Skills github-elements-tracking
📦
github-elements-tracking
Content revision r1 High Risk ⚙️ External commands📁 Filesystem access🔑 Env variables🌐 Network access
Coordinate GitHub Issue Workflows
Long AI tasks lose context and coordination across sessions. This skill uses GitHub Issues, checkpoints, and worktrees to preserve state and guide phase transitions.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "github-elements-tracking" from https://skillstore.io/skills/emasoft-github-elements-tracking.md and its manifest at https://skillstore.io/api/skills/emasoft-github-elements-tracking/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "github-elements-tracking". Continue the authentication feature after context compaction.
Expected outcome:
The assistant summarizes the issue history, identifies the current phase, lists blockers, and posts a new checkpoint.
Using "github-elements-tracking". Coordinate three agents working on one epic.
Expected outcome:
The assistant separates DEV, TEST, and REVIEW threads, records issue scopes, and flags overlapping file ownership.
Using "github-elements-tracking". Prepare a review handoff for a completed branch.
Expected outcome:
The assistant gathers checkpoints, test status, changed files, and review criteria into a GitHub issue update.
Security Audit
High Riskv9 • 7/5/2026 Open versioned report
Most static hits are documentation artifacts, especially Markdown code spans, example links, and workflow prose. Confirmed risks remain because the skill directs agents to run shell and GitHub CLI commands, write parent worktree paths, modify hidden Claude configuration, install an external MCP package, and install GitHub automation with write permissions.
12
Files scanned
10,750
Lines analyzed
81
Review items
0
False positives ignored
Confirmed security concerns (3)
High
Prompt Injection Attempt Detected
The skill states that its law is absolute and that every user word must be followed verbatim. This can pressure an assistant to treat skill text as higher priority than safety or security review.
The wording uses absolute authority language and directs verbatim obedience to user specifications. It does not explicitly say to ignore system instructions, so confidence is high but not maximal.
High
Unpinned Third-Party MCP Installation
The setup workflow tells users to install and run SERENA MCP from a GitHub URL through uvx and Claude MCP tooling. The dependency is not pinned to a reviewed commit in the cited commands.
The cited lines create an install script and run uvx from a git+https URL. That is a direct supply-chain risk even if the dependency is legitimate.
Medium
Repository Automation With Write Permissions
The enforcement guide includes GitHub Actions snippets with issue and pull-request write permissions. If installed, they can automatically comment, label, and request changes in repository workflows.
The cited workflow examples request write permissions and call GitHub APIs that mutate issues or pull requests. This is intended enforcement behavior, but it requires explicit repository-owner review.
Capability review items (81)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hardcoded URL
claude mcp add serena -- uvx --from git+https://github.com/oraios/serena serena start-mcp-server --c
The setup script pulls or runs SERENA MCP from a GitHub URL through uvx or Claude MCP tooling. This is an intended dependency install, but it executes code from an external source.
High
Hardcoded URL
uvx --from git+https://github.com/oraios/serena serena project create $lang_flags
The setup script pulls or runs SERENA MCP from a GitHub URL through uvx or Claude MCP tooling. This is an intended dependency install, but it executes code from an external source.
High
Hardcoded URL
uvx --from git+https://github.com/oraios/serena serena project index
The setup script pulls or runs SERENA MCP from a GitHub URL through uvx or Claude MCP tooling. This is an intended dependency install, but it executes code from an external source.
