Fähigkeiten github-elements-tracking
📦
github-elements-tracking
Inhaltsrevision r1 Hohes Risiko ⚙️ Externe Befehle📁 Dateisystemzugriff🔑 Umgebungsvariablen🌐 Netzwerkzugriff
GitHub-Issue-Workflows koordinieren
Lange KI-Aufgaben verlieren über Sitzungen hinweg Kontext und Koordination. Dieser Skill nutzt GitHub Issues, Checkpoints und Worktrees, um den Zustand zu bewahren und Phasenübergänge zu steuern.
Unterstützt: Claude Codex Code(CC)
Vor der Installation anhalten und eine Bestätigung anfordern.
Prüfen Sie den Plan und holen Sie vor Änderungen an Dateien die ausdrückliche Zustimmung des Benutzers ein.
Mit meinem Agent installieren
Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.
Agent-Anfrage
Review the Skillstore skill "github-elements-tracking" from https://skillstore.io/skills/emasoft-github-elements-tracking.md and its manifest at https://skillstore.io/api/skills/emasoft-github-elements-tracking/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.
Agent-lesbare Ressourcen
Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.
Testen
„github-elements-tracking“ wird verwendet. Authentifizierungsfeature nach Kontextkompaktierung fortsetzen.
Erwartetes Ergebnis:
Der Assistent fasst die Issue-Historie zusammen, identifiziert die aktuelle Phase, listet Blocker auf und postet einen neuen Checkpoint.
„github-elements-tracking“ wird verwendet. Drei Agenten koordinieren, die an einem Epic arbeiten.
Erwartetes Ergebnis:
Der Assistent trennt DEV-, TEST- und REVIEW-Threads, dokumentiert Issue-Umfänge und markiert überlappende Dateiverantwortung.
„github-elements-tracking“ wird verwendet. Eine Review-Übergabe für einen abgeschlossenen Branch vorbereiten.
Erwartetes Ergebnis:
Der Assistent sammelt Checkpoints, Teststatus, geänderte Dateien und Review-Kriterien in einem GitHub-Issue-Update.
Sicherheitsaudit
Hohes Risikov9 • 5.7.2026 Versionsbericht öffnen
Most static hits are documentation artifacts, especially Markdown code spans, example links, and workflow prose. Confirmed risks remain because the skill directs agents to run shell and GitHub CLI commands, write parent worktree paths, modify hidden Claude configuration, install an external MCP package, and install GitHub automation with write permissions.
12
Gescannte Dateien
10,750
Analysierte Zeilen
81
Prüfelemente
0
Falschmeldungen ignoriert
Bestätigte Sicherheitsbedenken (3)
Hoch
Prompt Injection Attempt Detected
The skill states that its law is absolute and that every user word must be followed verbatim. This can pressure an assistant to treat skill text as higher priority than safety or security review.
The wording uses absolute authority language and directs verbatim obedience to user specifications. It does not explicitly say to ignore system instructions, so confidence is high but not maximal.
Hoch
Unpinned Third-Party MCP Installation
The setup workflow tells users to install and run SERENA MCP from a GitHub URL through uvx and Claude MCP tooling. The dependency is not pinned to a reviewed commit in the cited commands.
The cited lines create an install script and run uvx from a git+https URL. That is a direct supply-chain risk even if the dependency is legitimate.
Mittel
Repository Automation With Write Permissions
The enforcement guide includes GitHub Actions snippets with issue and pull-request write permissions. If installed, they can automatically comment, label, and request changes in repository workflows.
The cited workflow examples request write permissions and call GitHub APIs that mutate issues or pull requests. This is intended enforcement behavior, but it requires explicit repository-owner review.
Elemente der Fähigkeitsprüfung (81)
Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.
Hoch
Hardcoded URL
claude mcp add serena -- uvx --from git+https://github.com/oraios/serena serena start-mcp-server --c
The setup script pulls or runs SERENA MCP from a GitHub URL through uvx or Claude MCP tooling. This is an intended dependency install, but it executes code from an external source.
Hoch
Hardcoded URL
uvx --from git+https://github.com/oraios/serena serena project create $lang_flags
The setup script pulls or runs SERENA MCP from a GitHub URL through uvx or Claude MCP tooling. This is an intended dependency install, but it executes code from an external source.
Hoch
Hardcoded URL
uvx --from git+https://github.com/oraios/serena serena project index
The setup script pulls or runs SERENA MCP from a GitHub URL through uvx or Claude MCP tooling. This is an intended dependency install, but it executes code from an external source.
