Installation guide and reference

Skills for building digital and AI products

Two portable Agent Skills packages for business analysts, product owners and teams building products with Claude Code or Codex.

What you are installing

A skill is a folder centred on a SKILL.md file. It describes when to use the skill, the workflow, checks and expected output. Supporting references are loaded only when needed. It is not a separate application, model or data store.

What a skill does

It gives the agent a professional framework, requires evidence and explicit assumptions, checks risk, and produces a useful working artefact.

What a skill does not do

It does not replace product ownership, legal advice or security expertise; guarantee unreviewed code; or grant the agent additional permissions.

Two packages, one product lifecycle

Package 1 · 8 skills

BA/PO Core Delivery

The core delivery toolkit, from framing the product through to a controlled release. Designed for day-to-day MVP development and the evolution of a live product.

Download Core Delivery
ba-po-core-delivery.zip

Package 2 · 7 skills

BA/PO Production Governance

The production-readiness layer: security, data protection, observability, recovery, public demos, UX and incident coordination.

Download Production Governance
ba-po-production-governance.zip

Recommendation Install both packages for end-to-end coverage. If you are just starting, begin with Core Delivery and add Production Governance before introducing real users, personal data or public access.

Install on your computer

Extract the ZIP files, then copy the contents of each skills folder into the personal skills directory used by your tool. The commands below install both packages.

No terminal required

Simple installation with Finder or File Explorer

Download and extract one or both archives. Open the skills folder inside.
Open your home folder. In macOS Finder choose Go → Home and press ⌘ Shift . to show hidden folders. In Windows File Explorer enable View → Hidden items.
Create .agents/skills for Codex or .claude/skills for Claude Code.
Copy the individual skill folders, such as framing-digital-products, into that directory. Do not copy the outer package folder.
Restart the tool and use the relevant tab below to verify the installation.

Quick installation from the command line

This option is for users comfortable with Terminal or PowerShell. Replace /path/to or C:\path\to with the actual location of the extracted folders.

Extract both archives

After extraction, you should have the folders ba-po-core-delivery and ba-po-production-governance.

Copy the skills into Codex

macOS / Linux — replace the paths with your extracted folders:

mkdir -p "$HOME/.agents/skills"
cp -R "/path/to/ba-po-core-delivery/skills/." "$HOME/.agents/skills/"
cp -R "/path/to/ba-po-production-governance/skills/." "$HOME/.agents/skills/"

Windows PowerShell:

New-Item -ItemType Directory -Force "$HOME\.agents\skills"
Copy-Item -Recurse -Force "C:\path\to\ba-po-core-delivery\skills\*" "$HOME\.agents\skills\"
Copy-Item -Recurse -Force "C:\path\to\ba-po-production-governance\skills\*" "$HOME\.agents\skills\"

Verify the installation

find "$HOME/.agents/skills" -maxdepth 2 -name SKILL.md

Restart Codex if the skills do not appear automatically. In an interactive session, open /skills or invoke a skill as $framing-digital-products.

Extract both archives

Claude Code needs the folders inside skills; the Codex plugin manifest does not need to be copied.

Copy the skills into Claude Code

macOS / Linux — replace the paths with your extracted folders:

mkdir -p "$HOME/.claude/skills"
cp -R "/path/to/ba-po-core-delivery/skills/." "$HOME/.claude/skills/"
cp -R "/path/to/ba-po-production-governance/skills/." "$HOME/.claude/skills/"

Windows PowerShell:

New-Item -ItemType Directory -Force "$HOME\.claude\skills"
Copy-Item -Recurse -Force "C:\path\to\ba-po-core-delivery\skills\*" "$HOME\.claude\skills\"
Copy-Item -Recurse -Force "C:\path\to\ba-po-production-governance\skills\*" "$HOME\.claude\skills\"

Verify the installation

find "$HOME/.claude/skills" -maxdepth 2 -name SKILL.md

Start Claude Code and ask “What skills are available?”, or invoke one directly: /framing-digital-products. If ~/.claude/skills was first created during the current session, restart Claude Code.