High
Path traversal sequence
**Standard Worktree Location**: `../ghe-worktrees/issue-{N}/`
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
mkdir -p ../ghe-worktrees
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
git worktree add ../ghe-worktrees/issue-${ISSUE_NUM} -b issue-${ISSUE_NUM} main
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
cd ../ghe-worktrees/issue-${ISSUE_NUM}
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
echo "Create worktree: git worktree add ../ghe-worktrees/issue-N -b issue-N main"
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
echo "WARNING: Not in a worktree. Should be in ../ghe-worktrees/issue-N/"
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
| Claim DEV | `git worktree add ../ghe-worktrees/issue-N -b issue-N main` |
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
cd ../ghe-worktrees/issue-${ISSUE_NUM}
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
| `GHE_WORKTREES_DIR` | ../ghe-worktrees | Worktrees directory |
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
safe_worktree_cleanup "../ghe-worktrees/issue-123" true
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
if ! verify_worktree_health "../ghe-worktrees/issue-123"; then
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
safe_worktree_cleanup "../ghe-worktrees/issue-123" true
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
git worktree add ../ghe-worktrees/issue-123 -b issue-123 main
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
| **Work on main branch** | Breaks isolation, pollutes main | ALL work in worktrees: `../ghe-worktre
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Hidden file in home directory
- ~/.claude (for plugin/settings fixes)
The skill explicitly allows background agents to write under ~/.claude for plugin or settings fixes. Writing hidden user configuration is a real security-sensitive filesystem action.
Medium
Shell command substitution
TIMESTAMP="$(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC"
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
CURRENT=$(gh issue view $ISSUE --json assignees --jq '.assignees | length')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
TIMESTAMP="$(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC"
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
CURRENT_BODY=$(gh issue view $ISSUE --json body --jq '.body')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
Started: $(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
TIMESTAMP="$(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC"
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
TIMESTAMP="$(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC"
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
SUB_ISSUE=$(gh issue list --limit 1 --json number --jq '.[0].number')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
EPIC_LABEL=$(gh issue view $MY_ISSUE --json labels --jq '.labels[].name | select(startswith("epic:")
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Temp directory access
gh issue edit $ISSUE --body-file /tmp/updated_body.md
The skill instructs agents to write or edit temporary files under /tmp before updating GitHub Issues. This is a real filesystem side effect, although the intended use is transient issue-body editing.
Medium
Temp directory access
gh issue view $ISSUE --json body --jq '.body' > /tmp/body.md
The skill instructs agents to write or edit temporary files under /tmp before updating GitHub Issues. This is a real filesystem side effect, although the intended use is transient issue-body editing.
Medium
Temp directory access
# Edit /tmp/body.md to check completed task boxes, add links
The skill instructs agents to write or edit temporary files under /tmp before updating GitHub Issues. This is a real filesystem side effect, although the intended use is transient issue-body editing.
Medium
Temp directory access
gh issue edit $ISSUE --body-file /tmp/body.md