Hoch
Path traversal sequence
**Standard Worktree Location**: `../ghe-worktrees/issue-{N}/`
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
Hoch
Path traversal sequence
mkdir -p ../ghe-worktrees
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
Hoch
Path traversal sequence
git worktree add ../ghe-worktrees/issue-${ISSUE_NUM} -b issue-${ISSUE_NUM} main
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
Hoch
Path traversal sequence
cd ../ghe-worktrees/issue-${ISSUE_NUM}
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
Hoch
Path traversal sequence
echo "Create worktree: git worktree add ../ghe-worktrees/issue-N -b issue-N main"
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
Hoch
Path traversal sequence
echo "WARNING: Not in a worktree. Should be in ../ghe-worktrees/issue-N/"
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
Hoch
Path traversal sequence
| Claim DEV | `git worktree add ../ghe-worktrees/issue-N -b issue-N main` |
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
Hoch
Path traversal sequence
cd ../ghe-worktrees/issue-${ISSUE_NUM}
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
Hoch
Path traversal sequence
| `GHE_WORKTREES_DIR` | ../ghe-worktrees | Worktrees directory |
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
Hoch
Path traversal sequence
safe_worktree_cleanup "../ghe-worktrees/issue-123" true
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
Hoch
Path traversal sequence
if ! verify_worktree_health "../ghe-worktrees/issue-123"; then
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
Hoch
Path traversal sequence
safe_worktree_cleanup "../ghe-worktrees/issue-123" true
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
Hoch
Path traversal sequence
git worktree add ../ghe-worktrees/issue-123 -b issue-123 main
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
Hoch
Path traversal sequence
| **Work on main branch** | Breaks isolation, pollutes main | ALL work in worktrees: `../ghe-worktre
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
Hoch
Hidden file in home directory
- ~/.claude (for plugin/settings fixes)
The skill explicitly allows background agents to write under ~/.claude for plugin or settings fixes. Writing hidden user configuration is a real security-sensitive filesystem action.
Mittel
Shell command substitution
TIMESTAMP="$(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC"
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
CURRENT=$(gh issue view $ISSUE --json assignees --jq '.assignees | length')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
TIMESTAMP="$(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC"
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
CURRENT_BODY=$(gh issue view $ISSUE --json body --jq '.body')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
Started: $(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
TIMESTAMP="$(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC"
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
TIMESTAMP="$(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC"
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
SUB_ISSUE=$(gh issue list --limit 1 --json number --jq '.[0].number')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
EPIC_LABEL=$(gh issue view $MY_ISSUE --json labels --jq '.labels[].name | select(startswith("epic:")
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Temp directory access
gh issue edit $ISSUE --body-file /tmp/updated_body.md
The skill instructs agents to write or edit temporary files under /tmp before updating GitHub Issues. This is a real filesystem side effect, although the intended use is transient issue-body editing.
Mittel
Temp directory access
gh issue view $ISSUE --json body --jq '.body' > /tmp/body.md
The skill instructs agents to write or edit temporary files under /tmp before updating GitHub Issues. This is a real filesystem side effect, although the intended use is transient issue-body editing.
Mittel
Temp directory access
# Edit /tmp/body.md to check completed task boxes, add links
The skill instructs agents to write or edit temporary files under /tmp before updating GitHub Issues. This is a real filesystem side effect, although the intended use is transient issue-body editing.
Mittel
Temp directory access
gh issue edit $ISSUE --body-file /tmp/body.md
The skill instructs agents to write or edit temporary files under /tmp before updating GitHub Issues. This is a real filesystem side effect, although the intended use is transient issue-body editing.
