,6 +38,7 @@
 | Boolean Search Builder | `pm-recruiting` | `pm-recruiting/boolean-search-builder/boolean-search-builder.md` |
 | Brag Doc | `pm-career` | `pm-career/brag-doc/brag-doc.md` |
 | Brief Builder | `pm-cross` | `pm-cross/brief-builder/brief-builder.md` |
+| Briefing Note | `pm-gov` | `pm-gov/briefing-note/briefing-note.md` |
 | Budget Builder | `pm-money` | `pm-money/budget-builder/budget-builder.md` |
 | Budget Variance Analysis | `pm-finance` | `pm-finance/budget-variance-analysis/budget-variance-analysis.md` |
 | Bug Diagnosis | `pm-craft` | `pm-craft/bug-diagnosis/bug-diagnosis.md` |
@@ -166,6 +167,7 @@
 | Financial Model Narrative | `pm-finance` | `pm-finance/financial-model-narrative/financial-model-narrative.md` |
 | Financial Statement Explainer | `pm-accounting` | `pm-accounting/financial-statement-explainer/financial-statement-explainer.md` |
 | Flowchart | `pm-visuals` | `pm-visuals/flowchart/flowchart.md` |
+| FOIA / Public-Records Request | `pm-gov` | `pm-gov/foia-request/foia-request.md` |
 | Follow-Up Sequence | `pm-jobsearch` | `pm-jobsearch/follow-up-sequence/follow-up-sequence.md` |
 | Founder-Market Fit | `pm-founders` | `pm-founders/founder-market-fit/founder-market-fit.md` |
 | Fundraising FAQ | `pm-founders` | `pm-founders/fundraising-faq/fundraising-faq.md` |
@@ -259,11 +261,13 @@
 | Partnership Proposal | `pm-sales` | `pm-sales/partnership-proposal/partnership-proposal.md` |
 | Patient Communication | `pm-research` | `pm-research/patient-communication/patient-communication.md` |
 | Paywall Optimization | `pm-growth` | `pm-growth/paywall-optimization/paywall-optimization.md` |
+| Penetration Test Report | `pm-security` | `pm-security/pentest-report/pentest-report.md` |
 | Performance Budget | `pm-engineering` | `pm-engineering/performance-budget/performance-budget.md` |
 | Performance Review | `pm-people` | `pm-people/performance-review/performance-review.md` |
 | Personal Bio | `pm-personal` | `pm-personal/personal-bio/personal-bio.md` |
 | Persuasion Brief | `pm-comms` | `pm-comms/persuasion-brief/persuasion-brief.md` |
 | PM Weekly Review | `pm-rituals` | `pm-rituals/pm-weekly-review/pm-weekly-review.md` |
+| Policy Memo | `pm-gov` | `pm-gov/policy-memo/policy-memo.md` |
 | Portfolio Page | `pm-personal` | `pm-personal/portfolio-page/portfolio-page.md` |
 | PPTX Slide Auditor | `pm-delivery` | `pm-delivery/pptx-slide-auditor/pptx-slide-auditor.md` |
 | PR Crisis Response | `pm-crisis` | `pm-crisis/pr-crisis-response/pr-crisis-response.md` |
@@ -293,6 +297,7 @@
 | Property Listing | `pm-realestate` | `pm-realestate/property-listing/property-listing.md` |
 | Property Offer Letter | `pm-realestate` | `pm-realestate/property-offer-letter/property-offer-letter.md` |
 | Proposal Writer | `pm-sales` | `pm-sales/proposal-writer/proposal-writer.md` |
+| Public Comment | `pm-gov` | `pm-gov/public-comment/public-comment.md` |
 | QA Release Sign-off | `pm-qa` | `pm-qa/qa-release-signoff/qa-release-signoff.md` |
 | QBR Deck | `pm-cs` | `pm-cs/qbr-deck/qbr-deck.md` |
 | Quiz Generator | `pm-education` | `pm-education/quiz-generator/quiz-generator.md` |
@@ -311,6 +316,7 @@
 | Referral Program Design | `pm-growth` | `pm-growth/referral-program-design/referral-program-design.md` |
 | Regex Builder & Explainer | `pm-engineering` | `pm-engineering/regex-builder/regex-builder.md` |
