What it is
PM AI Shipping Kit is a product management plugin for making AI-built code reviewable and shippable. It addresses a fundamental problem: AI agents write code fast but leave no record of intent -- what the system should do, who may do what, where secrets live. Without that record, no human and no auditing agent can determine whether the code is safe to ship. The kit restores reviewability by documenting the system and then auditing the gap between what the docs say and what the code does. The kit includes three skills and five commands. The /ship-check command runs the full pipeline: document the app, wire agent context, run correctness, security, and performance reviews, add an independent unsteered pass by a second model, map test coverage, and compile results. The /document-app command reverse-engineers a codebase into system documents (architecture, user/permission flows, variables/secrets, test coverage map). The static audit commands (/security-audit-static and /performance-audit-static) can target specific git ranges for change-only audits. A distinctive feature is the intended-vs-implemented skill, which finds the gap between what documentation says a system does and what the code actually does, with cited evidence on both sides. The /document-app check and /derive-tests check variants write no files and simply report disagreements, making them suitable for release checklists.
Who it's for
- product managers accountable for AI-built code
- startup founders shipping vibe-coded apps
- engineering leads reviewing AI-generated code
Requirements
Requirements
- Claude Code with pm-skills plugin installed
Setup
Step 1
bashclaude plugin marketplace add phuryn/pm-skillsStep 2
bashclaude plugin install pm-ai-shipping@pm-skills
يوثق التطبيقات المبنية بالذكاء الاصطناعي ويراجعها للصحة والأمان والأداء وينتج حزم شحن جاهزة للمراجعة.
Examples
Full shipping check
Prompt/ship-checkExpected output: Runs the complete pipeline: document the app, wire agent context, run correctness/security/performance reviews, add an independent second-model pass, map test coverage, and compile results.
Document a codebase
Prompt/document-appExpected output: Reverse-engineers a codebase into system documents: architecture, flows, permissions, variables, plus conditional docs for emails, cron, SEO, and automation.
Pros & cons
Pros
- Pro:Addresses the key gap in AI-generated code: no record of intent
- Pro:Static security and performance audits can target specific git ranges or uncommitted changes
- Pro:Adversarial second-model pass for independent verification
- Pro:Test coverage mapping with gate policy recommendations
Cons
- Con:Assumes the codebase has enough structure for documentation extraction; very early prototypes may be too chaotic