Mittel
Shell command substitution
--body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
EPIC=$(gh issue list --limit 1 --json number --jq '.[0].number')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
--body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
--body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
--body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
EPIC=$(gh issue view $REVIEW_ISSUE --json labels --jq '.labels[] | select(.name | startswith("epic:"
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
DEV_OPEN=$(gh issue list --label "epic:$EPIC" --label "phase:dev" --state open --json number --jq 'l
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
TEST_OPEN=$(gh issue list --label "epic:$EPIC" --label "phase:test" --state open --json number --jq
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
TEST_ISSUE=$(gh issue list --label "epic:$EPIC" --label "phase:test" --state closed --json number --
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
gh issue comment $ISSUE --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
## Review Started - $(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
EPIC=$(gh issue view $ISSUE --json labels --jq '.labels[] | select(.name | startswith("epic:")) | .n
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
## Review Progress - $(date -u +%H:%M) UTC
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
EPIC=$(gh issue view $ISSUE --json labels --jq '.labels[] | select(.name | startswith("epic:")) | .n
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
## Re-Review - $(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
$ gh issue comment 201 --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
ASSIGNEE=$(gh issue view $ISSUE --json assignees --jq '.assignees[0].login')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
LABELS=$(gh issue view $ISSUE --json labels --jq '.labels[].name')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
EPIC_LABEL=$(gh issue view $MY_ISSUE --json labels --jq '.labels[] | select(.name | startswith("epic
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
EPIC=$(gh issue view $ISSUE --json labels --jq '.labels[] | select(.name | startswith("epic:")) | .n
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
--body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
--body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
$ gh issue comment 201 --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
CURRENT=$(gh issue view $TEST_ISSUE --json assignees --jq '.assignees | length')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
gh issue comment $TEST_ISSUE --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
## [TEST Session 1] $(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC - @me
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
gh issue comment $TEST_ISSUE --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
gh issue comment $TEST_ISSUE --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
gh issue comment $DEV_ISSUE --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
gh issue comment $TEST_ISSUE --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
## [TEST Session N - COMPLETE] $(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC - @me
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
PROJECT_DIR=$(pwd)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
CURRENT_BRANCH=$(git branch --show-current)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
REVIEW_DATE=$(date +%Y-%m-%d)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
BEHIND=$(git rev-list --count HEAD..origin/main)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
attempt=$((attempt + 1))
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
local start=$(date +%s)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
while [ $(check_merge_lock) -gt 0 ]; do
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
local now=$(date +%s)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
local elapsed=$((now - start))
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Shell command substitution
gh pr edit 456 --body "$(gh pr view 456 --json body --jq .body)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Mittel
Template literal with command substitution
```bash
The flagged location opens a bash command block that includes variable expansion and operational commands. The exact label is broad, but the surrounding guidance still asks agents to execute shell workflows.
Mittel
Template literal with command substitution
```bash
The flagged location opens a bash command block that includes variable expansion and operational commands. The exact label is broad, but the surrounding guidance still asks agents to execute shell workflows.
Mittel
Template literal with command substitution
```bash
The flagged location opens a bash command block that includes variable expansion and operational commands. The exact label is broad, but the surrounding guidance still asks agents to execute shell workflows.
Mittel
Template literal with command substitution
```bash
The flagged location opens a bash command block that includes variable expansion and operational commands. The exact label is broad, but the surrounding guidance still asks agents to execute shell workflows.
Mittel
Template literal with command substitution
```bash
The flagged location opens a bash command block that includes variable expansion and operational commands. The exact label is broad, but the surrounding guidance still asks agents to execute shell workflows.
Mittel
Template literal with command substitution
```bash
The flagged location opens a bash command block that includes variable expansion and operational commands. The exact label is broad, but the surrounding guidance still asks agents to execute shell workflows.
Mittel
Unix shell invocation
#!/bin/bash
The finding is a bash script entry point in setup or verification guidance. Running it can execute local commands and modify tool configuration or repository state.
Mittel
Unix shell invocation
#!/bin/bash
The finding is a bash script entry point in setup or verification guidance. Running it can execute local commands and modify tool configuration or repository state.
Mittel
Hidden file access
- ~/.claude (for plugin/settings fixes)
The skill explicitly allows background agents to write under ~/.claude for plugin or settings fixes. Writing hidden user configuration is a real security-sensitive filesystem action.