 | Regression Test Plan | `pm-qa` | `pm-qa/regression-test-plan/regression-test-plan.md` |
+| Regulatory Impact Analysis | `pm-gov` | `pm-gov/regulatory-impact-analysis/regulatory-impact-analysis.md` |
 | Renewal Playbook | `pm-cs` | `pm-cs/renewal-playbook/renewal-playbook.md` |
 | Rental Application | `pm-lifeadmin` | `pm-lifeadmin/rental-application/rental-application.md` |
 | Research Protocol | `pm-research` | `pm-research/research-protocol/research-protocol.md` |
@@ -321,6 +327,7 @@
 | Return & Refund Policy | `pm-ecommerce` | `pm-ecommerce/return-refund-policy/return-refund-policy.md` |
 | Review Response | `pm-ecommerce` | `pm-ecommerce/review-response/review-response.md` |
 | RFC Writer | `pm-engineering` | `pm-engineering/rfc-writer/rfc-writer.md` |
+| RFP Response | `pm-gov` | `pm-gov/rfp-response/rfp-response.md` |
 | RFP Writer | `pm-operations` | `pm-operations/rfp-writer/rfp-writer.md` |
 | RICE + Strategic Alignment | `pm-planning` | `pm-planning/rice-impact-matrix/rice-impact-matrix.md` |
 | RICE Prioritisation | `pm-planning` | `pm-planning/rice-prioritisation/rice-prioritisation.md` |
@@ -342,6 +349,8 @@
 | Savings Goal Plan | `pm-money` | `pm-money/savings-goal-plan/savings-goal-plan.md` |
 | Saying No | `pm-comms` | `pm-comms/saying-no/saying-no.md` |
 | Schema Markup | `pm-growth` | `pm-growth/schema-markup/schema-markup.md` |
+| Security Incident Response | `pm-security` | `pm-security/security-incident-response/security-incident-response.md` |
+| Security Review | `pm-security` | `pm-security/security-review/security-review.md` |
 | Security Threat Model | `pm-engineering` | `pm-engineering/security-threat-model/security-threat-model.md` |
 | Self-Review | `pm-career` | `pm-career/self-review/self-review.md` |
 | SEO Content Brief | `pm-gtm` | `pm-gtm/seo-content-brief/seo-content-brief.md` |
@@ -388,6 +397,7 @@
 | Tenant Screening Guide | `pm-realestate` | `pm-realestate/tenant-screening-guide/tenant-screening-guide.md` |
 | Test Case Writer | `pm-qa` | `pm-qa/test-case-writer/test-case-writer.md` |
 | Test Strategy Document | `pm-engineering` | `pm-engineering/test-strategy-doc/test-strategy-doc.md` |
+| Threat Model | `pm-security` | `pm-security/threat-model/threat-model.md` |
 | Thumbnail Creator Skill (via Gemini) | `pm-writers` | `pm-writers/thumbnail-creator/thumbnail-creator.md` |
 | Transcreation | `pm-localization` | `pm-localization/transcreation/transcreation.md` |
 | Unit Economics | `pm-calculators` | `pm-calculators/unit-economics/unit-economics.md` |
@@ -402,6 +412,7 @@
 | Vendor Security Review | `pm-compliance` | `pm-compliance/vendor-security-review/vendor-security-review.md` |
 | Viral Content Framework | `pm-social` | `pm-social/viral-content-framework/viral-content-framework.md` |
 | Voice of Customer Program | `pm-pmm` | `pm-pmm/voice-of-customer-program/voice-of-customer-program.md` |
+| Vulnerability Triage | `pm-security` | `pm-security/vuln-triage/vuln-triage.md` |
 | Win/Loss Analysis | `pm-pmm` | `pm-pmm/win-loss-analysis/win-loss-analysis.md` |
 | Word Document | `pm-documents` | `pm-documents/word-document/word-document.md` |
 | Workshop Facilitation Guide | `pm-operations` | `pm-operations/workshop-facilitation-guide/workshop-facilitation-guide.md` |

