Foundation build risk review
Skill product-on-purpose/pm-skills/skills/foundation-build-risk-review
Runs a fast pre-build risk review on a product idea, feature request, or scope change, naming the single assumption most likely to make it fail and returning a clear verdict (build small, validate first, pivot first, or don't build yet) with a no-code validation step. Use before committing build effort, when triaging whether to honor a feature request, or when deciding whether to expand scope, ahead of writing a PRD. For a launched product's pivot-or-persevere decision, use iterate-pivot-decision instead.From its SKILL.md
npx -y skills add product-on-purpose/pm-skills --skill foundation-build-risk-reviewAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
What its file declares
Copied from the file, not written here
The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
6.6 KB, ~1.4k tokens by cl100k_base, as published. Nobody here has run it
Build Risk Review
Don't build it yet. First name the one assumption most likely to make it fail.
foundation-build-risk-review is a fast, pre-commitment gate for product decisions. Given an idea, a feature request, or a scope change, it returns a Build Risk Review: the single biggest risk, the evidence behind it, a verdict, and a concrete no-code validation step, then routes you to the skill that does the next piece of work. It is a foundation hub: its job is to triage and dispatch, not to duplicate the deeper skills.
Hard gate
Do not write code, scaffold a project, recommend a stack, or design implementation. First answer three things: should this be built, what is most likely to make it fail, and what must be validated before committing.
If the user says the work is for learning, a portfolio, or internal practice, do not judge it by market standards; still flag scope and clarity risks.
When to Use
- A product idea, MVP, or new bet is about to turn into build work.
- A feature request or scope change has arrived and you need to separate real demand from a polite ask, founder anxiety, or competitor-copying.
- Someone wants a fast "should we build this?" verdict before a PRD, roadmap row, or ticket exists.
When NOT to Use
| If the ask is | Use instead |
|---|---|
| A launched product's pivot-or-persevere call, weighing usage or market data | iterate-pivot-decision |
| You have chosen the assumption and need to design the test | define-hypothesis |
| Framing a confirmed problem for the team or leadership | define-problem-statement |
| The full nine-block business model, not a single-risk read | foundation-lean-canvas |
| Ranking many features or initiatives against each other | define-prioritization-framework |
The boundary that matters most: this skill is forward-looking and pre-commitment (low or no data); iterate-pivot-decision is retrospective and post-launch (it weighs market feedback on something already shipped).
Modes (route first; state the mode at the top)
- Pre-build - a new idea, product, or MVP not yet built. The usual primary risks: demand and distribution.
- Feature-change - a feature request, scope expansion, requirement change, or competitor-copy on an in-progress product. The primary tool here is the demand hierarchy.
If the product is already launched and the question is whether to change direction, hand off to iterate-pivot-decision. If the request is too broad to review responsibly, ask exactly one clarifying question (complete the sentence: "this is for [who] in [situation] to solve [problem]"), then proceed. Never run a long questionnaire; at most two questions before a constrained review.
The review (the contract)
Produce a Build Risk Review with these parts:
- Biggest risk (
R1). Exactly one primary risk, tagged fromreferences/risk-taxonomy.md. Not a long inventory. Add at most three to five supporting risks (R2,R3, ...). - Demand level (feature-change mode). Place the request on the hierarchy: L0 founder anxiety or "competitors have it"; L1 one user asked; L2 repeated asks, no behavior proof; L3 workflow blocker; L4 revenue or retention blocker. Build-now is usually justified only at L3 or L4.
- Evidence ledger. List the signal that exists and grade each entry on the strength ladder in
references/risk-taxonomy.md. Likes, compliments, waitlists, and market-size numbers are NOT demand. Real files, booked calls, payment, repeated manual use, or switching from an existing alternative are. - Verdict (exactly one): Build small / Validate first / Pivot first / Don't build yet. Do not use "Kill".
- Validation step. A specific, no-code or low-code next action (talk to the ten users who do X; manually deliver the result for three of them; collect a preorder, paid call, or deposit), never generic advice like "build an MVP" or "do user research".
- Routing. Send the user to the skill that does the next piece of work (see below).
Be skeptical but useful. Always separate "can be built" from "should be built". Do not flatter the idea or default to encouragement; do not say "this has potential" unless the path is specific.
Verdict routing
| Verdict | Routes to |
|---|---|
| Build small | define-problem-statement, then deliver-prd / deliver-user-stories |
| Validate first | define-hypothesis, then measure-experiment-design |
| Pivot first | foundation-lean-canvas (re-frame the model) |
| Don't build yet | stop; or discover-competitive-analysis / discover-market-sizing for an evidence check |
| Several competing requests | define-prioritization-framework |
Full map, including the per-risk routing: references/routing-map.md.
Output Format
A single Build Risk Review artifact, built from references/TEMPLATE.md. Section order: decision header (verdict + one-line rationale), the biggest risk (R1), supporting risks, demand level (feature mode), evidence ledger, validation plan, routing, Sources. A fully worked case is in references/EXAMPLE.md.
Quality Checklist
- Exactly one primary risk is named (
R1) and tagged from the taxonomy. - Feature-change mode places the request on L0 through L4.
- Every evidence entry is graded; no like, waitlist, or market-size number is counted as demand.
- Exactly one of the four verdicts is returned.
- The next step is specific and low or no-code, not generic advice.
- A routing target is named.
- No code, stack recommendation, or implementation design is produced (the hard gate held).
Attribution
Adapted from bin1874/before-you-build-skill (Apache-2.0), repositioned PM-neutral. The source skill's external case-memory API call and translate-to-user-language behavior are removed.
What ships with it: 7 files
20.6 KB alongside SKILL.md
evals/
references/
- EXAMPLE.md4.9 KB
- risk-taxonomy.md2.7 KB
- routing-map.md1.7 KB
- TEMPLATE.md2.0 KB
- HISTORY.md2.3 KB
Gives 0 of the 12 instructions most review quality skills give in ~1.4k tokens
Counted across 1,273 of the 2,403 authors here whose files we hold, read 2026-09-06
- Ask one question at a timein 63 of 1273, across 62 files
- Provide a recommended answer for each questionin 47 of 1273, across 45 files
- Rank findings by severityin 44 of 1273
- Use parameterized queries for database accessin 38 of 1273, across 20 files
- Validate all user input with schemasin 33 of 1273, across 15 files
- Store secrets in environment variablesin 32 of 1273, across 14 files
- Explore the codebase to answer questionsin 31 of 1273, across 29 files
- Store tokens in httpOnly cookiesin 30 of 1273, across 12 files
- Implement rate limiting on API endpointsin 30 of 1273, across 12 files
- Sanitize user-provided HTMLin 29 of 1273, across 11 files
- Return generic error messages to usersin 28 of 1273, across 10 files
- Cite file and line for every findingin 28 of 1273, across 25 files
Said here and by no other author read
- name the one assumption most likely to cause failure
- state the mode at the top of the response
- ask exactly one clarifying question if the request is broad
- produce a build risk review artifact
- tag the primary risk from the risk taxonomy
- list at most five supporting risks
Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.