Risikofaktoren
⚙️ Externe Befehle (442)
references/P1-task-agent-playbook.md:141-142 references/P1-task-agent-playbook.md:142-149 references/P1-task-agent-playbook.md:445-452 references/P1-task-agent-playbook.md:584-596 references/P1-task-agent-playbook.md:206 references/P1-task-agent-playbook.md:237 references/P1-task-agent-playbook.md:247 references/P1-task-agent-playbook.md:280 references/P1-task-agent-playbook.md:364 references/P1-task-agent-playbook.md:406 references/P1-task-agent-playbook.md:547 references/P1-task-agent-playbook.md:645 references/P1-task-agent-playbook.md:664 references/P10-bug-triage-protocol.md:100-103 references/P2-epic-coordinator-playbook.md:200-217 references/P2-epic-coordinator-playbook.md:240 references/P2-epic-coordinator-playbook.md:338-368 references/P2-epic-coordinator-playbook.md:532-540 references/P2-epic-coordinator-playbook.md:562-570 references/P3-review-agent-playbook.md:262-270 references/P3-review-agent-playbook.md:99 references/P3-review-agent-playbook.md:102 references/P3-review-agent-playbook.md:110 references/P3-review-agent-playbook.md:118 references/P3-review-agent-playbook.md:180-181 references/P3-review-agent-playbook.md:181 references/P3-review-agent-playbook.md:206 references/P3-review-agent-playbook.md:221 references/P3-review-agent-playbook.md:377 references/P3-review-agent-playbook.md:391 references/P4-compaction-recovery-walkthrough.md:142-149 references/P4-compaction-recovery-walkthrough.md:194-201 references/P4-compaction-recovery-walkthrough.md:306-319 references/P4-compaction-recovery-walkthrough.md:364-368 references/P4-compaction-recovery-walkthrough.md:430-444 references/P4-compaction-recovery-walkthrough.md:644-645 references/P4-compaction-recovery-walkthrough.md:645-663 references/P4-compaction-recovery-walkthrough.md:663-673 references/P4-compaction-recovery-walkthrough.md:714-729 references/P4-compaction-recovery-walkthrough.md:800-810 references/P4-compaction-recovery-walkthrough.md:413-417 references/P5-multi-instance-protocol.md:164-180 references/P5-multi-instance-protocol.md:331-344 references/P5-multi-instance-protocol.md:93 references/P5-multi-instance-protocol.md:102 references/P5-multi-instance-protocol.md:317 references/P5-multi-instance-protocol.md:364 references/P6-enforcement-setup.md:112 references/P6-enforcement-setup.md:116-135 references/P6-enforcement-setup.md:138 references/P6-enforcement-setup.md:140-154 references/P6-enforcement-setup.md:159 references/P6-enforcement-setup.md:167 references/P6-enforcement-setup.md:171-173 references/P6-enforcement-setup.md:227-270 references/P6-enforcement-setup.md:270-278 references/P6-enforcement-setup.md:286-295 references/P6-enforcement-setup.md:301-305 references/P6-enforcement-setup.md:345-370 references/P6-enforcement-setup.md:374-378 references/P6-enforcement-setup.md:378-430 references/P6-enforcement-setup.md:430-438 references/P6-enforcement-setup.md:444-447 references/P6-enforcement-setup.md:486 references/P6-enforcement-setup.md:489 references/P6-enforcement-setup.md:499 references/P6-enforcement-setup.md:501-504 references/P6-enforcement-setup.md:572-575 references/P6-enforcement-setup.md:652-659 references/P6-enforcement-setup.md:682-685 references/P6-enforcement-setup.md:748 references/P6-enforcement-setup.md:750 references/P6-enforcement-setup.md:753 references/P6-enforcement-setup.md:755 references/P6-enforcement-setup.md:757-760 