package/exports/aider/pm-gov/briefing-note/briefing-note.md

@@ -0,0 +1,51 @@
+# Briefing Note Skill
+
+A briefing note gets a principal ready for a decision, a meeting, or a question — on one page, in two minutes.
+It's ruthlessly concise: purpose, the few facts that matter, the considerations, and what's being asked.
+This skill writes that note in the standard structure officials and executives expect.
+
+## Required Inputs
+
+Ask for these only if they aren't already provided:
+
+- **Purpose** — why the note exists: for decision, for information, or for a meeting/event.
+- **The audience** — who's being briefed and what they need (and already know).
+- **The substance** — the issue, key facts, relevant background, positions of stakeholders.
+- **The ask** — the decision sought, or the meeting/response the note prepares them for.
+
+## Output Format
+
+### BRIEFING NOTE — [subject]
+**Date · Prepared for · Purpose:** [for decision / for information / for meeting on DATE]
+
+**Issue** — one or two lines: what this is about and why it's in front of them now.
+
+**Background** — the minimum context needed, as tight bullets (dates, decisions to date, who's involved). No history for its own sake.
+
+**Key considerations** — the factors that matter to the decision or discussion: facts, risks, sensitivities (financial, legal, political, reputational), stakeholder positions. Bullets, not prose.
+
+**Recommendation / decision sought** — if for decision: the recommended action and one-line rationale. If for information/meeting: the key messages or the line to take, and likely questions with suggested answers.
+
+**Contact** — who to follow up with.
+
+Keep it to **one page**. Detail belongs in an annex, referenced not included.
+
+## Quality Checks
+
+- [ ] The purpose (decision / information / meeting) is stated up front and shapes the note
+- [ ] It fits on one page and is scannable in ~2 minutes (bullets, not paragraphs)
+- [ ] Background is the minimum needed — no padding
+- [ ] Key considerations surface the real risks/sensitivities, not just facts
+- [ ] It ends with a clear recommendation or the specific decision/action sought
+
+## Anti-Patterns
+
+- [ ] Do not write an essay — a briefing note is one page of scannable bullets
+- [ ] Do not include history the principal doesn't need to act — annex it
+- [ ] Do not bury the ask — state the decision sought or key messages plainly
+- [ ] Do not omit sensitivities/risks — surprising a principal in the room is the cardinal sin
+- [ ] Do not editorialize — be accurate and balanced; flag where judgment is involved
+
+## Based On
+
+Government/executive briefing-note practice (purpose-led, one page, key considerations, decision-or-line-to-take).

package/exports/aider/pm-gov/foia-request/foia-request.md

@@ -0,0 +1,58 @@
+# FOIA / Public-Records Request Skill
+
+Public-records requests fail when they're too vague ("all documents about X") — agencies reject or stall them.
+A good request is *specific*: named record types, a date range, the right custodian, and the statutory hooks
+for fees and timing. This skill drafts a request that's easy to fulfil and hard to deny.
+
+> Educational drafting aid. Public-records laws vary by jurisdiction (US federal FOIA, US state open-records
+> laws, UK/EU FOI, etc.) — confirm the governing statute, agency, and deadlines for the specific case.
+
+## Required Inputs
+
+Ask for these only if they aren't already provided:
+
+- **The records you want** — as specifically as possible (type, subject, people/programs, keywords).
+- **Timeframe & custodian** — the date range, and which agency/department/office likely holds them.
+- **Jurisdiction** — federal, which state, or which country's FOI law (sets the statute, timelines, exemptions).
+- **Requester type & purpose** — individual, journalist, researcher, commercial — affects fee category and waivers.
+- **Format** — how you want records delivered (electronic preferred, native format).
+
+## Output Format
+
+### Public-records request — [agency]
+
+**To:** the agency's FOIA/records officer (address/portal). **Date.**
+
+**1. Statement of request** — "Under [the governing statute, e.g. the Freedom of Information Act, 5 U.S.C. § 552 / the [State] Public Records Act], I request the following records:"
+
+**2. Records sought** — a numbered, specific list. For each: record type, subject, custodian if known, and the **date range**. Specific beats broad — narrow, well-defined items get filled; sweeping ones get denied.
+
+**3. Format & delivery** — preferred format (electronic/native), and delivery method.
+
+**4. Fees** — a fee category statement and, where applicable, a **fee-waiver request** (e.g. disclosure is in the public interest / non-commercial) with brief justification, plus a cap ("please contact me before incurring fees over $X").
+
+**5. Expedited processing** (if applicable) — the basis (urgency, media, imminent public need).
+
+**6. Response-time note** — cite the statutory response deadline and request acknowledgment.
+
+**7. Contact & signature.**
+
+## Quality Checks
+
+- [ ] Records sought are specific (type, subject, custodian, date range) — not "all documents about X"
+- [ ] The governing statute and jurisdiction are cited correctly
+- [ ] Format/delivery preference is stated
+- [ ] Fee category, a fee-waiver ask (if applicable), and a cost cap are included
+- [ ] Expedited processing and the statutory response deadline are addressed where relevant
+
+## Anti-Patterns
+
+- [ ] Do not write an overbroad "any and all records" request — it invites denial or endless delay
+- [ ] Do not omit the date range and custodian — specificity is what gets records produced
+- [ ] Do not forget the fee cap — an uncapped request can return a huge estimate that stalls it
+- [ ] Do not cite the wrong law for the jurisdiction — federal FOIA ≠ state open-records acts
+- [ ] Do not overstate an expedited-processing basis — it must genuinely qualify
+
+## Based On
+
+FOIA / public-records practice (specificity, statutory citation, fee-waiver & expedited-processing provisions).

