
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
@britt/llpm
Advanced tools
Large Language Model Product Manager - AI-powered CLI for software development
A modern, AI-powered project management CLI that brings intelligent assistance directly to your terminal. Built with Ink for a polished terminal UI, LLPM combines natural language interaction with structured project management, offering seamless GitHub integration and persistent workspace configuration.
Perfect for developers who want to organize multiple projects, interact with GitHub repositories, and leverage AI assistance without leaving the command line.
npm install -g @britt/llpm
After installation, run llpm to start the CLI.
Bun blocks postinstall scripts from packages not in its trusted list. To install with Bun, first add @britt/llpm to your global ~/.bunfig.toml:
[install]
trustedDependencies = ["@britt/llpm"]
Then install:
bun install -g @britt/llpm
git clone https://github.com/britt/llpm.git
cd llpm
bun install
bun run start
Full documentation available at: https://britt.github.io/llpm/
~/.llpm//skills reload/info - Show application and current project information/help - Display all available commands/quit or /exit - Exit the application/clear - Start a new chat session/project - Manage projects (add, list, switch, remove)/project-scan - Scan and analyze project structure/github - Browse and search GitHub repositories/issue - Manage GitHub issues/model - Switch between AI models and view provider status/skills - Manage skills (list, test, enable, disable, reload)/notes - Manage project notes/stakeholder - Manage stakeholders and goals/history - View chat history/registry - View model registry information/debug - Show recent debug logs for troubleshootingConfigure API keys as environment variables. If running from source, copy .env.example to .env:
cp .env.example .env
# AI Providers (configure at least one)
OPENAI_API_KEY=your-openai-api-key-here
ANTHROPIC_API_KEY=your-anthropic-api-key-here
GROQ_API_KEY=your-groq-api-key-here
CEREBRAS_API_KEY=your-cerebras-api-key-here
GOOGLE_VERTEX_PROJECT_ID=your-google-cloud-project-id
GOOGLE_VERTEX_REGION=us-central1 # Optional, defaults to us-central1
# Optional integrations
GITHUB_TOKEN=your-github-token-here # For GitHub features
📖 For detailed provider configuration instructions, see Model Providers Documentation
bun run start # Start the CLI
bun run start:verbose # Start with debug logging
Run the setup wizard to configure credentials and create an initial project.
llpm setup
To re-run setup from a clean state, pass --force.
llpm setup --force
llpm (or bun run start if running from source)/help) for specific functionsMarkdown rendering is enabled only when stdout is a TTY and neither NO_COLOR nor CI=true is set.
Set up your first project:
/project add "My App" "https://github.com/user/my-app" "/path/to/project"
The newly created project becomes the active project.
Or browse GitHub repositories:
/github list
# Then use the AI: "Add this repository as a new project"
Switch between projects:
/project switch project-id
# or
/project switch # to see available projects to switch to
/project list # to list all available projects with details
Natural language project management:
Switch between AI models:
/model switch # Interactive model selector
/model switch openai/gpt-4o # Direct model switch
/model list # Show available models
/model providers # Check provider configuration
You can use either approach:
Slash commands (direct, immediate):
/info - Quick system information/project list - List all projects/project switch - Switch between projects/github search typescript - Search repositoriesNatural language (AI-powered, flexible):
bun run test
bun start - Start the CLI applicationbun start:verbose - Start with debug logging enabledbun run dev - Same as start (development mode)bun run dev:verbose - Development mode with debug loggingbun run test - Run test suitebun run test:watch - Run tests in watch modebun run test:ui - Run tests with UIbun run test:coverage - Run tests with coverage reportbun run typecheck - Run TypeScript type checkingbun run lint - Run ESLintbun run format - Format code with PrettierEnable verbose debug logging to troubleshoot issues:
# Using npm scripts
bun start:verbose
# Using flags directly
bun run index.ts --verbose
./index.ts -v
Debug logs include:
LLPM includes OpenTelemetry support for distributed tracing with Jaeger. This enables comprehensive visibility into:
Quick Start:
# Start Jaeger
cd docker
docker-compose up -d jaeger
# Enable telemetry (enabled by default)
export LLPM_TELEMETRY_ENABLED=1
# Run LLPM with verbose logging to see trace initialization
bun run index.ts --verbose
# View traces at http://localhost:16686
📖 For detailed telemetry setup and usage, see TELEMETRY.md
LLPM stores configuration in ~/.llpm/:
config.json - Project configurations and current projectchat-sessions/ - Persistent chat history by sessionsystem_prompt.txt - Custom system prompt (automatically created on first run)skills/ - Core skills and custom skills (automatically installed on first run)LLPM automatically creates a default system prompt file on first run. You can customize the AI assistant's behavior by editing this file:
# View the current system prompt
cat ~/.llpm/system_prompt.txt
# Edit the system prompt with your preferred editor
nano ~/.llpm/system_prompt.txt
# or
code ~/.llpm/system_prompt.txt
Key features:
~/.llpm/system_prompt.txt on first install/runThe default system prompt focuses on project management, GitHub integration, and provides access to all available tools and commands.
LLPM implements the Agent Skills standard, allowing you to create reusable instruction sets that work across multiple AI coding assistants including Claude Code, Cursor, and other compatible tools.