references/P6-enforcement-setup.md:817-820 references/P7-validation-checklist.md:838-839 references/P7-validation-checklist.md:839-846 references/P8-complete-lifecycle-example.md:76-108 references/P8-complete-lifecycle-example.md:199-209 references/P8-complete-lifecycle-example.md:277-288 references/P8-complete-lifecycle-example.md:311-325 references/P8-complete-lifecycle-example.md:325-345 references/P8-complete-lifecycle-example.md:400-409 references/P8-complete-lifecycle-example.md:423-427 references/P8-complete-lifecycle-example.md:502-517 references/P8-complete-lifecycle-example.md:517-533 references/P8-complete-lifecycle-example.md:836-837 references/P8-complete-lifecycle-example.md:837-847 references/P8-complete-lifecycle-example.md:306-324 references/P8-complete-lifecycle-example.md:497-515 references/P8-complete-lifecycle-example.md:628-632 references/P9-test-agent-playbook.md:217-218 references/P9-test-agent-playbook.md:218-223 references/P9-test-agent-playbook.md:271-274 references/P9-test-agent-playbook.md:292-296 references/P9-test-agent-playbook.md:476-484 references/P9-test-agent-playbook.md:121 references/P9-test-agent-playbook.md:134-135 references/P9-test-agent-playbook.md:135 references/P9-test-agent-playbook.md:176-177 references/P9-test-agent-playbook.md:321-330 references/P9-test-agent-playbook.md:362-372 references/P9-test-agent-playbook.md:392-393 references/P9-test-agent-playbook.md:393 references/templates/issue-comment-format.md:52-53 references/templates/issue-comment-format.md:83-84 references/templates/issue-comment-format.md:84-89 SKILL.md:40 SKILL.md:41 SKILL.md:44 SKILL.md:45 SKILL.md:46 SKILL.md:47 SKILL.md:62 SKILL.md:66 SKILL.md:67 SKILL.md:68 SKILL.md:69 SKILL.md:70 SKILL.md:71 SKILL.md:127-133 SKILL.md:133-186 SKILL.md:186-194 SKILL.md:194 SKILL.md:204 SKILL.md:205 SKILL.md:206 SKILL.md:207 SKILL.md:210 SKILL.md:234-261 SKILL.md:261-267 SKILL.md:267-287 SKILL.md:287-307 SKILL.md:307-310 SKILL.md:310-322 SKILL.md:322-334 SKILL.md:334 SKILL.md:335-336 SKILL.md:336 SKILL.md:346-348 SKILL.md:348-392 SKILL.md:392-395 SKILL.md:395-400 SKILL.md:400-405 SKILL.md:405-407 SKILL.md:407-411 SKILL.md:411-420 SKILL.md:420-433 SKILL.md:433-437 SKILL.md:437-440 SKILL.md:440-447 SKILL.md:447-451 SKILL.md:451-453 SKILL.md:453-467 SKILL.md:467-473 SKILL.md:473-490 SKILL.md:490-494 SKILL.md:494-512 SKILL.md:512-518 SKILL.md:518 SKILL.md:519 SKILL.md:520 SKILL.md:525-537 SKILL.md:537-540 SKILL.md:540-552 SKILL.md:552-555 SKILL.md:555-564 SKILL.md:564-570 SKILL.md:570-573 SKILL.md:573-574 SKILL.md:574-580 SKILL.md:580-591 SKILL.md:591-599 SKILL.md:599-607 SKILL.md:607-614 SKILL.md:614-618 SKILL.md:618-620 SKILL.md:620-622 SKILL.md:622-626 SKILL.md:626-671 SKILL.md:671-677 SKILL.md:677-697 SKILL.md:697-737 SKILL.md:737-753 SKILL.md:753-755 SKILL.md:755-765 SKILL.md:765-818 SKILL.md:818-824 SKILL.md:824-861 SKILL.md:861-892 SKILL.md:892-894 SKILL.md:894-896 SKILL.md:896-929 SKILL.md:929-935 SKILL.md:935-961 SKILL.md:961-970 SKILL.md:970-976 SKILL.md:976-996 SKILL.md:996-1000 SKILL.md:1000-1001 SKILL.md:1001-1002 SKILL.md:1002-1003 SKILL.md:1003-1004 SKILL.md:1004-1005 SKILL.md:1005-1012 SKILL.md:1012-1043 SKILL.md:1043 SKILL.md:1044-1045 SKILL.md:1045-1049 SKILL.md:1049-1071 SKILL.md:1071-1078 SKILL.md:1078-1088 SKILL.md:1088-1089 SKILL.md:1089-1090 SKILL.md:1090-1094 SKILL.md:1094-1097 SKILL.md:1097-1103 SKILL.md:1103-1128 SKILL.md:1128-1134 SKILL.md:1134-1135 