The skill instructs agents to write or edit temporary files under /tmp before updating GitHub Issues. This is a real filesystem side effect, although the intended use is transient issue-body editing.
Medium
Shell command substitution
--body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
EPIC=$(gh issue list --limit 1 --json number --jq '.[0].number')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
--body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
--body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
--body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
EPIC=$(gh issue view $REVIEW_ISSUE --json labels --jq '.labels[] | select(.name | startswith("epic:"
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
DEV_OPEN=$(gh issue list --label "epic:$EPIC" --label "phase:dev" --state open --json number --jq 'l
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
TEST_OPEN=$(gh issue list --label "epic:$EPIC" --label "phase:test" --state open --json number --jq
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
TEST_ISSUE=$(gh issue list --label "epic:$EPIC" --label "phase:test" --state closed --json number --
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
gh issue comment $ISSUE --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
## Review Started - $(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
EPIC=$(gh issue view $ISSUE --json labels --jq '.labels[] | select(.name | startswith("epic:")) | .n
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
## Review Progress - $(date -u +%H:%M) UTC
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
EPIC=$(gh issue view $ISSUE --json labels --jq '.labels[] | select(.name | startswith("epic:")) | .n
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
## Re-Review - $(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
$ gh issue comment 201 --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
ASSIGNEE=$(gh issue view $ISSUE --json assignees --jq '.assignees[0].login')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
LABELS=$(gh issue view $ISSUE --json labels --jq '.labels[].name')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
EPIC_LABEL=$(gh issue view $MY_ISSUE --json labels --jq '.labels[] | select(.name | startswith("epic
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
EPIC=$(gh issue view $ISSUE --json labels --jq '.labels[] | select(.name | startswith("epic:")) | .n
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
--body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
--body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
$ gh issue comment 201 --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
CURRENT=$(gh issue view $TEST_ISSUE --json assignees --jq '.assignees | length')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
gh issue comment $TEST_ISSUE --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
## [TEST Session 1] $(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC - @me
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
gh issue comment $TEST_ISSUE --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
gh issue comment $TEST_ISSUE --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
gh issue comment $DEV_ISSUE --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
gh issue comment $TEST_ISSUE --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
## [TEST Session N - COMPLETE] $(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC - @me
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
PROJECT_DIR=$(pwd)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
CURRENT_BRANCH=$(git branch --show-current)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
REVIEW_DATE=$(date +%Y-%m-%d)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
BEHIND=$(git rev-list --count HEAD..origin/main)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
attempt=$((attempt + 1))
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
local start=$(date +%s)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
