Live survey304 models · 14 providers · 22,792 auditsAudited grill-with-docs · SAFE →What changedHow we verifyllms.txt

Agent skill · Audited from source

Requirement Penetration

skill · echoVic/boss-skillMIT licenceAudited 15 Oct 2026 · source 0317d4cb4f54

★ 542pushed 4 days agoversion 1.0.0
✓SAFEGrade B · 89/100 · 15 Oct 2026 · 0317d4c
542repo stars · whole echoVic/boss-skill

Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 0317d4cb4f54 and found no filesystem, network or shell access and no hard-coded secrets. What it does: 深度挖掘用户需求的方法论,通过5W2H追问和需求分层模型,识别显性、隐性、潜在和惊喜需求

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Requirement Penetration (echoVic/boss-skill)”. Retrieved 15 Oct 2026. https://modelsatlas.com/skills/echovic/requirement-penetration

Trust audit

Audit 0.4.1 · source read 15 Oct 2026

Trust score89/100✓SAFE B
0 critical0 high0 medium0 low0 info

SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 16,667 of 17,602 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkNone observedNo outbound calls in the source
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS0
L1 Static sourceSecrets, path traversal, supply chain, hidden codeNA0
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS0
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (0)

No findings at any severity. We re-audit when the source changes.

Audit 0.4.1 · source sha 0317d4cb4f54 · 15 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • PublisherechoVic GitHub userOwner of the repository this skill is read from
  • Source folderechoVic/boss-skill/skill/skills/pm/requirement-penetrationThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdict0317d4cb4f54A new audit runs when the source changes
  • Repository statusNot archivedLast push 4 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: 深度挖掘用户需求的方法论,通过5W2H追问和需求分层模型,识别显性、隐性、潜在和惊喜需求

---
name: pm/requirement-penetration
description: 深度挖掘用户需求的方法论,通过5W2H追问和需求分层模型,识别显性、隐性、潜在和惊喜需求
version: 1.0.0
agent: pm
type: methodology
user-invocable: false
agent-invocable: true
dependencies: []
triggers:
  - 用户提出新功能需求时
  - 需要理解用户真实意图时
  - 开始PRD编写前的需求分析阶段
metadata:
  internal: true
---

# 需求穿透方法论

## 适用场景

当用户提出需求时,不要直接接受表面描述。使用本方法论深度挖掘用户真正想要什么,识别用户没说出口的需求,甚至发现用户自己都没意识到的需求。

## 核心方法

### 需求分层模型

用户需求分为四个层次,从下到上价值递增:

```
        ┌─────────────────┐
        │   惊喜需求      │ ← 超出预期,带来 "Wow"
        │   (Delighters)  │
        ├─────────────────┤
        │   潜在需求      │ ← 用户尚未意识到
        │   (Latent)      │
        ├─────────────────┤
        │   隐性需求      │ ← 用户想到但未说
        │   (Implicit)    │
        ├─────────────────┤
        │   显性需求      │ ← 用户明确表达
        │   (Explicit)    │
        └─────────────────┘
```

**四层需求定义**:

1. **显性需求**:用户明确表达的需求
   - 直接从用户原话中提取
   - 这是需求分析的起点,不是终点

2. **隐性需求**:用户想到但未表达的需求
   - 用户认为"理所当然"而没说的
   - 用户不好意思说的
   - 用户以为你会知道的

3. **潜在需求**:用户尚未意识到但会需要的需求
   - 基于场景推演发现的需求
   - 基于竞品分析发现的需求
   - 基于行业趋势预判的需求

4. **惊喜需求**:超出用户预期、能带来 "Wow" 体验的需求
   - 创新性的功能或体验
   - 让用户感到"这个太棒了!"
   - 这是产品差异化的关键