SKILL.md:1135-1136 SKILL.md:1136-1137 SKILL.md:1137-1138 SKILL.md:1138 SKILL.md:1139-1140 SKILL.md:1140 SKILL.md:1141 SKILL.md:1142-1143 SKILL.md:1143-1159 SKILL.md:1159-1160 SKILL.md:1160-1161 SKILL.md:1161 SKILL.md:1162-1163 SKILL.md:1163-1164 SKILL.md:1164-1169 SKILL.md:1169-1180 SKILL.md:1180-1185 SKILL.md:1185-1190 SKILL.md:1190-1209 SKILL.md:1209-1212 SKILL.md:1212-1240 SKILL.md:1240-1243 SKILL.md:1243-1279 SKILL.md:1279-1282 SKILL.md:1282-1299 SKILL.md:1299-1302 SKILL.md:1302-1335 SKILL.md:1335-1343 SKILL.md:1343-1344 SKILL.md:1344-1345 SKILL.md:1345-1346 SKILL.md:1346-1347 SKILL.md:1347 SKILL.md:1348-1349 SKILL.md:1349-1350 SKILL.md:1350-1357 SKILL.md:1357-1360 SKILL.md:1360-1363 SKILL.md:1363 SKILL.md:1364 SKILL.md:1365 SKILL.md:1368-1372 SKILL.md:1372-1384 SKILL.md:1384-1385 SKILL.md:1385-1386 SKILL.md:1386-1387 SKILL.md:1387-1388 SKILL.md:1388-1394 SKILL.md:1394-1395 SKILL.md:1395-1396 SKILL.md:1396-1397 SKILL.md:1397-1403 SKILL.md:1403-1404 SKILL.md:1404-1405 SKILL.md:1405-1406 SKILL.md:1406-1407 SKILL.md:1407 SKILL.md:1408-1414 SKILL.md:1414-1415 SKILL.md:1415-1416 SKILL.md:1416-1422 SKILL.md:1422-1423 SKILL.md:1423-1424 SKILL.md:1424-1425 SKILL.md:1425-1426 SKILL.md:1426-1427 SKILL.md:1427-1428 SKILL.md:1428-1434 SKILL.md:1434-1435 SKILL.md:1435 SKILL.md:1441-1479 SKILL.md:1479-1485 SKILL.md:1485-1539 SKILL.md:1539-1597 SKILL.md:1597-1614 SKILL.md:1614-1635 SKILL.md:1635-1648 SKILL.md:1648-1654 SKILL.md:1654-1660 SKILL.md:1660-1661 SKILL.md:1661-1662 SKILL.md:1662-1666 SKILL.md:1666-1692 SKILL.md:1692-1698 SKILL.md:1698-1699 SKILL.md:1699-1700 SKILL.md:1700-1701 SKILL.md:1701-1702 SKILL.md:1702-1703 SKILL.md:1703-1709 SKILL.md:1709-1713 SKILL.md:1713-1721 SKILL.md:1721-1726 SKILL.md:1726-1727 SKILL.md:1727-1734 SKILL.md:1734-1753 SKILL.md:1753-1759 SKILL.md:1759-1775 SKILL.md:1775-1812 SKILL.md:1812-1820 SKILL.md:1820-1841 SKILL.md:1841-1843 SKILL.md:1843-1875 SKILL.md:1875-1883 SKILL.md:1883-1884 SKILL.md:1884-1885 SKILL.md:1885-1888 SKILL.md:1888-1895 SKILL.md:1895-1905 SKILL.md:1905-1912 SKILL.md:1912-1918 SKILL.md:1918-1919 SKILL.md:1919-1920 SKILL.md:1920-1926 SKILL.md:1926-1932 SKILL.md:1932-1961 SKILL.md:1961-1972 SKILL.md:1972-1984 SKILL.md:1984-1985 SKILL.md:1985-1986 SKILL.md:1986-1987 SKILL.md:1987-1988 SKILL.md:1988-1989 SKILL.md:1989-1990 SKILL.md:1990-1996 SKILL.md:1996-1997 SKILL.md:1997-1998 SKILL.md:1998-2004 SKILL.md:2004-2005 SKILL.md:2005-2006 SKILL.md:2006-2007 SKILL.md:2007-2021 SKILL.md:2021-2033 SKILL.md:2033-2039 SKILL.md:2039-2040 SKILL.md:2040-2041 SKILL.md:2041-2042 SKILL.md:2042-2043 SKILL.md:2043-2044 SKILL.md:2044-2045 SKILL.md:2045-2046 SKILL.md:2046-2047 SKILL.md:2047-2048 SKILL.md:2048-2049 SKILL.md:2049-2050 SKILL.md:2050-2051 SKILL.md:2051 SKILL.md:2052-2058 SKILL.md:2058-2061 SKILL.md:2061-2083 SKILL.md:2083-2086 SKILL.md:2086-2092 SKILL.md:2092-2093 SKILL.md:2093-2094 SKILL.md:2094-2095 SKILL.md:2095-2096 SKILL.md:2096-2097 SKILL.md:2097-2098 SKILL.md:2098-2099 SKILL.md:2099-2100 SKILL.md:2100-2101 SKILL.md:2101-2102 SKILL.md:2102-2108 SKILL.md:2108-2109 SKILL.md:2109-2110 SKILL.md:2110-2111 SKILL.md:2111-2115 SKILL.md:2115-2126 SKILL.md:2126-2136 SKILL.md:2136-2146 SKILL.md:2146-2152 SKILL.md:2152-2160 SKILL.md:2160-2166 SKILL.md:2166-2171 SKILL.md:2171-2177 SKILL.md:2177-2190 SKILL.md:2190-2196 SKILL.md:2196-2201 SKILL.md:2201-2207 SKILL.md:2207 SKILL.md:2208-2209 SKILL.md:2209-2210 SKILL.md:2210-2211 SKILL.md:2211-2212 