while [ $(check_merge_lock) -gt 0 ]; do
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
local now=$(date +%s)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
local elapsed=$((now - start))
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
gh pr edit 456 --body "$(gh pr view 456 --json body --jq .body)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Template literal with command substitution
```bash
The flagged location opens a bash command block that includes variable expansion and operational commands. The exact label is broad, but the surrounding guidance still asks agents to execute shell workflows.
Medium
Template literal with command substitution
```bash
The flagged location opens a bash command block that includes variable expansion and operational commands. The exact label is broad, but the surrounding guidance still asks agents to execute shell workflows.
Medium
Template literal with command substitution
```bash
The flagged location opens a bash command block that includes variable expansion and operational commands. The exact label is broad, but the surrounding guidance still asks agents to execute shell workflows.
Medium
Template literal with command substitution
```bash
The flagged location opens a bash command block that includes variable expansion and operational commands. The exact label is broad, but the surrounding guidance still asks agents to execute shell workflows.
Medium
Template literal with command substitution
```bash
The flagged location opens a bash command block that includes variable expansion and operational commands. The exact label is broad, but the surrounding guidance still asks agents to execute shell workflows.
Medium
Template literal with command substitution
```bash
The flagged location opens a bash command block that includes variable expansion and operational commands. The exact label is broad, but the surrounding guidance still asks agents to execute shell workflows.
Medium
Unix shell invocation
#!/bin/bash
The finding is a bash script entry point in setup or verification guidance. Running it can execute local commands and modify tool configuration or repository state.
Medium
Unix shell invocation
#!/bin/bash
The finding is a bash script entry point in setup or verification guidance. Running it can execute local commands and modify tool configuration or repository state.
Medium
Hidden file access
- ~/.claude (for plugin/settings fixes)
The skill explicitly allows background agents to write under ~/.claude for plugin or settings fixes. Writing hidden user configuration is a real security-sensitive filesystem action.
Risk Factors
⚙️ External commands (442)
references/P1-task-agent-playbook.md:141-142 references/P1-task-agent-playbook.md:142-149 references/P1-task-agent-playbook.md:445-452 references/P1-task-agent-playbook.md:584-596 references/P1-task-agent-playbook.md:206 references/P1-task-agent-playbook.md:237 references/P1-task-agent-playbook.md:247 references/P1-task-agent-playbook.md:280 references/P1-task-agent-playbook.md:364 references/P1-task-agent-playbook.md:406 references/P1-task-agent-playbook.md:547 references/P1-task-agent-playbook.md:645 references/P1-task-agent-playbook.md:664 references/P10-bug-triage-protocol.md:100-103 references/P2-epic-coordinator-playbook.md:200-217 references/P2-epic-coordinator-playbook.md:240 references/P2-epic-coordinator-playbook.md:338-368 references/P2-epic-coordinator-playbook.md:532-540 references/P2-epic-coordinator-playbook.md:562-570 references/P3-review-agent-playbook.md:262-270 references/P3-review-agent-playbook.md:99 references/P3-review-agent-playbook.md:102 references/P3-review-agent-playbook.md:110 references/P3-review-agent-playbook.md:118 references/P3-review-agent-playbook.md:180-181 references/P3-review-agent-playbook.md:181 references/P3-review-agent-playbook.md:206 references/P3-review-agent-playbook.md:221 references/P3-review-agent-playbook.md:377 references/P3-review-agent-playbook.md:391 