Install for one project only

Tool	Directory at project root	When to choose it
Codex	`.agents/skills/`	When the set should be version-controlled and limited to this team or repository.
Claude Code	`.claude/skills/`	When the skills are product-specific and should travel with the repository.

Claude.ai, Cowork and cloud sessions They do not read the personal ~/.claude/skills folder on your computer. The two package archives above are intended for Codex and Claude Code. For Claude.ai, download the individual ZIP for the skill you need from the catalogue below and upload it through Customize → Skills. A cloud session may also use project skills committed to the repository where the selected mode supports them.

How to use the skills

Automatic selection

Describe the task naturally. The agent matches it to installed skill descriptions and loads the relevant one. For example: “Turn these rating rules into a decision table and boundary tests.”

Direct invocation

Name the skill directly: $skill-name in Codex or /skill-name in Claude Code. Follow it with the task and links to relevant files.

# Codex
$designing-ai-features Review the proposed CV analysis flow. Define the schema,
validation, human review and no-AI fallback.

# Claude Code
/reviewing-ai-generated-code Review the current diff against the acceptance
criteria. Do not edit files; report evidence and risks first.

Give the agent the goal, context, constraints and completion criteria.
Point to specific files and evidence rather than relying on memory.
For high-risk changes, request analysis and a plan first, then authorise implementation separately.
Review the result: a skill improves the process, but accountability remains with a person.

Skill catalogue

Each skill is designed to finish with a structured output—a table, map, checklist, verification plan or decision log—rather than generic advice.

Package 1 · BA/PO Core Delivery

Framing digital products

framing-digital-productsDownload skill (.zip)Claude.ai · Claude Code · Codex

Clarifies users, outcomes, MVP boundaries, data, roles, risks, assumptions and measurable acceptance criteria before implementation starts.

product passport and MVP boundary
risks, open questions and acceptance criteria

Designing access models

designing-access-modelsDownload skill (.zip)Claude.ai · Claude Code · Codex

Connects roles, data ownership, actions and restrictions, exposing mismatches between the UI, API and row-level policies.

access matrix and denied-path tests
public, admin and RLS decisions

Modelling business rules

modelling-business-rulesDownload skill (.zip)Claude.ai · Claude Code · Codex

Turns formulas, statuses, eligibility and transitions into unambiguous decision tables, invariants and boundary examples.

decision table and worked examples
regression case set

Designing AI features

designing-ai-featuresDownload skill (.zip)Claude.ai · Claude Code · Codex

Designs an AI feature as a controlled pipeline: minimum data, a clear model role, structured output, validation, human review and fallback.

data flow and output contract
failure modes, safeguards and no-AI path

Evaluating AI quality

evaluating-ai-qualityDownload skill (.zip)Claude.ai · Claude Code · Codex

Compares models, prompts and schemas on a representative evaluation set, covering quality, cost, latency and critical failures.

eval set, rubric and baseline
release gate and regression analysis

Directing coding agents

directing-coding-agentsDownload skill (.zip)Claude.ai · Claude Code · Codex

Turns a change or defect into a bounded, evidence-driven task for Codex, Claude Code or another coding agent.

implementation brief with constraints
verification, approvals and stop conditions

Reviewing AI-generated code

reviewing-ai-generated-codeDownload skill (.zip)Claude.ai · Claude Code · Codex

Reviews a diff against product intent, business rules, access control, data safety, tests and agreed scope.

prioritised findings with evidence
verification gaps and readiness decision

Releasing digital products

releasing-digital-productsDownload skill (.zip)Claude.ai · Claude Code · Codex

Defines the target commit, build and migration order, environment, smoke tests, observation and rollback.