SKILL.md:2212-2218 SKILL.md:2218-2226 SKILL.md:2226-2262 SKILL.md:2262-2265 SKILL.md:2265-2267 SKILL.md:2267-2269 SKILL.md:2269-2517 SKILL.md:2517-2527 SKILL.md:2527-2530 SKILL.md:2530-2534 SKILL.md:2534-2544 SKILL.md:2544-2546 SKILL.md:2546-2561 SKILL.md:2561-2568 SKILL.md:2568-2585 SKILL.md:2585-2586 SKILL.md:2586-2587 SKILL.md:2587-2588 SKILL.md:2588-2589 SKILL.md:353 SKILL.md:475 SKILL.md:699 SKILL.md:775 SKILL.md:805 SKILL.md:833 SKILL.md:835 SKILL.md:836 SKILL.md:837 SKILL.md:1872 SKILL.md:348-392 SKILL.md:473-490 SKILL.md:697-737 SKILL.md:765-818 SKILL.md:824-861 SKILL.md:1843-1875 SKILL.md:349 SKILL.md:1442
📁 Dateisystemzugriff (59)
references/P1-task-agent-playbook.md:283 references/P1-task-agent-playbook.md:458 references/P1-task-agent-playbook.md:459 references/P1-task-agent-playbook.md:460 references/P5-multi-instance-protocol.md:870 references/P6-enforcement-setup.md:116 references/P6-enforcement-setup.md:171 references/P6-enforcement-setup.md:286 references/P6-enforcement-setup.md:38 references/P6-enforcement-setup.md:39 references/P6-enforcement-setup.md:40 references/P6-enforcement-setup.md:41 references/P6-enforcement-setup.md:42 references/P6-enforcement-setup.md:48 references/P6-enforcement-setup.md:49 references/P6-enforcement-setup.md:50 references/P6-enforcement-setup.md:51 references/P6-enforcement-setup.md:52 references/P6-enforcement-setup.md:53 references/P6-enforcement-setup.md:56 references/P6-enforcement-setup.md:57 references/P6-enforcement-setup.md:58 references/P6-enforcement-setup.md:59 references/P6-enforcement-setup.md:63 references/P6-enforcement-setup.md:65 references/P6-enforcement-setup.md:66 references/templates/issue-comment-format.md:10 references/templates/issue-comment-format.md:11 references/templates/issue-comment-format.md:12 references/templates/issue-comment-format.md:13 references/templates/issue-comment-format.md:14 references/templates/issue-comment-format.md:15 references/templates/issue-comment-format.md:16 references/templates/issue-comment-format.md:17 references/templates/issue-comment-format.md:18 references/templates/issue-comment-format.md:19 references/templates/issue-comment-format.md:20 references/templates/issue-comment-format.md:58 references/templates/issue-comment-format.md:73 SKILL.md:451 SKILL.md:457 SKILL.md:460 SKILL.md:463 SKILL.md:480 SKILL.md:486 SKILL.md:570 SKILL.md:702 SKILL.md:2060 SKILL.md:2111 SKILL.md:2159 SKILL.md:2181 SKILL.md:2185 SKILL.md:2188 SKILL.md:2262 SKILL.md:26 SKILL.md:26 SKILL.md:589 SKILL.md:1454 SKILL.md:1458
🔑 Umgebungsvariablen (14)
references/P2-epic-coordinator-playbook.md:416 references/P4-compaction-recovery-walkthrough.md:213 references/P4-compaction-recovery-walkthrough.md:225 references/P4-compaction-recovery-walkthrough.md:230 references/P4-compaction-recovery-walkthrough.md:232 references/P4-compaction-recovery-walkthrough.md:243 references/P4-compaction-recovery-walkthrough.md:251 references/P4-compaction-recovery-walkthrough.md:295 references/P4-compaction-recovery-walkthrough.md:314 references/P4-compaction-recovery-walkthrough.md:450 references/P5-multi-instance-protocol.md:257 references/P5-multi-instance-protocol.md:265 references/P5-multi-instance-protocol.md:282 references/P5-multi-instance-protocol.md:297
🌐 Netzwerkzugriff (4)
Geprüft von: codex Audit-Verlauf anzeigen →
Diesen Bericht teilen & zitieren
Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.