references/P4-compaction-recovery-walkthrough.md:142-149 references/P4-compaction-recovery-walkthrough.md:194-201 references/P4-compaction-recovery-walkthrough.md:306-319 references/P4-compaction-recovery-walkthrough.md:364-368 references/P4-compaction-recovery-walkthrough.md:430-444 references/P4-compaction-recovery-walkthrough.md:644-645 references/P4-compaction-recovery-walkthrough.md:645-663 references/P4-compaction-recovery-walkthrough.md:663-673 references/P4-compaction-recovery-walkthrough.md:714-729 references/P4-compaction-recovery-walkthrough.md:800-810 references/P4-compaction-recovery-walkthrough.md:413-417 references/P5-multi-instance-protocol.md:164-180 references/P5-multi-instance-protocol.md:331-344 references/P5-multi-instance-protocol.md:93 references/P5-multi-instance-protocol.md:102 references/P5-multi-instance-protocol.md:317 references/P5-multi-instance-protocol.md:364 references/P6-enforcement-setup.md:112 references/P6-enforcement-setup.md:116-135 references/P6-enforcement-setup.md:138 references/P6-enforcement-setup.md:140-154 references/P6-enforcement-setup.md:159 references/P6-enforcement-setup.md:167 references/P6-enforcement-setup.md:171-173 references/P6-enforcement-setup.md:227-270 references/P6-enforcement-setup.md:270-278 references/P6-enforcement-setup.md:286-295 references/P6-enforcement-setup.md:301-305 references/P6-enforcement-setup.md:345-370 references/P6-enforcement-setup.md:374-378 references/P6-enforcement-setup.md:378-430 references/P6-enforcement-setup.md:430-438 references/P6-enforcement-setup.md:444-447 references/P6-enforcement-setup.md:486 references/P6-enforcement-setup.md:489 references/P6-enforcement-setup.md:499 references/P6-enforcement-setup.md:501-504 references/P6-enforcement-setup.md:572-575 references/P6-enforcement-setup.md:652-659 references/P6-enforcement-setup.md:682-685 references/P6-enforcement-setup.md:748 references/P6-enforcement-setup.md:750 references/P6-enforcement-setup.md:753 references/P6-enforcement-setup.md:755 references/P6-enforcement-setup.md:757-760 references/P6-enforcement-setup.md:817-820 references/P7-validation-checklist.md:838-839 references/P7-validation-checklist.md:839-846 references/P8-complete-lifecycle-example.md:76-108 references/P8-complete-lifecycle-example.md:199-209 references/P8-complete-lifecycle-example.md:277-288 references/P8-complete-lifecycle-example.md:311-325 references/P8-complete-lifecycle-example.md:325-345 references/P8-complete-lifecycle-example.md:400-409 references/P8-complete-lifecycle-example.md:423-427 references/P8-complete-lifecycle-example.md:502-517 references/P8-complete-lifecycle-example.md:517-533 references/P8-complete-lifecycle-example.md:836-837 references/P8-complete-lifecycle-example.md:837-847 references/P8-complete-lifecycle-example.md:306-324 references/P8-complete-lifecycle-example.md:497-515 references/P8-complete-lifecycle-example.md:628-632 references/P9-test-agent-playbook.md:217-218 references/P9-test-agent-playbook.md:218-223 references/P9-test-agent-playbook.md:271-274 references/P9-test-agent-playbook.md:292-296 references/P9-test-agent-playbook.md:476-484 references/P9-test-agent-playbook.md:121 references/P9-test-agent-playbook.md:134-135 references/P9-test-agent-playbook.md:135 references/P9-test-agent-playbook.md:176-177 references/P9-test-agent-playbook.md:321-330 references/P9-test-agent-playbook.md:362-372 references/P9-test-agent-playbook.md:392-393 references/P9-test-agent-playbook.md:393 references/templates/issue-comment-format.md:52-53 references/templates/issue-comment-format.md:83-84 references/templates/issue-comment-format.md:84-89 SKILL.md:40 SKILL.md:41 SKILL.md:44 SKILL.md:45 SKILL.md:46 SKILL.md:47 SKILL.md:62 SKILL.md:66 SKILL.md:67 SKILL.md:68 SKILL.md:69 SKILL.md:70 SKILL.md:71 SKILL.md:127-133 SKILL.md:133-186 SKILL.md:186-194 SKILL.md:194 SKILL.md:204 SKILL.md:205 SKILL.md:206 SKILL.md:207 SKILL.md:210 SKILL.md:234-261 SKILL.md:261-267 