Skills gh-ticket

📦

gh-ticket

Name: gh-ticket
Author: Cygnusfear

Content revision r1 High Risk ⚙️ External commands📁 Filesystem access

Create Complete GitHub Tickets

Vague issues slow implementation and lose investigation context. This skill turns findings, requirements, and acceptance criteria into complete GitHub tickets.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "gh-ticket" from https://skillstore.io/skills/cygnusfear-gh-ticket.md and its manifest at https://skillstore.io/api/skills/cygnusfear-gh-ticket/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/cygnusfear-gh-ticket.md Signed manifest GET /api/skills/cygnusfear-gh-ticket/manifest Signed lockfile GET /api/skills/cygnusfear-gh-ticket/lockfile

Test it

Using "gh-ticket". A file upload crashes for files larger than 10MB.

Expected outcome:

A bug ticket with summary, current and desired behavior, file size requirements, edge cases, acceptance checks, affected upload files, and technical notes.

Using "gh-ticket". Users need a dark mode setting.

Expected outcome:

A feature ticket with product context, theme options, persistence requirements, affected settings files, dependencies, and clear out-of-scope items.

Using "gh-ticket". New investigation found a related pull request and a missing acceptance criterion.

Expected outcome:

An issue update or comment that adds the pull request link, revised acceptance criteria, and implementation notes without losing prior context.

Security Audit

High Risk

v8 • 7/5/2026 Open versioned report

Most static findings are false positives caused by Markdown code fences and inline code examples. Confirmed risks remain around shell command substitution, predictable temporary file use, remote GitHub issue mutation, and possible disclosure of sensitive context in tickets.

Files scanned

721

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:10-18 SKILL.md:273-275 SKILL.md:285-294

Potential Sensitive Data Disclosure in GitHub Issues

The skill urges users to capture maximum context, fresh error messages, config values, and environment details, then publish the ticket through GitHub commands. Without explicit redaction guidance, secrets, private logs, or internal operational details can be disclosed to GitHub issues.

The cited lines explicitly request broad context, error messages, config values, and environment details, and show commands that publish issue bodies. The risk depends on user content, but the absence of redaction safeguards makes the disclosure path clear.

Medium

SKILL.md:285-297 SKILL.md:302-324

Remote GitHub Issue Mutation Without Confirmation Guidance

The skill provides commands to create issues, replace issue bodies, add comments, and add labels, but it does not require an explicit confirmation step before remote changes. An agent following the instructions could modify project issue state with incorrect or sensitive content.

The cited command examples perform remote GitHub create, edit, comment, and label operations. No nearby instruction requires previewing and confirming the final remote mutation.

Capability review items (7)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:287-290

Shell command substitution

gh issue create --title "[Type]: Brief description" --body "$(cat <<'EOF'

The skill recommends passing generated issue bodies through shell command substitution into gh issue commands. If the body contains a heredoc terminator or untrusted text, shell parsing can cause command injection or unintended GitHub writes.

Medium

SKILL.md:307-310

Shell command substitution

gh issue edit <number> --body "$(cat <<'EOF'

Medium

SKILL.md:316-321

Shell command substitution

gh issue comment <number> --body "$(cat <<'EOF'

Medium

SKILL.md:285-298

Template literal with command substitution

```bash

This fenced bash example contains gh issue create, edit, and comment commands that embed generated text using command substitution. The pattern is functional but risky when an agent inserts unreviewed ticket content into a shell command.

Medium

SKILL.md:302-325

Template literal with command substitution

```bash

Medium

SKILL.md:293

Temp directory access

echo "[ticket content]" > /tmp/ticket.md

The skill suggests writing ticket content to a predictable /tmp/ticket.md path before publishing it. A shared predictable temp file can expose sensitive issue text or be clobbered by another local process.

Medium

SKILL.md:294

Temp directory access

gh issue create --title "[Type]: Brief description" --body-file /tmp/ticket.md

Risk Factors

⚙️ External commands (99)

