📦
jira-workflow
38使用核准關卡管理 Jira 工作流程
Jira 更新經常與開發工作脫節，並需要手動追蹤處理。這項技能可協助 Claude、Codex 或 Claude Code 提出故事、請求核准、建立議題，並同步工作流程狀態。
效率 查看
技能 jira-safe
📦
jira-safe
內容修訂 r1 高風險 ⚙️ 外部命令🌐 網路存取🔑 環境變數📁 檔案系統存取
整理 SAFe Jira 工作流程
在 Jira 中進行 SAFe 規劃時，很難讓 epics、stories 和 subtasks 保持一致。此技能提供結構化範本與腳本，用於建立 Jira issue 和更新工作流程。
支援: Claude Codex Code(CC)
安裝前請停止並請求確認。
請審查安裝計畫，並在變更檔案前取得使用者明確同意。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "jira-safe" from https://skillstore.io/skills/01000001-01001110-jira-safe.md and its manifest at https://skillstore.io/api/skills/01000001-01001110-jira-safe/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「jira-safe」。 為團隊管理的 Jira 專案建立一則密碼重設 story。
預期結果:
一則包含角色、目標、效益、Given-When-Then 條件、完成定義和建議 subtasks 的 SAFe story。
正在使用「jira-safe」。 為行銷助理產品規劃 MVP backlog。
預期結果:
一份 epic 大綱，包含商業成果、成功指標、分組 stories、實作 subtasks 和 Jira linking 指引。
正在使用「jira-safe」。 在實作後將 SCRUM-100 從 To Do 移至 Done。
預期結果:
一份轉換檢查清單，會查詢可用的 Jira transitions、選擇相符狀態、新增完成備註，並確認更新。
安全審計
高風險v11 • 2026/7/7 開啟版本化報告
The many command-execution and certificate findings are mostly false positives caused by Markdown backticks, JavaScript template literals, and Jira issue key fields. Real risks remain because the skill and scripts use Jira credentials, perform authenticated network writes, and include destructive bulk-delete guidance.
8
已掃描檔案
4,225
分析行數
78
複核項目
0
已忽略的誤報
已確認的安全問題 (16)
高
Environment file access
const JIRA_EMAIL = process.env.JIRA_EMAIL;
The code reads JIRA_EMAIL as part of the Basic authentication credential pair. It is expected but still sensitive account-identifying data.
高
Environment file access
const JIRA_API_TOKEN = process.env.JIRA_API_TOKEN;
The code reads JIRA_API_TOKEN, a secret used to build Basic authentication for Jira API calls. Exposure or misuse of this token would affect the Jira account.
高
Environment file access
const JIRA_EMAIL = process.env.JIRA_EMAIL;
The code reads JIRA_EMAIL as part of the Basic authentication credential pair. It is expected but still sensitive account-identifying data.
高
Environment file access
const JIRA_API_TOKEN = process.env.JIRA_API_TOKEN;
The code reads JIRA_API_TOKEN, a secret used to build Basic authentication for Jira API calls. Exposure or misuse of this token would affect the Jira account.
高
Environment file access
# Load .env file from jira root (two levels up from scripts/)
The Python helper loads a parent .env file that can contain Jira credentials. Reading local environment files is a real sensitive-file access pattern.
高
Environment file access
env_path = Path(__file__).parent.parent.parent / '.env'
The Python helper loads a parent .env file that can contain Jira credentials. Reading local environment files is a real sensitive-file access pattern.
高
Environment file access
const JIRA_EMAIL = process.env.JIRA_EMAIL;
The code reads JIRA_EMAIL as part of the Basic authentication credential pair. It is expected but still sensitive account-identifying data.
高
Environment file access
const JIRA_API_TOKEN = process.env.JIRA_API_TOKEN;
The code reads JIRA_API_TOKEN, a secret used to build Basic authentication for Jira API calls. Exposure or misuse of this token would affect the Jira account.
顯示全部 16 條已確認問題
高
Environment file access
# Load .env file from jira root (two levels up from scripts/)
The Python helper loads a parent .env file that can contain Jira credentials. Reading local environment files is a real sensitive-file access pattern.
高
Environment file access
env_path = Path(__file__).parent.parent.parent / '.env'
The Python helper loads a parent .env file that can contain Jira credentials. Reading local environment files is a real sensitive-file access pattern.
高
Environment file access
const JIRA_EMAIL = process.env.JIRA_EMAIL;
The code reads JIRA_EMAIL as part of the Basic authentication credential pair. It is expected but still sensitive account-identifying data.
高
Environment file access
const JIRA_API_TOKEN = process.env.JIRA_API_TOKEN;
The code reads JIRA_API_TOKEN, a secret used to build Basic authentication for Jira API calls. Exposure or misuse of this token would affect the Jira account.
高
Environment file access
# Load .env file from jira root (two levels up from scripts/)
The Python helper loads a parent .env file that can contain Jira credentials. Reading local environment files is a real sensitive-file access pattern.
高
Environment file access
env_path = Path(__file__).parent.parent.parent / '.env'
The Python helper loads a parent .env file that can contain Jira credentials. Reading local environment files is a real sensitive-file access pattern.
高
Destructive Jira Bulk Delete Helper
The skill documents a helper that searches all issues in a project and deletes each issue with deleteSubtasks=true. This can remove a large Jira backlog if copied or executed with a privileged token.
Lines 341-355 show a bulk delete routine that searches Jira issues and sends DELETE requests. The behavior is explicit and destructive, though it is documented rather than hidden.