SKILL.md:267-287 SKILL.md:287-307 SKILL.md:307-310 SKILL.md:310-322 SKILL.md:322-334 SKILL.md:334 SKILL.md:335-336 SKILL.md:336 SKILL.md:346-348 SKILL.md:348-392 SKILL.md:392-395 SKILL.md:395-400 SKILL.md:400-405 SKILL.md:405-407 SKILL.md:407-411 SKILL.md:411-420 SKILL.md:420-433 SKILL.md:433-437 SKILL.md:437-440 SKILL.md:440-447 SKILL.md:447-451 SKILL.md:451-453 SKILL.md:453-467 SKILL.md:467-473 SKILL.md:473-490 SKILL.md:490-494 SKILL.md:494-512 SKILL.md:512-518 SKILL.md:518 SKILL.md:519 SKILL.md:520 SKILL.md:525-537 SKILL.md:537-540 SKILL.md:540-552 SKILL.md:552-555 SKILL.md:555-564 SKILL.md:564-570 SKILL.md:570-573 SKILL.md:573-574 SKILL.md:574-580 SKILL.md:580-591 SKILL.md:591-599 SKILL.md:599-607 SKILL.md:607-614 SKILL.md:614-618 SKILL.md:618-620 SKILL.md:620-622 SKILL.md:622-626 SKILL.md:626-671 SKILL.md:671-677 SKILL.md:677-697 SKILL.md:697-737 SKILL.md:737-753 SKILL.md:753-755 SKILL.md:755-765 SKILL.md:765-818 SKILL.md:818-824 SKILL.md:824-861 SKILL.md:861-892 SKILL.md:892-894 SKILL.md:894-896 SKILL.md:896-929 SKILL.md:929-935 SKILL.md:935-961 SKILL.md:961-970 SKILL.md:970-976 SKILL.md:976-996 SKILL.md:996-1000 SKILL.md:1000-1001 SKILL.md:1001-1002 SKILL.md:1002-1003 SKILL.md:1003-1004 SKILL.md:1004-1005 SKILL.md:1005-1012 SKILL.md:1012-1043 SKILL.md:1043 SKILL.md:1044-1045 SKILL.md:1045-1049 SKILL.md:1049-1071 SKILL.md:1071-1078 SKILL.md:1078-1088 SKILL.md:1088-1089 SKILL.md:1089-1090 SKILL.md:1090-1094 SKILL.md:1094-1097 SKILL.md:1097-1103 SKILL.md:1103-1128 SKILL.md:1128-1134 SKILL.md:1134-1135 SKILL.md:1135-1136 SKILL.md:1136-1137 SKILL.md:1137-1138 SKILL.md:1138 SKILL.md:1139-1140 SKILL.md:1140 SKILL.md:1141 SKILL.md:1142-1143 SKILL.md:1143-1159 SKILL.md:1159-1160 SKILL.md:1160-1161 SKILL.md:1161 SKILL.md:1162-1163 SKILL.md:1163-1164 SKILL.md:1164-1169 SKILL.md:1169-1180 SKILL.md:1180-1185 SKILL.md:1185-1190 SKILL.md:1190-1209 SKILL.md:1209-1212 SKILL.md:1212-1240 SKILL.md:1240-1243 SKILL.md:1243-1279 SKILL.md:1279-1282 SKILL.md:1282-1299 SKILL.md:1299-1302 SKILL.md:1302-1335 SKILL.md:1335-1343 SKILL.md:1343-1344 SKILL.md:1344-1345 SKILL.md:1345-1346 SKILL.md:1346-1347 SKILL.md:1347 SKILL.md:1348-1349 SKILL.md:1349-1350 SKILL.md:1350-1357 SKILL.md:1357-1360 SKILL.md:1360-1363 SKILL.md:1363 SKILL.md:1364 SKILL.md:1365 SKILL.md:1368-1372 SKILL.md:1372-1384 SKILL.md:1384-1385 SKILL.md:1385-1386 SKILL.md:1386-1387 SKILL.md:1387-1388 SKILL.md:1388-1394 SKILL.md:1394-1395 SKILL.md:1395-1396 SKILL.md:1396-1397 SKILL.md:1397-1403 SKILL.md:1403-1404 SKILL.md:1404-1405 SKILL.md:1405-1406 SKILL.md:1406-1407 SKILL.md:1407 SKILL.md:1408-1414 SKILL.md:1414-1415 SKILL.md:1415-1416 SKILL.md:1416-1422 SKILL.md:1422-1423 SKILL.md:1423-1424 SKILL.md:1424-1425 SKILL.md:1425-1426 SKILL.md:1426-1427 SKILL.md:1427-1428 SKILL.md:1428-1434 SKILL.md:1434-1435 SKILL.md:1435 SKILL.md:1441-1479 SKILL.md:1479-1485 SKILL.md:1485-1539 SKILL.md:1539-1597 SKILL.md:1597-1614 SKILL.md:1614-1635 SKILL.md:1635-1648 SKILL.md:1648-1654 SKILL.md:1654-1660 SKILL.md:1660-1661 SKILL.md:1661-1662 SKILL.md:1662-1666 SKILL.md:1666-1692 SKILL.md:1692-1698 SKILL.md:1698-1699 SKILL.md:1699-1700 SKILL.md:1700-1701 SKILL.md:1701-1702 SKILL.md:1702-1703 SKILL.md:1703-1709 SKILL.md:1709-1713 SKILL.md:1713-1721 SKILL.md:1721-1726 SKILL.md:1726-1727 SKILL.md:1727-1734 SKILL.md:1734-1753 SKILL.md:1753-1759 SKILL.md:1759-1775 SKILL.md:1775-1812 SKILL.md:1812-1820 SKILL.md:1820-1841 SKILL.md:1841-1843 SKILL.md:1843-1875 SKILL.md:1875-1883 SKILL.md:1883-1884 SKILL.md:1884-1885 SKILL.md:1885-1888 SKILL.md:1888-1895 SKILL.md:1895-1905 SKILL.md:1905-1912 SKILL.md:1912-1918 SKILL.md:1918-1919 SKILL.md:1919-1920 SKILL.md:1920-1926 SKILL.md:1926-1932 SKILL.md:1932-1961 SKILL.md:1961-1972 SKILL.md:1972-1984 SKILL.md:1984-1985 SKILL.md:1985-1986 SKILL.md:1986-1987 SKILL.md:1987-1988 SKILL.md:1988-1989 SKILL.md:1989-1990 SKILL.md:1990-1996 SKILL.md:1996-1997 SKILL.md:1997-1998 SKILL.md:1998-2004 SKILL.md:2004-2005 SKILL.md:2005-2006 SKILL.md:2006-2007 SKILL.md:2007-2021 