Skills are automatically injected into the system prompt, making the AI aware of when and how to use them. Because LLPM uses the Agent Skills standard, you can share skills between tools or use community skill packs like Superpowers which provides battle-tested workflows for TDD, debugging, code review, and more.
LLPM comes with 20 core skills installed by default in ~/.llpm/skills/:
| Skill | Description |
|---|---|
| architecture-diagramming | Create architecture diagrams for projects |
| at-risk-detection | Detect at-risk items in projects and issues |
| build-faq-from-issues | Generate FAQ documents from GitHub issues |
| consolidate-notes-summary | Consolidate and summarize project notes |
| context-aware-questions | Generate context-aware clarifying questions |
| dependency-mapping | Map project dependencies and relationships |
| issue-decomposition | Decompose large issues into smaller tasks |
| markdown-formatting | Best practices for markdown document formatting |
| mermaid-diagrams | Create syntactically correct Mermaid diagrams for GitHub |
| prepare-meeting-agenda | Structure effective meeting agendas |
| project-planning | Guide project planning and milestone creation |
| requirement-elicitation | Elicit and refine project requirements |
| research-topic-summarize | Summarize research on technical topics |
| stakeholder-tracking | Track stakeholders and their goals |
| stakeholder-updates | Craft clear stakeholder communications |
| summarize-conversation-thread | Summarize long conversation threads |
| timeline-planning | Plan project timelines and schedules |
| triage-new-issues | Triage and categorize new GitHub issues |
| user | General user interaction skill |
| user-story-template | Write well-formed user stories with acceptance criteria |
Skills are automatically listed in the system prompt, showing the AI when to load them:
You: "I need to create a sequence diagram for the authentication flow"
AI: I'll load the mermaid-diagrams skill to help create a syntactically correct diagram.
[Uses load_skills tool]
AI Tools for Skills:
load_skills - Load one or more skills to augment contextlist_available_skills - Discover available skills with optional tag filteringSlash Commands:
/skills list # List all discovered skills and their status
/skills test <name> # Preview a skill's content and settings
/skills enable <name> # Enable a skill
/skills disable <name> # Disable a skill
/skills reload # Rescan skill directories and reload all skills
/skills reinstall # Reinstall core skills from bundled directory
Create your own skills in ~/.llpm/skills/ (personal) or .skills/ (project-specific):
# ~/.llpm/skills/my-skill/SKILL.md
---
name: my-skill
description: "Brief description of what this skill does"
instructions: "When [condition], [action]"
tags:
- tag1
- tag2
allowed_tools:
- tool1
- tool2
---
# My Skill Instructions
Your markdown instructions here...
Frontmatter Fields:
name (required): Unique skill identifier (lowercase, hyphens only)description (required): What the skill does (max 1024 chars)instructions (optional): Single-line guidance on when to use this skilltags (optional): Array of tags for filtering and discoveryallowed_tools (optional): Restrict tool usage when skill is activevars (optional): Variables for content substitutionresources (optional): Additional files to loadSkill Locations:
~/.llpm/skills/ - Personal skills (shared across all projects).skills/ or skills/ - Project-specific skills (not shared)How Skills Work:
/skills reload is calledinstructions fieldload_skills tool, the skill's full content is added to contextExample Custom Skill:
# ~/.llpm/skills/api-design/SKILL.md
---
name: api-design
description: "Guide for designing RESTful API endpoints following best practices"
instructions: "When designing APIs, creating endpoints, or reviewing API specifications"
tags:
- api
- rest
- design
allowed_tools:
- github
- notes
---
# API Design Skill
## RESTful Principles
- Use nouns for resources (not verbs)
- HTTP methods: GET (read), POST (create), PUT/PATCH (update), DELETE (remove)
...
src/components/)src/hooks/useChat.ts)src/services/llm.ts)src/commands/)src/tools/)src/utils/)~/.llpm/config.jsonThe AI assistant has access to 59 tools across these categories:
Project Management:
get_current_project, list_projects, add_project, set_current_project, remove_project, update_projectGitHub Integration:
list_github_repos, search_github_repos, get_github_repocreate_github_issue, list_github_issues, update_github_issue, comment_on_github_issue, search_github_issues, get_github_issue_with_commentslist_github_pull_requests, create_github_pull_requestNotes:
add_note, update_note, search_notes, list_notes, get_note, delete_noteStakeholder Management:
add_stakeholder, list_stakeholders, get_stakeholder, update_stakeholder, remove_stakeholderlink_issue_to_goal, unlink_issue_from_goal, generate_coverage_report, resolve_conflictProject Analysis:
scan_project, get_project_scan, list_project_scans, analyze_project_fullget_project_architecture, get_project_key_files, get_project_dependenciesanalyze_project_risks, analyze_issue_risks, get_at_risk_itemsgenerate_project_questions, generate_issue_questions, suggest_clarifications, identify_information_gapsFilesystem:
read_project_file, list_project_directory, get_project_file_info, find_project_filesWeb & Screenshots:
web_search, read_web_page, summarize_web_pagetake_screenshot, check_screenshot_setupShell & System:
run_shell_command, get_system_prompt, ask_userSkills:
load_skills, list_available_skillsThis project uses:
FAQs
Large Language Model Product Manager - AI-powered CLI for software development
The npm package @britt/llpm receives a total of 2 weekly downloads. As such, @britt/llpm popularity was classified as not popular.
We found that @britt/llpm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.