release plan and go/no-go criteria
smoke checks, monitoring and rollback

Package 2 · BA/PO Production Governance

Auditing product security

auditing-product-securityDownload skill (.zip)Claude.ai · Claude Code · Codex

Reviews secrets, trust boundaries, authentication, authorisation, RLS, public endpoints, prompt injection, dependencies and deployment.

threat model and findings
prioritised remediation plan

Assessing AI data protection

assessing-ai-data-protectionDownload skill (.zip)Claude.ai · Claude Code · Codex

Examines purpose, minimisation, data flows, vendors, retention, international transfers, DPIA triggers and human safeguards.

data map and lawful-basis questions
controls, gaps and escalations

Designing operational observability

designing-operational-observabilityDownload skill (.zip)Claude.ai · Claude Code · Codex

Connects user journeys, application health, AI calls, data changes and business outcomes to logs, metrics and alerting.

signals, correlation IDs and dashboards
alerts and post-release observation

Planning backup and recovery

planning-backup-recoveryDownload skill (.zip)Claude.ai · Claude Code · Codex

Plans backup and restore for databases, files and runtime configuration, including RPO/RTO and restoration tests.

backup inventory and recovery runbook
restore test and evidence log

Reviewing public demos

reviewing-public-demosDownload skill (.zip)Claude.ai · Claude Code · Codex

Isolates a demo from production data and credentials, checking direct URLs, search, exports and client bundles.

isolation matrix and exposure checks
public-sharing decision

Reviewing product UX and accessibility

reviewing-product-ux-accessibilityDownload skill (.zip)Claude.ai · Claude Code · Codex

Reviews not only visual polish but journey clarity, keyboard use, focus, forms, mobile behaviour and resilient states.

journey findings and accessibility risks
loading, empty, error and long-content checks

Coordinating product incidents

coordinating-product-incidentsDownload skill (.zip)Claude.ai · Claude Code · Codex

Coordinates containment, evidence, communication, recovery and follow-up for outages, exposure or incorrect decisions.

incident timeline and decision log
recovery checks and corrective actions

Plain-language glossary

Agent Skill

A folder of working instructions for an AI agent. It provides a repeatable process but does not grant additional permissions.

RLS / RBAC

Ways to restrict access by individual data records and by user role.

Eval / baseline / release gate

A test set, the starting result used for comparison, and the minimum conditions a change must meet before release.

Fallback / human review

A safe alternative path and meaningful review of the result by a person.

Smoke test / rollback

A short check of critical functions after release and a prepared way to return to a working version.

RPO / RTO / DPIA

Acceptable data loss, acceptable recovery time, and an assessment of how data processing may affect people’s rights and freedoms.

Update, move and remove

Update

Back up any custom edits, then replace only the relevant skill folders. Codex normally detects changes automatically; Claude Code watches SKILL.md changes. Start a new session if discovery appears stale.

Remove

Delete the specific skill folder from ~/.agents/skills or ~/.claude/skills. Do not delete the parent directory, as it may contain other skills.

One source for both tools

To avoid duplicate files, advanced users may keep skills in one directory and use symbolic links. Confirm symlink support in your current tool version first.

Team use

Project skills can be stored in Git. Review changes as you would code: an instruction can alter the agent’s decisions, scope and proposed commands.

Safety and privacy

Read SKILL.md and its supporting files before installation, especially when the package comes from a third party.
The packages contain instructions, templates and a local build-skills.js for reproducible authoring. The script makes no external connections and is not needed for normal installation: only the contents of skills are copied. The packages contain no passwords, API keys or production data.
agents/openai.yaml contains Codex interface metadata. Claude Code may ignore it; SKILL.md is the skill entry point.
Do not place secrets or real personal data in prompts, examples, logs or evaluation sets. Use anonymised or synthetic data.
Read, write, command and external-action permissions remain governed by the agent’s settings and your approvals.

Practical rule Treat a skill as an executable working policy: install it from a trusted source, review changes, and do not approve risky actions merely because an AI proposed them.