SKILL.md:2021-2033 SKILL.md:2033-2039 SKILL.md:2039-2040 SKILL.md:2040-2041 SKILL.md:2041-2042 SKILL.md:2042-2043 SKILL.md:2043-2044 SKILL.md:2044-2045 SKILL.md:2045-2046 SKILL.md:2046-2047 SKILL.md:2047-2048 SKILL.md:2048-2049 SKILL.md:2049-2050 SKILL.md:2050-2051 SKILL.md:2051 SKILL.md:2052-2058 SKILL.md:2058-2061 SKILL.md:2061-2083 SKILL.md:2083-2086 SKILL.md:2086-2092 SKILL.md:2092-2093 SKILL.md:2093-2094 SKILL.md:2094-2095 SKILL.md:2095-2096 SKILL.md:2096-2097 SKILL.md:2097-2098 SKILL.md:2098-2099 SKILL.md:2099-2100 SKILL.md:2100-2101 SKILL.md:2101-2102 SKILL.md:2102-2108 SKILL.md:2108-2109 SKILL.md:2109-2110 SKILL.md:2110-2111 SKILL.md:2111-2115 SKILL.md:2115-2126 SKILL.md:2126-2136 SKILL.md:2136-2146 SKILL.md:2146-2152 SKILL.md:2152-2160 SKILL.md:2160-2166 SKILL.md:2166-2171 SKILL.md:2171-2177 SKILL.md:2177-2190 SKILL.md:2190-2196 SKILL.md:2196-2201 SKILL.md:2201-2207 SKILL.md:2207 SKILL.md:2208-2209 SKILL.md:2209-2210 SKILL.md:2210-2211 SKILL.md:2211-2212 SKILL.md:2212-2218 SKILL.md:2218-2226 SKILL.md:2226-2262 SKILL.md:2262-2265 SKILL.md:2265-2267 SKILL.md:2267-2269 SKILL.md:2269-2517 SKILL.md:2517-2527 SKILL.md:2527-2530 SKILL.md:2530-2534 SKILL.md:2534-2544 SKILL.md:2544-2546 SKILL.md:2546-2561 SKILL.md:2561-2568 SKILL.md:2568-2585 SKILL.md:2585-2586 SKILL.md:2586-2587 SKILL.md:2587-2588 SKILL.md:2588-2589 SKILL.md:353 SKILL.md:475 SKILL.md:699 SKILL.md:775 SKILL.md:805 SKILL.md:833 SKILL.md:835 SKILL.md:836 SKILL.md:837 SKILL.md:1872 SKILL.md:348-392 SKILL.md:473-490 SKILL.md:697-737 SKILL.md:765-818 SKILL.md:824-861 SKILL.md:1843-1875 SKILL.md:349 SKILL.md:1442
📁 Filesystem access (59)
references/P1-task-agent-playbook.md:283 references/P1-task-agent-playbook.md:458 references/P1-task-agent-playbook.md:459 references/P1-task-agent-playbook.md:460 references/P5-multi-instance-protocol.md:870 references/P6-enforcement-setup.md:116 references/P6-enforcement-setup.md:171 references/P6-enforcement-setup.md:286 references/P6-enforcement-setup.md:38 references/P6-enforcement-setup.md:39 references/P6-enforcement-setup.md:40 references/P6-enforcement-setup.md:41 references/P6-enforcement-setup.md:42 references/P6-enforcement-setup.md:48 references/P6-enforcement-setup.md:49 references/P6-enforcement-setup.md:50 references/P6-enforcement-setup.md:51 references/P6-enforcement-setup.md:52 references/P6-enforcement-setup.md:53 references/P6-enforcement-setup.md:56 references/P6-enforcement-setup.md:57 references/P6-enforcement-setup.md:58 references/P6-enforcement-setup.md:59 references/P6-enforcement-setup.md:63 references/P6-enforcement-setup.md:65 references/P6-enforcement-setup.md:66 references/templates/issue-comment-format.md:10 references/templates/issue-comment-format.md:11 references/templates/issue-comment-format.md:12 references/templates/issue-comment-format.md:13 references/templates/issue-comment-format.md:14 references/templates/issue-comment-format.md:15 references/templates/issue-comment-format.md:16 references/templates/issue-comment-format.md:17 references/templates/issue-comment-format.md:18 references/templates/issue-comment-format.md:19 references/templates/issue-comment-format.md:20 references/templates/issue-comment-format.md:58 references/templates/issue-comment-format.md:73 SKILL.md:451 SKILL.md:457 SKILL.md:460 SKILL.md:463 SKILL.md:480 SKILL.md:486 SKILL.md:570 SKILL.md:702 SKILL.md:2060 SKILL.md:2111 SKILL.md:2159 SKILL.md:2181 SKILL.md:2185 SKILL.md:2188 SKILL.md:2262 SKILL.md:26 SKILL.md:26 SKILL.md:589 SKILL.md:1454 SKILL.md:1458
🔑 Env variables (14)
references/P2-epic-coordinator-playbook.md:416 references/P4-compaction-recovery-walkthrough.md:213 references/P4-compaction-recovery-walkthrough.md:225 references/P4-compaction-recovery-walkthrough.md:230 references/P4-compaction-recovery-walkthrough.md:232 references/P4-compaction-recovery-walkthrough.md:243 references/P4-compaction-recovery-walkthrough.md:251 references/P4-compaction-recovery-walkthrough.md:295 references/P4-compaction-recovery-walkthrough.md:314 references/P4-compaction-recovery-walkthrough.md:450 references/P5-multi-instance-protocol.md:257 references/P5-multi-instance-protocol.md:265 references/P5-multi-instance-protocol.md:282 references/P5-multi-instance-protocol.md:297