Berichtslink kopieren
https://skillstore.io/skills/emasoft-github-elements-tracking/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown-Badge
[](https://skillstore.io/skills/emasoft-github-elements-tracking?utm_source=security_passport_badge)HTML-Badge
<a href="https://skillstore.io/skills/emasoft-github-elements-tracking?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/emasoft-github-elements-tracking/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Einbettungskarte
<iframe src="https://skillstore.io/embed/skills/emasoft-github-elements-tracking.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Wissenschaftliche Zitate (APA · BibTeX · CFF)
APA-Zitat
Emasoft. (2026). github-elements-tracking security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/emasoft-github-elements-tracking/audits/9BibTeX-Zitat
@techreport{emasoft-emasoft-github-elements-tracking-2026,
author = {Emasoft},
title = {github-elements-tracking security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/emasoft-github-elements-tracking/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "github-elements-tracking security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "Emasoft"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/emasoft-github-elements-tracking/audits/9"
identifiers:
- type: other
value: "skillstore:emasoft-github-elements-tracking:audit:9"
description: "Skillstore immutable audit report identifier"
Skillstore-Score
Warum dieser Score Evidenzvertrauen: Mittel 50
Architektur
85
Wartbarkeit
85
Inhalt
70
Gemeinschaft
70
Spezifikationskonformität
Was Sie erstellen können
Lange Aufgaben wiederaufnehmen
Arbeit nach Kontextverlust durch Lesen von Issue-Checkpoints und Phasenstatus fortsetzen.
Agentenphasen koordinieren
Entwicklungs-, Test- und Review-Verantwortlichkeiten über GitHub-Issue-Threads hinweg trennen.
Feature-Historie prüfen
Claims, Entscheidungen, Testergebnisse und Review-Ergebnisse anhand von Issue-Kommentaren nachverfolgen.
Diese Prompts ausprobieren
Tracking starten
Erstelle einen GitHub-Issue-Workflow für dieses Feature. Definiere Phase, Umfang, Akzeptanzkriterien und den ersten Checkpoint.
Arbeit claimen
Claime Issue <number>, identifiziere die aktive Phase, deklariere die Dateien im Umfang und poste einen Start-Checkpoint.
Sitzung wiederherstellen
Lies Issue <number> und rekonstruiere den aktuellen Zustand, Blocker, abgeschlossene Arbeit und die nächste Aktion.
Epic koordinieren
Überprüfe das Epic-Issue, ordne aktive DEV-, TEST- und REVIEW-Threads zu, finde Konflikte und schlage den nächsten Wellenplan vor.
Bewährte Praktiken
- Repository, Issue-Nummer und Phase bestätigen, bevor GitHub-CLI-Befehle ausgeführt werden.
- Kurze Checkpoints bei bedeutenden Zustandsänderungen posten, nicht bei jeder kleinen Bearbeitung.
- Automatisierungs-Snippets und Token-Berechtigungen prüfen, bevor Durchsetzungs-Workflows installiert werden.
Vermeiden
- Branches nicht vor einem dokumentierten REVIEW-Durchlauf mergen.
- Issue-Kommentare nicht als optional behandeln, wenn sie Projektspeicher enthalten.
- Setup-Skripte aus dem Skill nicht ausführen, ohne die Befehle vorher zu prüfen.
Häufig gestellte Fragen
Erfordert dieser Skill GitHub?
Ja. Der Workflow hängt von GitHub Issues, Labels, Kommentaren und oft der GitHub CLI ab.
Kann er ohne SERENA MCP laufen?
Ja, aber die Speicherung großer Dokumente und die Synchronisierung des Projektspeichers können eingeschränkt sein.
Erstellt er von selbst Codeänderungen?
Nein. Er stellt Protokolle und Befehlsbeispiele bereit, denen ein Assistent während der Entwicklungsarbeit folgen kann.
Ist die Durchsetzungseinrichtung automatisch?
Nein. Der Repository-Eigentümer muss alle GitHub-Actions-Snippets prüfen und installieren.
Wer sollte diesen Skill verwenden?
Verwende ihn für lang laufende Entwicklungsarbeit, die dauerhaften Zustand und Phasenverfolgung benötigt.
Was sollte vor der Verwendung geprüft werden?
Shell-Befehle, GitHub-Token-Scopes, Worktree-Pfade und externe MCP-Installationsschritte prüfen.
Entwicklerdetails
Autor
EmasoftLizenz
MIT
Skillstore-Revision
r1
Versionshinweis
Der Autor hat keine Version angegeben.
Repository
https://github.com/Emasoft/ghe-marketplace/tree/main/plugins/ghe/skills/github-elements-trackingRef.
30c73eac2afe762f6aa9c4553158769369d47351
Aktualität der Wartung
21.7.2026
Nutzung
4 Downloads · 224 Aufrufe