Live survey304 models · 14 providers · 22,792 auditsAudited grill-with-docs · SAFE →What changedHow we verifyllms.txt

Agent skill · Audited from source

Strategic Review

skill · echoVic/boss-skillMIT licenceAudited 15 Oct 2026 · source 0317d4cb4f54

★ 542pushed 4 days agoversion 1.0.0
✓SAFEGrade B · 89/100 · 15 Oct 2026 · 0317d4c
542repo stars · whole echoVic/boss-skill

Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 0317d4cb4f54 and found no filesystem, network or shell access and no hard-coded secrets. What it does: 从CEO/战略视角进行商业价值评审,评估市场契合度、ROI、竞争优势、风险和战略对齐

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Strategic Review (echoVic/boss-skill)”. Retrieved 15 Oct 2026. https://modelsatlas.com/skills/echovic/strategic-review

Trust audit

Audit 0.4.1 · source read 15 Oct 2026

Trust score89/100✓SAFE B
0 critical0 high0 medium0 low0 info

SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 16,667 of 17,602 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkNone observedNo outbound calls in the source
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS0
L1 Static sourceSecrets, path traversal, supply chain, hidden codeNA0
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS0
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (0)

No findings at any severity. We re-audit when the source changes.

Audit 0.4.1 · source sha 0317d4cb4f54 · 15 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • PublisherechoVic GitHub userOwner of the repository this skill is read from
  • Source folderechoVic/boss-skill/skill/skills/pm/strategic-reviewThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdict0317d4cb4f54A new audit runs when the source changes
  • Repository statusNot archivedLast push 4 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: 从CEO/战略视角进行商业价值评审,评估市场契合度、ROI、竞争优势、风险和战略对齐

---
name: pm/strategic-review
description: 从CEO/战略视角进行商业价值评审,评估市场契合度、ROI、竞争优势、风险和战略对齐
version: 1.0.0
agent: pm
type: methodology
user-invocable: true
agent-invocable: true
dependencies:
  - pm/competitive-analysis
triggers:
  - 用户请求战略评审或商业价值评估时
  - 使用 /boss-review 命令时
  - 需要从商业角度判断项目是否值得投入时
  - 产品方向存在争议需要高层决策时
metadata:
  internal: true
---

# 战略评审(Boss Review)

## 适用场景

当需要从 CEO/战略高度评估一个功能或项目的商业价值时使用。不同于技术评审关注实现质量,战略评审关注**做不做**和**为什么做**。

典型场景:
- 新功能立项前的价值论证
- 资源有限时的优先级决策
- 产品方向调整的论证
- 投资人/利益相关者沟通准备

## 核心方法

### 第一维度:市场契合度(Market Fit)

评估产品/功能与市场需求的匹配程度:

| 评估项 | 问题 | 评分标准 |
|--------|------|----------|
| 目标市场 | TAM/SAM/SOM 分别多大? | 清晰可量化 = 高分 |
| 痛点强度 | 用户痛点是止痛药还是维生素? | 必须有 > 最好有 > 可以有 |
| 时机 | 为什么是现在? | 有明确时间窗口 = 高分 |
| 验证程度 | 有多少用户验证? | 付费验证 > 使用验证 > 口头验证 > 假设 |

### 第二维度:投资回报率(ROI)

量化投入产出比:

| 评估项 | 问题 | 评分标准 |
|--------|------|----------|
| 开发成本 | 需要多少人天? | 精确估算 = 高分 |
| 运营成本 | 上线后持续投入? | 低维护 = 高分 |
| 收益模型 | 直接/间接收益如何? | 有历史数据支撑 = 高分 |
| 回收周期 | 多久能回本? | <3个月 = 优 / <6个月 = 良 / >12个月 = 需论证 |
| 机会成本 | 不做什么来做这个? | 机会成本可控 = 高分 |

### 第三维度:竞争优势(Competitive Advantage)

评估护城河和差异化:

| 评估项 | 问题 | 评分标准 |
|--------|------|----------|
| 技术壁垒 | 竞对复制需要多久? | >6个月 = 强壁垒 |
| 网络效应 | 用户越多越好用吗? | 有强网络效应 = 高分 |
| 数据优势 | 有独占数据资产吗? | 数据不可替代 = 高分 |
| 品牌认知 | 能否建立心智定位? | 有清晰定位 = 高分 |
| 切换成本 | 用户迁移难度? | 高切换成本 = 高分 |

### 第四维度:风险矩阵(Risk Assessment)

识别和评估风险:

| 风险类型 | 评估要素 | 缓解方案 |
|----------|----------|----------|
| 市场风险 | 需求是否真实、市场是否足够大 | MVP 验证、用户访谈 |
| 技术风险 | 是否有未验证的技术假设 | 技术 spike、原型验证 |
| 执行风险 | 团队是否有能力按时交付 | 分阶段交付、招聘计划 |
| 合规风险 | 是否涉及法规/政策限制 | 法务咨询、合规审查 |
| 依赖风险 | 是否依赖不可控的外部因素 | 备选方案、合同约束 |

### 第五维度:战略对齐(Strategic Alignment)

评估与公司战略的一致性:

| 评估项 | 问题 | 评分标准 |
|--------|------|----------|
| 愿景匹配 | 与公司3-5年愿景一致吗? | 强关联 = 高分 |
| 能力杠杆 | 能否复用现有优势? | 高杠杆 = 高分 |
| 协同效应 | 与其他产品线有协同吗? | 1+1>2 = 高分 |
| 资源匹配 | 现有资源能否支撑? | 资源充足 = 高分 |

## 评审决策框架

### 综合评分规则

每个维度 1-5 分,加权计算综合分:
- 市场契合度:权重 30%
- ROI:权重 25%
- 竞争优势:权重 20%
- 风险评估:权重 15%(此项为风险可控程度)
- 战略对齐:权重 10%

### 决策映射

| 综合分 | 决策 | 说明 |
|--------|------|------|
| ≥ 4.0 | ✅ 推进 | 全力推进,优先分配资源 |
| 3.0 - 3.9 | ⚠️ 需调整 | 方向正确但需优化具体方案 |
| < 3.0 | ❌ 暂缓 | 暂不投入,需重新论证或等待时机 |

## 输出要求

使用 `strategic-review.md.template` 模板输出到 `.boss/<feature>/strategic-review.md`,包含:

1. **执行摘要**:商业价值评级(1-5)、推荐决策、关键洞察(1-2句)
2. **五维分析详情**:每个维度的评分和关键判断依据
3. **风险矩阵表**:风险项 × 影响程度 × 发生概率 × 缓解方案
4. **战略建议**:具体的行动建议(推进/调整/暂缓的理由和下一步)
5. **关键假设**:列出评审中的关键假设,标注验证状态

Excerpt, first 2,389 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 0317d4c

Download folder ↗
git clone https://github.com/echoVic/boss-skill
git -C boss-skill checkout 0317d4cb4f54

The author documents no install command, so this uses the repository directly. Our verdict covers commit 0317d4cb4f54 only.

Works in

The author has not said which agents this skill supports, and we have not tested it in any.

Audit history

Every audit, every source change

  1. ✓SAFE B 89 / 100

    first audit · source 0317d4cb4f54

Questions about Strategic Review

What does the Strategic Review skill do?
Boss Skill - BMAD 全自动研发流水线(多 Agent 编排)
Is Strategic Review safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can Strategic Review access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
How current is this page?
The grade is for one exact copy of the source (0317d4cb4f54), read on 2026-10-15. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.