utility-pm-workflow-orchestrator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited utility-pm-workflow-orchestrator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- PM-Skills | https://github.com/product-on-purpose/pm-skills | Apache 2.0 -->
Cross-client dispatch wrapper for the pm-workflow-orchestrator sub-agent. Detects the runtime; dispatches to the native sub-agent on Claude Code; reads agents/pm-workflow-orchestrator.md and walks the run loop inline on non-Claude clients via the "reference + execute inline" pattern. The orchestrator runs an ordered sequence of pm-skills from a saved prioritized-action-plan (Mode A) or a user-named chain (Mode B), pausing for go/no-go by default and stopping on a failed or empty step.
Status summary (updated v2.26.0): smoke-tested on the native Claude Code path; EXPERIMENTAL elsewhere. - Claude Code (native): Mode B chains SMOKE-TESTED PASS (2026-06-10, installed plugin). The live run confirmed the engine invokes downstream skills via the Skill tool and that they execute INLINE in the engine's context (the Skill tool injects the target SKILL.md into the caller's context; no sub-agent is spawned), with real artifacts produced and the checkpoint pause honored. Mode A native runs and a single continuous interactive engine instance across multiple checkpoints have not yet been exercised; details and caveats in the compatibility matrix's v2.26.0 smoke-gate record. - All non-Claude clients (Codex CLI, Cursor, Windsurf, Copilot CLI, Gemini CLI): EXPERIMENTAL until a dedicated maintainer-gate test exercises a real multi-artifact inline WRITE run. The orchestrator writes up to three full PM artifacts and may thread state; this is strictly harder than the conductor's inline path and has never been live-validated off Claude Code.>
On ANY client, run --dry-run FIRST as the readiness check (it exercises parsing, checkpointing, stop-on-fail, and the tool-capability pre-flight without invoking consequential skills). See the Sub-Agent Compatibility Matrix for the canonical safe-usage matrix.foundation-prioritized-action-plan and want to run its runnable Section 7 prompts in order, pausing for go/no-go (Mode A).deliver-prd then deliver-user-stories. On Claude Code, the /chain command is the terse front door for this mode.workflow-* command.Run modes (orthogonal to client):
--force-auto.--thread declares a linear dependency so each step receives the prior step's confirmed artifact; see the Mode B Chain Expression Contract in references/PARSE-CONTRACT.md.
workflow-* command (workflow-foundation-sprint, workflow-customer-discovery, ...). The orchestrator does NOT supersede those and surfaces a workflow step as MANUAL rather than nesting it.foundation-prioritized-action-plan (which can then offer to hand its plan here).utility-pm-critic.Runtime detection step. Determine which AI client is invoking this skill. Run mode (checkpointed vs auto) comes from the user's flags and is independent of the client.
Invoke @agent-pm-skills:pm-workflow-orchestrator with the user's input plus any flags from $ARGUMENTS (--auto, --force-auto, --dry-run). The native sub-agent parses the input, builds the step list, and delegates each step via the Skill tool to the real downstream skill, running its own per-step loop with confirmation pauses. Relay the engine's per-step output blocks and the terminal output to the user.
This path is EXPERIMENTAL at v2.24.0 (see Status summary). Instruct the user to run --dry-run first.
Codex CLI, Cursor, Windsurf, Copilot CLI, Gemini CLI, or any client without native pm-skills plugin sub-agent support:
_pm-skills/plan-orchestrator/<run>/ and (b) run any Bash a downstream skill needs.agents/pm-workflow-orchestrator.md.references/PARSE-CONTRACT.md (the engine reads the same file; this is what keeps the inline branch and the engine from drifting).SKILL.md and execute its method inline in this window; classify the return PRODUCED / EMPTY / FAILED with the rubric in references/PARSE-CONTRACT.md; write NN-<skill-name>.md to the run directory when disk-write is on.--force-auto.The "reference + execute inline" pattern is what enables cross-client compatibility. It is EXPERIMENTAL here until the maintainer-gate WRITE harness validates a real multi-artifact run on each client.
--dry-run (readiness probe; run this FIRST on any client)--dry-run walks the full step list and exercises parsing, checkpointing, stop-on-fail, and the tool-capability pre-flight, but does NOT invoke any consequential downstream skill. Each step emits "NOT EXECUTED - dry run" plus what WOULD happen (which skill, which mode, whether disk-write would engage). Use it to confirm the plan parses, the chain resolves, and the client has the tool access the live run needs, before spending tokens on real delegation.
Because non-Claude clients run the loop and every step inline in ONE context window:
Skill (Claude Code) or inline read-and-execute (non-Claude), never by spawning a sub-agent. A Mode A step that resolves to a dispatch skill which would fan out to a sub-agent (only utility-pm-critic) is handled by inlining the leaf agent, never by chaining (engine section 7.2).agents/pm-workflow-orchestrator.mdreferences/PARSE-CONTRACT.mdreferences/TEMPLATE.mdreferences/EXAMPLE.mdskills/foundation-prioritized-action-plan/SKILL.mddocs/reference/sub-agent-compatibility.mddocs/reference/runtime-components.mdlibrary/sub-agent-samples/pm-workflow-orchestrator/~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.