Skills managing-projects

📦

managing-projects

Name: managing-projects
Author: C0ntr0lledCha0s

v1.1.0 Content revision r2 Medium Risk ⚙️ External commands📁 Filesystem access🌐 Network access

Manage GitHub Projects v2 Workflows

GitHub Projects v2 configuration and bulk updates require precise CLI and GraphQL operations. This skill guides board setup, item management, validation, and reporting.

Supports: Claude Codex Code(CC)

📊 75 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "managing-projects" from https://skillstore.io/skills/c0ntr0lledcha0s-managing-projects.md and its manifest at https://skillstore.io/api/skills/c0ntr0lledcha0s-managing-projects/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/c0ntr0lledcha0s-managing-projects.md Signed manifest GET /api/skills/c0ntr0lledcha0s-managing-projects/manifest Signed lockfile GET /api/skills/c0ntr0lledcha0s-managing-projects/lockfile

Test it

Using "managing-projects". Review project 7 for acme without making changes.

Expected outcome:

Project: Platform Sprint
Fields found: Status, Priority, Story Points, and Sprint
Configuration gap: six items have no Status value
No changes were made

Using "managing-projects". Prepare a Kanban board for the payments team.

Expected outcome:

Proposed columns: Todo, In Progress, Review, and Done
Proposed fields: Priority and Size
Target owner and write confirmation are still required

Using "managing-projects". Summarize sprint progress for project 12.

Expected outcome:

The board contains 24 items. Twelve are done, six are in progress, four are pending, and two are in review.

Security Audit

Medium Risk

v9 • 7/23/2026 Open versioned report

Most static findings are false positives from Markdown fences, GraphQL identifiers, fixed GitHub CLI calls, and output redirection. The auto-install instruction and parent-directory lookup create privileged and out-of-scope execution risks. An unused eval-based retry helper also permits command injection if sourced.

Files scanned

3,772

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

scripts/project-helpers.sh:27-35

Unsafe Command Evaluation Helper

The retry helper joins positional arguments into a string and passes it to eval. A caller can inject shell syntax if the function is sourced.

The eval call is direct and receives reconstructed positional arguments. The helper is currently unused by the script router, which limits immediate reachability.

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/project-helpers.sh:81

Path traversal sequence

local script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && cd ../../.. && pwd)"

The helper climbs three directories above the reviewed skill and later executes installer scripts found there. This crosses the package trust boundary and can run unreviewed code.

High

SKILL.md:37

sudo privilege escalation

- **Auto-installation**: Installs `gh` if missing (requires sudo on Linux)

The skill states that it automatically installs GitHub CLI with sudo on Linux. Automatic privileged setup can modify the host outside the requested project workflow.

Risk Factors

⚙️ External commands (50)

📁 Filesystem access (27)

🌐 Network access (9)

scripts/graphql-queries.sh:513 scripts/project-helpers.sh:57 scripts/project-helpers.sh:64 scripts/project-helpers.sh:105 scripts/validate-board-config.py:36 SKILL.md:47 SKILL.md:49 SKILL.md:185 SKILL.md:188

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/c0ntr0lledcha0s-managing-projects/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/c0ntr0lledcha0s-managing-projects/security.svg)](https://skillstore.io/skills/c0ntr0lledcha0s-managing-projects?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/c0ntr0lledcha0s-managing-projects?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/c0ntr0lledcha0s-managing-projects/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/c0ntr0lledcha0s-managing-projects.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

C0ntr0lledCha0s. (2026). managing-projects security audit report (audit version 9) [Author version 1.1.0]. Skillstore. https://skillstore.io/skills/c0ntr0lledcha0s-managing-projects/audits/9

BibTeX citation

@techreport{c0ntr0lledcha0s-c0ntr0lledcha0s-managing-projects-2026,
  author = {C0ntr0lledCha0s},
  title = {managing-projects security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/c0ntr0lledcha0s-managing-projects/audits/9},
  note = {Author version 1.1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "managing-projects security audit report (audit version 9)"
version: "1.1.0"
type: report
authors:
  - name: "C0ntr0lledCha0s"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/c0ntr0lledcha0s-managing-projects/audits/9"
identifiers:
  - type: other
    value: "skillstore:c0ntr0lledcha0s-managing-projects:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Plan an Engineering Sprint

Create a sprint board, add planning fields, organize selected issues, and review workload.

Track a Product Release

Organize release issues, maintain status fields, and generate progress summaries for stakeholders.

Maintain an Issue Backlog

Bulk-add matching issues, update priorities, validate field coverage, and archive completed work.

Try These Prompts

Inspect a Project Board

Review GitHub Projects v2 project [number] for [owner]. List its fields, views, item counts, and configuration gaps without changing anything.

Create a Kanban Board

Create a Kanban project named [name] for [owner]. Propose status, priority, and size fields, then request confirmation before making changes.

Sync Matching Issues

Find open issues in [repository] matching [filter]. Preview the results, then add approved items to project [number] for [owner].

Audit and Update a Sprint

Analyze project [number] for [owner]. Identify missing statuses, stale completed items, workload imbalance, and safe batch updates. Confirm every mutation before execution.

Best Practices

Run read-only project and field queries before any mutation.
Preview filters and confirm the owner, project, and item set before bulk changes.
Use least-privilege GitHub access and require approval for dependency installation.

Avoid

Do not install system packages or invoke privileged commands automatically.
Do not guess project, item, field, or option identifiers.
Do not archive or bulk-update items without a preview and explicit confirmation.