SKILL.md:52-72 SKILL.md:72-76 SKILL.md:76-84 SKILL.md:84-88 SKILL.md:88-97 SKILL.md:97-109 SKILL.md:109-116 SKILL.md:116-128 SKILL.md:128-134 SKILL.md:134-140 SKILL.md:140-148 SKILL.md:148-158 SKILL.md:158-162 SKILL.md:162-163 SKILL.md:163-164 SKILL.md:164-167 SKILL.md:167-170 SKILL.md:170-171 SKILL.md:171-175 SKILL.md:175-178 SKILL.md:178 SKILL.md:179 SKILL.md:180 SKILL.md:182-183 SKILL.md:183-187 SKILL.md:187-196 SKILL.md:196-204 SKILL.md:204-241 SKILL.md:241-242 SKILL.md:242-245 SKILL.md:245-248 SKILL.md:248-251 SKILL.md:251-252 SKILL.md:252-277 SKILL.md:277-285 SKILL.md:285-298 SKILL.md:298-302 SKILL.md:302-325 SKILL.md:325-339 SKILL.md:339-354 SKILL.md:354-394 SKILL.md:394-400 SKILL.md:400-402 SKILL.md:402-406 SKILL.md:406-426 SKILL.md:426-430 SKILL.md:430-440 SKILL.md:440-444 SKILL.md:444-455 SKILL.md:455-463 SKILL.md:463-506 SKILL.md:506 SKILL.md:507-508 SKILL.md:508 SKILL.md:511 SKILL.md:512 SKILL.md:515-519 SKILL.md:519-524 SKILL.md:524-526 SKILL.md:526-530 SKILL.md:530-573 SKILL.md:573-574 SKILL.md:574-575 SKILL.md:575-576 SKILL.md:576-579 SKILL.md:579-580 SKILL.md:580-583 SKILL.md:583-584 SKILL.md:584-585 SKILL.md:585-590 SKILL.md:590-594 SKILL.md:594-595 SKILL.md:595-607 SKILL.md:607-626 SKILL.md:626 SKILL.md:627-628 SKILL.md:628-629 SKILL.md:629-630 SKILL.md:630-631 SKILL.md:631-637 SKILL.md:637-638 SKILL.md:638-646 SKILL.md:646-647 SKILL.md:647-651 SKILL.md:651-652 SKILL.md:652-665 SKILL.md:665-666 SKILL.md:666-670 SKILL.md:670-671 SKILL.md:671-681 SKILL.md:681-682 SKILL.md:682-688 SKILL.md:688-701 SKILL.md:287-290 SKILL.md:307-310 SKILL.md:316-321 SKILL.md:285-298 SKILL.md:302-325 SKILL.md:96

📁 Filesystem access (2)

SKILL.md:293 SKILL.md:294

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/cygnusfear-gh-ticket/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/cygnusfear-gh-ticket/security.svg)](https://skillstore.io/skills/cygnusfear-gh-ticket?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/cygnusfear-gh-ticket?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cygnusfear-gh-ticket/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/cygnusfear-gh-ticket.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

Cygnusfear. (2026). gh-ticket security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cygnusfear-gh-ticket/audits/8

BibTeX citation

@techreport{cygnusfear-cygnusfear-gh-ticket-2026,
  author = {Cygnusfear},
  title = {gh-ticket security audit report (audit version 8)},
  institution = {Skillstore},
  year = {2026},
  number = {8},
  url = {https://skillstore.io/skills/cygnusfear-gh-ticket/audits/8},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "gh-ticket security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
  - name: "Cygnusfear"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/cygnusfear-gh-ticket/audits/8"
identifiers:
  - type: other
    value: "skillstore:cygnusfear-gh-ticket:audit:8"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Write a Bug Ticket After Investigation

Capture symptoms, errors, affected files, expected behavior, and testable acceptance criteria.

Turn a Feature Request Into a Workable Spec

Convert a broad request into requirements, dependencies, implementation notes, and out-of-scope items.

Update an Existing Issue With New Findings

Add discovered context, revised requirements, or comments while preserving useful project history.

Try These Prompts

Create a Basic Ticket

Create a GitHub issue for this request. Include summary, context, requirements, edge cases, and acceptance criteria: [request]

Capture a Bug Report

Create a bug ticket from these findings. Include current behavior, desired behavior, error messages, affected files, and validation steps: [findings]

Update an Existing Issue

Update issue #[number] with this new context. Decide whether to rewrite the body or add a comment, then prepare the final ticket text: [context]

Create a Detailed Implementation Spec

Draft a comprehensive GitHub ticket for this implementation. Include dependencies, out-of-scope items, affected files, key code locations, risks, and a Mermaid diagram if useful: [details]

Best Practices

Review ticket content for secrets, tokens, personal data, and internal URLs before publishing.
Use exact file paths and line numbers when they are known.
Show the final issue body and labels before creating or editing a remote issue.

Avoid

Creating vague tickets that only say to fix or improve something.
Publishing logs, configuration values, or stack traces without redaction.
Changing an issue scope without documenting what moved out of scope.

Frequently Asked Questions

Does this skill create GitHub issues automatically?

It provides GitHub CLI command patterns, but the user or agent must run them with repository access.

Can it update existing issues?

Yes. It explains when to replace the issue body, update the title, add labels, or add a comment.

Does it require Claude Code or Codex?

No. It is compatible with Claude, Codex, and Claude Code workflows that can read instructions and use local tools.

What should I check before publishing a ticket?

Check that requirements are specific, acceptance criteria are testable, and sensitive data has been removed.

Can it include diagrams?

Yes. It recommends Mermaid diagrams for flows, state changes, component relationships, and process timelines.

What are the main security concerns?

The main concerns are shell command examples, temporary file handling, remote GitHub writes, and accidental disclosure of sensitive context.

Developer Details

Author

Cygnusfear

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/Cygnusfear/claude-stuff/tree/main/skills/gh-ticket

Ref

7e9e368dc1a370f2040369ebcd0db06d90cb48e5

Maintenance freshness

7/18/2026

Usage

4 downloads · 309 views

File structure

📄 SKILL.md