Repo Kanban PM

Install and enforce a lightweight product-management workflow inside a code repo: feature-as-kanban boards, ROADMAP status tracking, branch/PR conventions, a...

Security Scan

The skill is mostly coherent for bootstrapping repo-level Kanban/ROADMAP files, but there are a few mismatches and autonomy-related risks (cron/agent actions that may execute repo commands or broadcast the repo path) that you should understand before installing.

Purpose & Capability

The skill's files and instructions align with the stated goal: it creates docs/pm, per-feature KANBAN files, bug intake, and patches AGENTS.md. There are no unrelated credentials or obviously extraneous capabilities in the bundle.

Instruction Scope

SKILL.md and the scripts stay within repo setup/PM enforcement. However, the optional cron payload text instructs the scheduled agent to run checks like `gh pr list` and `npx tsc --noEmit` (the latter can fetch/execute code via npm). While these commands are reasonable for a PM audit, they introduce the possibility of network activity and code execution when the cron-triggered agent runs. The scripts themselves do not immediately execute those commands, but they configure a scheduled autonomous job that will be asked to perform them.

Install Mechanism

This is an instruction-only skill with small helper scripts; nothing is downloaded or extracted and no install spec is present. Risk from install mechanism is low.

Credentials

The skill declares no required environment variables or credentials, which is appropriate. One minor inconsistency: the add_daily_pm_cron.sh script invokes the `openclaw` CLI, but the skill metadata does not declare any required binary; if `openclaw` isn't present the cron-add step will fail. No secrets are requested or needed by the scripts.

Persistence & Privilege

The skill does not force permanent inclusion (always:false). However, the optional add_daily_pm_cron.sh creates an autonomous scheduled agent job (via `openclaw cron add --announce`) that will run daily and perform repo reads and lightweight checks. That scheduled job can execute commands (e.g., gh, npx) and broadcasts the repo path in the cron description/announcement — consider this persistence/autonomy when enabling the cron.

What to consider before installing

This skill appears to do what it promises (create ROADMAP/KANBAN templates and patch AGENTS.md). Before using it: 1) Inspect the two scripts in the repo and test them in a safe environment (a disposable clone or container). 2) If you enable the optional cron, be aware it schedules an autonomous agent run that may call `gh` and run `npx` in the repo — these actions can fetch code or network resources and will include the repo path in the cron announcement. Only enable the cron if you trust the OpenClaw environment/agent (`persey`) and the `openclaw` CLI behavior. 3) If you cannot trust autonomous agents or need stricter control, run init_repo_pm.sh manually and do not add the cron, or remove/adjust the cron message so it doesn't instruct potentially unsafe commands. 4) Consider adding the created documentation via a PR so maintainers can review changes to AGENTS.md and docs before merging.

Repo Kanban PM System

What this skill does

Sets up a multi-agent-safe product workflow in a repo:

• docs/roadmap/ROADMAP.md as the portfolio status
• docs/features/<feature>/KANBAN.md as execution boards
• docs/pm/bugs/ as the bug intake + triage inbox (linkable into KANBAN)
• Updates AGENTS.md to enforce the workflow
• (Optional) creates a daily OpenClaw cron job to run a PM review (includes bug triage)

When to use this skill (decision rule)

Use repo-kanban-pm when you are tasked with either:

1. Creating/spinning up a new project/repo and multiple agents will work on it (or you want to avoid chaos later).

   • Goal: install ROADMAP + per-feature KANBAN boards immediately.

2. Entering an existing repo to fix, refactor, or restructure it and it does not have a clear feature/backlog tracking system.

   • Goal: introduce the kanban workflow so subsequent work is trackable and PRs stay aligned.

Do not use this skill if the repo already has an equivalent system that the team actively uses (avoid duplicating governance).

---

Quick start

1) Initialize the repo workflow

Run:

bash scripts/init_repo_pm.sh /absolute/path/to/repo

This will:

• create docs/pm/ with the workflow doc + template
• create docs/pm/bugs/ with bug README + template
• add KANBAN.md to any existing docs/features/*/ folders
• patch AGENTS.md to include the kanban rules (idempotent)

2) Add a daily PM cron (optional)

Run:

bash scripts/add_daily_pm_cron.sh /absolute/path/to/repo --agent persey --tz Europe/Minsk --time 10:00

Operating rules (agents)

1. Pick a feature from docs/roadmap/ROADMAP.md
2. Create/update docs/features/<feature>/KANBAN.md and set status to in-progress
3. Create a branch: feat/<feature-slug>-<short>
4. PR must link the feature’s KANBAN.md
5. On merge: mark KANBAN.md as done and tick the ROADMAP checkbox

Templates

• Workflow spec: docs/pm/KANBAN-SYSTEM.md
• Feature template: docs/pm/FEATURE-KANBAN-TEMPLATE.md

Notes

• Keep KANBAN boards short.
• ROADMAP contains status only; do not duplicate per-task detail there.