intended-vs-implemented

An agent skill by phuryn, from phuryn/pm-skills. Tags: api, debugging, developer-tools, documents.

What it does

The method for finding the gap between what a system is supposed to do and what the code actually does — the class of bug generic scanners miss because they have no model of intent. Defines what counts as documented intent, what counts as implementation evidence, which mismatches matter, and how to avoid hand-wavy findings. Use when auditing AI-built code, reviewing access control against documented permissions, or checking whether a codebase matches its own documentation.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add phuryn/pm-skills --skill intended-vs-implemented

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/phuryn/pm-skills
cp -r pm-skills/pm-ai-shipping/skills/intended-vs-implemented ~/.claude/skills/intended-vs-implemented

Safety box score

Grade A, minimal risk: 0 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a read-only auditing guide: it contains only markdown instructions for comparing documented intent to code, with no executable scripts, network calls, or file-modifying steps. The main practical limitation is that it depends on other documentation existing and being current, but that is an audit-quality concern rather than a machine-safety risk.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	0 (none)	`SKILL.md` contains no shell commands, scripts, or code execution steps.
Network access	0 (none)	There are no download or upload instructions, only references to local docs and code.
Filesystem reach	0 (none)	The skill only instructs reading repository documentation and implementation evidence; it does not write or delete files.
Secrets & credentials	0 (none)	It does not ask for tokens, passwords, `.env` files, or other secrets.
Privilege & persistence	0 (none)	No sudo, service registration, global installs, or shell/OS configuration changes are mentioned.
Instruction hijack surface	0 (none)	The text does not instruct the agent to ignore safeguards or follow untrusted remote instructions; it explicitly says to treat docs as claims to verify.
Irreversible actions	0 (none)	It does not perform actions on the user's behalf such as posting, deploying, paying, or deleting anything.
Transparency	0 (none)	The shipped content is a single readable markdown file; there are no binaries, blobs, or runtime-decoded code.

Before installing

No special checks needed: this skill ships only `SKILL.md` and no executable artifacts.

Rated 2026-10-19 by an automated review of 1 file from the skill's repository.

Source

Repository: phuryn/pm-skills (all skills from this repository)
Path: pm-ai-shipping/skills/intended-vs-implemented/SKILL.md
Branch: main
Updated: 2026-09-19

deprecation-and-migration — Manages deprecation and migration. Use when removing old systems, APIs, or features. Use when migrating users from one implementation to another.
code-review — Review code for actionable defects. Correctness is the core; performance and security are optional sub-cases of the same engine.
shipping-artifacts — The durable documentation set that makes an AI-built (vibe-coded) app reviewable before shipping.
test-scenarios — Create comprehensive test scenarios from user stories with test objectives, starting conditions, user roles, step-by-step actions, and expected outcomes.
archify-review — Review Archify issues, PRs, or code through value, cost, and impact to support evidence-based maintenance decisions.
claude-api — Reference for the Claude API / Anthropic SDK — model ids, pricing, params, streaming, tool use, MCP, agents, caching, token counting, model migration.