🌐 Network access (4)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/emasoft-github-elements-tracking/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/emasoft-github-elements-tracking?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/emasoft-github-elements-tracking?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/emasoft-github-elements-tracking/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/emasoft-github-elements-tracking.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
Emasoft. (2026). github-elements-tracking security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/emasoft-github-elements-tracking/audits/9BibTeX citation
@techreport{emasoft-emasoft-github-elements-tracking-2026,
author = {Emasoft},
title = {github-elements-tracking security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/emasoft-github-elements-tracking/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "github-elements-tracking security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "Emasoft"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/emasoft-github-elements-tracking/audits/9"
identifiers:
- type: other
value: "skillstore:emasoft-github-elements-tracking:audit:9"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 50
Architecture
85
Maintainability
85
Content
70
Community
70
Spec Compliance
What You Can Build
Recover Long Tasks
Resume work after context loss by reading issue checkpoints and phase status.
Coordinate Agent Phases
Separate development, testing, and review responsibilities across GitHub issue threads.
Audit Feature History
Trace claims, decisions, test results, and review outcomes from issue comments.
Try These Prompts
Start Tracking
Create a GitHub issue workflow for this feature. Define the phase, scope, acceptance criteria, and first checkpoint.
Claim Work
Claim issue <number>, identify the active phase, declare the files in scope, and post a starting checkpoint.
Recover Session
Read issue <number> and reconstruct the current state, blockers, completed work, and next action.
Coordinate Epic
Review the epic issue, map active DEV, TEST, and REVIEW threads, find conflicts, and propose the next wave plan.
Best Practices
- Confirm repository, issue number, and phase before running GitHub CLI commands.
- Post short checkpoints at meaningful state changes, not every minor edit.
- Review automation snippets and token permissions before installing enforcement workflows.
Avoid
- Do not merge branches before a recorded REVIEW pass.
- Do not treat issue comments as optional when they hold project memory.
- Do not run setup scripts from the skill without inspecting the commands first.
Frequently Asked Questions
Does this skill require GitHub?
Yes. The workflow depends on GitHub Issues, labels, comments, and often the GitHub CLI.
Can it run without SERENA MCP?
Yes, but large document storage and project memory synchronization may be limited.
Does it create code changes by itself?
No. It provides protocols and command examples that an assistant may follow during development work.
Is the enforcement setup automatic?
No. The repository owner must review and install any GitHub Actions snippets.
Who should use this skill?
Use it for long-running development work that needs durable state and phase tracking.
What should be reviewed before use?
Review shell commands, GitHub token scopes, worktree paths, and external MCP installation steps.
Developer Details
Author
EmasoftLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Repository
https://github.com/Emasoft/ghe-marketplace/tree/main/plugins/ghe/skills/github-elements-trackingRef
30c73eac2afe762f6aa9c4553158769369d47351
Maintenance freshness
7/18/2026
Usage
4 downloads · 224 views