package/exports/aider/pm-gov/policy-memo/policy-memo.md

@@ -0,0 +1,57 @@
+# Policy Memo Skill
+
+A policy memo exists to drive a *decision*, not to demonstrate research. The decision-maker reads the top and
+wants: what's the issue, what are my realistic options, what do you recommend, and what happens if I say yes.
+This skill writes that — BLUF (bottom line up front), honest options with trade-offs, and a defensible
+recommendation.
+
+## Required Inputs
+
+Ask for these only if they aren't already provided:
+
+- **The issue / decision** — what must be decided and why now.
+- **The decision-maker** — who reads it (minister, exec, board) and what they care about / can authorize.
+- **Context** — relevant background, constraints (legal, budget, political), stakeholders.
+- **The options** — the realistic choices (or ask the skill to develop them), and any evidence/data.
+
+## Output Format
+
+### MEMO — [subject]
+**To / From / Date / Re** — standard header.
+
+**Bottom line (BLUF)** — 2–3 sentences: the issue, your recommended option, and the key reason. A busy reader should get the decision from this alone.
+
+**Issue** — the precise question to be decided, and why it needs a decision now.
+
+**Background** — only what's needed to decide (concise; detail goes to an annex). Facts, constraints, what's at stake.
+
+**Options** — 2–4 realistic options (including status quo). For each: what it is, pros, cons, cost/feasibility, and who's affected. A comparison table helps:
+
+| Option | Pros | Cons | Cost / feasibility |
+|---|---|---|---|
+
+**Recommendation** — the option you recommend and *why* it best fits the goals and constraints. Be decisive; acknowledge the main trade-off you're accepting.
+
+**Implementation & risks** — key steps, timeline, who does what, and the main risks + mitigations.
+
+**Next step / decision requested** — exactly what you're asking the reader to approve.
+
+## Quality Checks
+
+- [ ] The bottom line up front gives the recommendation in the first paragraph
+- [ ] The issue is framed as a precise, decidable question
+- [ ] Options include the status quo and show honest trade-offs (cost/feasibility, not just pros)
+- [ ] The recommendation is decisive and justified against the stated goals/constraints
+- [ ] Implementation, risks, and the specific decision requested are all present
+
+## Anti-Patterns
+
+- [ ] Do not bury the recommendation at the end — decision-makers read the top
+- [ ] Do not present a fake menu (one real option + straw men) — options must be genuine
+- [ ] Do not dump all the research — include only what's needed to decide; annex the rest
+- [ ] Do not hedge into non-recommendation — name a choice and own the trade-off
+- [ ] Do not ignore feasibility/cost/politics — an un-implementable recommendation is useless
+
+## Based On
+
+Government & executive decision-memo practice (BLUF, options analysis, evidence-based recommendation, implementation).

package/exports/aider/pm-gov/public-comment/public-comment.md

@@ -0,0 +1,55 @@
+# Public Comment Skill
+
+Agencies must review and respond to substantive comments — but only *substantive* ones move the needle. A
+comment that cites the specific provision, brings evidence, and proposes concrete alternative language carries
+far more weight than "I support/oppose this." This skill drafts that substantive comment.
+
+## Required Inputs
+
+Ask for these only if they aren't already provided:
+
+- **The proposal** — the rule/regulation/plan, ideally the specific sections or docket number.
+- **Your position & interest** — support, oppose, or amend; and who you are (individual, business, org — it affects standing/weight).
+- **The substance** — your reasons, and any data, expertise, or real-world impact you can cite.
+- **Desired outcome** — the specific change you want (kill it, delay it, amend a provision).
+
+## Output Format
+
+### Public comment: [rule / docket]
+
+**Re / docket line** — the proposal and docket/reference number, and your position in one line.
+
+**Who I am & my interest** — brief; establishes standing and why your input is relevant.
+
+**Summary of position** — what you support/oppose/want changed, up front.
+
+**Substantive comments** — the core. Each point:
+- **Cites the specific provision** (section/paragraph) it addresses,
+- **Makes the argument** with evidence (data, expertise, precedent, real-world consequence),
+- **Proposes a concrete fix** — suggested alternative language or a specific change, not just objection.
+
+Number them so the agency can respond point by point.
+
+**Impact** — the concrete effect (cost, burden, benefit, unintended consequence) on you/your community — this is what agencies weigh.
+
+**Conclusion & request** — restate the specific action requested; offer to provide more info.
+
+## Quality Checks
+
+- [ ] Each point cites the specific provision it addresses and is on-topic for the proposal
+- [ ] Arguments are backed by evidence (data, expertise, precedent, concrete impact) — not just opinion
+- [ ] It proposes concrete alternative language/changes, not only objections
+- [ ] The real-world impact is made specific
+- [ ] Position and the exact requested action are stated clearly up front and at the end
+
+## Anti-Patterns
+
+- [ ] Do not submit a bare "I support/oppose" — agencies weigh substance, not vote counts
+- [ ] Do not argue in generalities — tie every point to the proposal's actual text
+- [ ] Do not just object — propose the specific alternative you want instead
+- [ ] Do not omit evidence — unsupported assertions are easy to dismiss on the record
+- [ ] Do not go off-topic — comments outside the proposal's scope carry no weight
+
+## Based On
+
+Notice-and-comment rulemaking practice (substantive, provision-specific, evidence-based comments with proposed alternatives).

