productplan-pm — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited productplan-pm (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Complete toolkit for day-to-day product management in ProductPlan.
ProductPlan tools require IDs. Always list first, then drill down:
list_roadmaps → roadmap_id → get_roadmap_bars → bar_id → get_bar
list_objectives → objective_id → get_objective → key_result data
list_ideas → idea_id → get_idea → customer/tag datalist_roadmaps to get roadmap IDsget_roadmap_complete with roadmap_id for all data in one calllist_roadmapsget_roadmap_lanes (pick the category)manage_bar with:get_roadmap_barsmanage_bar with action="update", bar_id, new start_date and end_dateget_roadmap_barsget_roadmap_lanesmanage_bar with action="update", bar_id, lane_idget_roadmap_barsmanage_bar_connection with action="create", bar_id (source), target_bar_idCall get_bar_comments with bar_id. The ProductPlan API has no endpoint for writing comments.
Call manage_bar_link with action="create", bar_id, url, name. The link is a plain web link: an Azure DevOps or Jira integration link can only be made in the ProductPlan UI.
Bar color comes from the roadmap's legend, set by name.
get_roadmap_legends with roadmap_id to get the legend namesmanage_bar with action="update", bar_id, legend="<legend name>" (matched case-insensitively)Never pass legend_id: ProductPlan reads it as "clear the color", so the server refuses it.
Use the bulk tools for more than a couple of bars (up to 100 per call):
get_roadmap_bars filters (name_contains, lane, legend, tag, starts_after, ...)bulk_update_bars with items=[{bar_id}, ...] and a shared set, e.g. set={legend:"Committed"}. Run it with dry_run=true first to see the exact payloadsbulk_create_bars (roadmap_id + items) and bulk_delete_bars (bar_ids + confirm=true) work the same way.
manage_lane with action="create", roadmap_id, name (optional description, position). Lanes have no settable colormanage_lane with action="update", lane_id, positionmanage_lane with action="delete", lane_idCall manage_milestone with action="create", roadmap_id, title, date
list_objectives to see all objectives with progress percentagesget_objective with objective_idCall manage_objective with action="create", name, description, time_frame (e.g., "Q1 2025")
Call manage_key_result with action="create", objective_id, name, start_value, target_value
get_objective or list_key_resultsmanage_key_result with action="update", objective_id, key_result_id, current_valueFeatures can be linked to key results in the ProductPlan UI to show OKR alignment.
list_ideas to see all ideas with vote counts and statusget_idea for full detailslist_all_customers to see the customers on the account (the API has no per-idea customer list)Call manage_idea with action="create", title, description
Call list_all_tags or list_all_customers to see what exists. Adding a tag or a customer to an idea is not possible through the tools: the ProductPlan API has no endpoint for it, so do it in the ProductPlan UI.
manage_opportunity with action="create", problem_statement, descriptionlist_idea_forms - see available submission formsget_idea_form - get form details and fieldsCall list_launches to see all launches with dates and status
Call get_launch with launch_id for full checklist and assignments
get_roadmap_barsmanage_bar with action="create", container_bar_id set to the parent bar_id, and starts_on/ends_on (ProductPlan refuses to nest an undated bar). The parent must have is_container=true, and the child's parked state must match the parent'sCall get_bar_children with bar_id to see nested features
| Error | Cause | Solution |
|---|---|---|
| "Invalid API token" | Token expired | Verify at ProductPlan Settings → API |
| "Not found" | ID stale | Re-run list tool for fresh IDs |
| "Rate limited" | Quota exceeded | Wait 60 seconds, retry |
| "Permission denied" | Access restricted | Check role permissions |
get_roadmap_complete: 3-5 seconds for large roadmapshealth_check with deep=true to diagnose issuescheck_status to verify authentication50 tools: 35 read, 15 write.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.