### 5W2H 深度追问

对每个需求,系统性地追问以下7个维度:

| 维度 | 问题 | 目的 |
|------|------|------|
| **What** | 用户说的是什么?背后真正想要的是什么? | 识别真实需求 |
| **Why** | 为什么需要这个?解决什么问题? | 理解动机 |
| **Who** | 谁会用?在什么场景下用? | 明确用户 |
| **When** | 什么时候用?频率如何? | 理解场景 |
| **Where** | 在哪里用?环境如何? | 理解上下文 |
| **How** | 现在怎么解决的?有什么痛点? | 发现机会 |
| **How much** | 愿意付出多少?(时间/金钱/学习成本) | 评估价值 |

**追问技巧**:
- 至少追问 "为什么" 5次,直到触及根本动机
- 不要满足于第一个答案
- 关注用户的情绪和语气,往往隐藏着真实需求

### 需求优先级矩阵

基于价值和成本,将需求分为4个优先级:

```
        高价值
           │
    ┌──────┼──────┐
    │ 必做 │ 优先 │
    │ P0   │ P1   │
低成本 ────┼──── 高成本
    │ 可做 │ 谨慎 │
    │ P2   │ P3   │
    └──────┼──────┘
           │
        低价值
```

- **P0(必做)**:高价值 + 低成本 = 必须做
- **P1(优先)**:高价值 + 高成本 = 优先做
- **P2(可做)**:低价值 + 低成本 = 可以做
- **P3(谨慎)**:低价值 + 高成本 = 暂不做

## 输出要求

完成需求穿透后,应输出以下内容(通常作为PRD的第2章):

### 2. 需求穿透分析

#### 2.1 用户原始需求
> [用户的原始表述,保持原话]

#### 2.2 需求穿透

**显性需求(用户明确表达的)**

| 需求 | 用户原话 | 解读 |
|------|----------|------|
| [需求 1] | "[原话]" | [你的解读] |
| [需求 2] | "[原话]" | [你的解读] |

**隐性需求(用户想到但未表达的)**

| 需求 | 推断依据 | 为什么重要 |
|------|----------|------------|
| [需求 1] | [依据] | [重要性] |
| [需求 2] | [依据] | [重要性] |

**潜在需求(用户尚未意识到的)**

| 需求 | 洞察来源 | 预期价值 |
|------|----------|----------|
| [需求 1] | [来源] | [价值] |
| [需求 2] | [来源] | [价值] |

**惊喜需求(超出预期的创新点)**

| 需求 | 创新点 | 预期反应 |
|------|--------|----------|
| [需求 1] | [创新点] | "Wow, 这个太棒了!" |
| [需求 2] | [创新点] | [预期反应] |

#### 2.3 需求优先级矩阵

| 优先级 | 需求 | 价值 | 成本 | 决策 |
|--------|------|------|------|------|
| P0 | [需求] | 高 | 低 | 必须做 |
| P1 | [需求] | 高 | 高 | 优先做 |
| P2 | [需求] | 低 | 低 | 可以做 |
| P3 | [需求] | 低 | 高 | 暂不做 |

## 关键原则

1. **不要急于给答案**:先理解问题,再提供方案
2. **挑战假设**:用户说的不一定是对的,要验证
3. **关注痛点**:真正的需求来自真实的痛苦
4. **追求惊喜**:好产品不只是满足需求,更要超越预期

Excerpt, first 2,821 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 0317d4c

Download folder ↗
git clone https://github.com/echoVic/boss-skill
git -C boss-skill checkout 0317d4cb4f54

The author documents no install command, so this uses the repository directly. Our verdict covers commit 0317d4cb4f54 only.

Works in

The author has not said which agents this skill supports, and we have not tested it in any.

Audit history

Every audit, every source change

  1. ✓SAFE B 89 / 100

    first audit · source 0317d4cb4f54

Similar skills

Questions about Requirement Penetration

What does the Requirement Penetration skill do?
Boss Skill - BMAD 全自动研发流水线(多 Agent 编排)
Is Requirement Penetration safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can Requirement Penetration access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
How current is this page?
The grade is for one exact copy of the source (0317d4cb4f54), read on 2026-10-15. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.