package/exports/aider/pm-gov/regulatory-impact-analysis/regulatory-impact-analysis.md

@@ -0,0 +1,61 @@
+# Regulatory Impact Analysis Skill
+
+Before a rule is made, good practice (and often law) requires showing it's justified: what problem it solves,
+what it costs, what it delivers, and whether a lighter option would do better. This skill produces a structured
+**RIA** — honest about uncertainty, comparing real alternatives against the do-nothing baseline.
+
+> Educational analytical aid. A formal RIA must follow the jurisdiction's guidance (e.g. US OMB Circular A-4,
+> UK Better Regulation Framework) and use validated data — treat this as a rigorous first draft, not an official filing.
+
+## Required Inputs
+
+Ask for these only if they aren't already provided:
+
+- **The proposed rule & problem** — what's proposed and the market failure / risk / harm it addresses.
+- **Options** — the realistic alternatives (including status quo / non-regulatory approaches), or ask the skill to develop them.
+- **Impacts & data** — expected costs (compliance, admin, indirect) and benefits (safety, health, efficiency), who bears them, any figures available.
+- **Timeframe & discounting** — the horizon and any required discount rate.
+
+## Output Format
+
+### Regulatory Impact Analysis: [rule]
+
+**1. Problem statement & rationale** — the specific problem (market failure, externality, risk) and why intervention is needed now. If there's no clear problem, say so.
+
+**2. Objectives** — what success looks like, in measurable terms.
+
+**3. Options considered** — including the **baseline (do nothing)** and non-regulatory alternatives. Describe each.
+
+**4. Costs & benefits by option** — for each option, the expected costs and benefits (quantified where possible; qualitative where not), over the timeframe. A comparison table:
+
+| Option | Key costs | Key benefits | Net assessment |
+|---|---|---|---|
+
+State assumptions, data sources, and **uncertainty** honestly (ranges, sensitivity).
+
+**5. Distributional effects** — who gains and who bears the costs (small business, regions, groups); any equity concerns.
+
+**6. Recommendation** — the preferred option and why it's proportionate — the best net benefit for the burden imposed.
+
+**7. Implementation & review** — enforcement, compliance burden, and how/when the rule's effect will be evaluated (sunset/review clause).
+
+## Quality Checks
+
+- [ ] The problem/market-failure is clearly established before any option is recommended
+- [ ] Options include the do-nothing baseline and at least one non-regulatory or lighter alternative
+- [ ] Costs and benefits are compared per option, quantified where data allows, with sources
+- [ ] Uncertainty is stated honestly (ranges/sensitivity), not hidden behind point estimates
+- [ ] Distributional effects and a proportionality-based recommendation are included
+- [ ] A review/evaluation mechanism is specified
+
+## Anti-Patterns
+
+- [ ] Do not assume regulation is the answer — establish the problem and test the baseline first
+- [ ] Do not present only the preferred option — compare real alternatives
+- [ ] Do not fabricate precise numbers — use ranges and label assumptions where data is thin
+- [ ] Do not ignore who bears the cost — distributional/small-business impact matters
+- [ ] Do not omit proportionality — the benefit must justify the burden imposed
+
+## Based On
+
+Regulatory impact analysis practice (OMB Circular A-4 / Better Regulation): problem-first, options vs. baseline, cost-benefit, proportionality.