中
Bulk Jira Issue Creation Without Interactive Confirmation
Executable scripts create epics, stories, and subtasks directly when run. They do not implement a dry-run or interactive confirmation step before writing to Jira.
The cited code calls createIssue for epics, stories, and subtasks in loops. No confirmation gate or dry-run branch is present in those execution paths.
能力複核項目 (78)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
高
Fetch API call
await fetch(`${JIRA_URL}/rest/api/3/issue/${issue.key}?deleteSubtasks=true`, {
This Jira API request performs DELETE against issue URLs with deleteSubtasks=true. It can remove project issues if executed with a privileged token.
中
Environment variable access (dot notation)
const JIRA_EMAIL = process.env.JIRA_EMAIL;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
中
Environment variable access (dot notation)
const JIRA_API_TOKEN = process.env.JIRA_API_TOKEN;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
中
Environment variable object
const JIRA_EMAIL = process.env.JIRA_EMAIL;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
中
Environment variable object
const JIRA_API_TOKEN = process.env.JIRA_API_TOKEN;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
中
Fetch API call
const response = await fetch(url, {
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
中
Fetch API call
const response = await fetch(url, {
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
中
Fetch API call
const response = await fetch(url, { headers });
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
中
Environment variable access (dot notation)
const JIRA_EMAIL = process.env.JIRA_EMAIL;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
中
Environment variable access (dot notation)
const JIRA_API_TOKEN = process.env.JIRA_API_TOKEN;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
中
Environment variable object
const JIRA_EMAIL = process.env.JIRA_EMAIL;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
中
Environment variable object
const JIRA_API_TOKEN = process.env.JIRA_API_TOKEN;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
中
HTTP client library
def make_request(method, path, data=None):
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
中
HTTP client library
return make_request('POST', '/issue', {'fields': fields})
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
中
HTTP client library
return make_request('POST', '/issue', {'fields': fields})
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
中
HTTP client library
return make_request('GET', f'/issue/{issue_key}?fields=summary,issuetype')
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
中
Python HTTP libraries
from urllib.request import Request, urlopen
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
中
Python environment access
os.environ.setdefault(key.strip(), value.strip())
This line loads values from a .env file into process environment variables. The surrounding block is used to provide Jira credentials to API calls.
中
Python environment access
JIRA_EMAIL = os.environ.get('JIRA_EMAIL')
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
中
Python environment access
JIRA_API_TOKEN = os.environ.get('JIRA_API_TOKEN')
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
中
Fetch API call
const response = await fetch(url, { ...options, headers });
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
中
Environment variable access (dot notation)
const JIRA_EMAIL = process.env.JIRA_EMAIL;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
中
Environment variable access (dot notation)
const JIRA_API_TOKEN = process.env.JIRA_API_TOKEN;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
中
Environment variable object
const JIRA_EMAIL = process.env.JIRA_EMAIL;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
中
Environment variable object
const JIRA_API_TOKEN = process.env.JIRA_API_TOKEN;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
中
HTTP client library
def jira_request(path, method='GET', data=None):
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
中
HTTP client library
return jira_request('/issue', method='POST', data={'fields': fields})
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
中
Python HTTP libraries
from urllib.request import Request, urlopen
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
中
Python environment access
os.environ.setdefault(key.strip(), value.strip())
This line loads values from a .env file into process environment variables. The surrounding block is used to provide Jira credentials to API calls.
中
Python environment access
JIRA_EMAIL = os.environ.get('JIRA_EMAIL')
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
中
Python environment access
JIRA_API_TOKEN = os.environ.get('JIRA_API_TOKEN')
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
中
Fetch API call
const response = await fetch(`${JIRA_BASE_URL}/rest/api/3/issue`, {
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
中
Environment variable access (dot notation)
const JIRA_EMAIL = process.env.JIRA_EMAIL;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
中
Environment variable access (dot notation)
const JIRA_API_TOKEN = process.env.JIRA_API_TOKEN;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
中
Environment variable object
const JIRA_EMAIL = process.env.JIRA_EMAIL;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
中
Environment variable object
const JIRA_API_TOKEN = process.env.JIRA_API_TOKEN;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
中
HTTP client library
def make_request(method, path, data=None):
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
中
HTTP client library
return make_request('POST', '/issue', {'fields': fields})
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
中
Python HTTP libraries
from urllib.request import Request, urlopen
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
中
Python environment access
os.environ.setdefault(key.strip(), value.strip())
This line loads values from a .env file into process environment variables. The surrounding block is used to provide Jira credentials to API calls.
中
Python environment access
JIRA_EMAIL = os.environ.get('JIRA_EMAIL')
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
中
Python environment access
JIRA_API_TOKEN = os.environ.get('JIRA_API_TOKEN')
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
低
Fetch API call
const response = await fetch(`${JIRA_BASE_URL}/rest/api/3/issue`, {
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
低
Fetch API call
const response = await fetch(`${JIRA_BASE_URL}/rest/api/3/issue`, {
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
低
Fetch API call
const response = await fetch(
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
低
Fetch API call
const response = await fetch(
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
低
Fetch API call
const response = await fetch(
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
低
Fetch API call
const response = await fetch(
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
低
Environment variable access (dot notation)
const JIRA_BASE_URL = process.env.JIRA_BASE_URL;
The code reads the Jira base URL from the environment and later sends authenticated requests to that destination. This is configuration, but it affects credential exposure boundaries.
低
Environment variable access (dot notation)
const PROJECT_KEY = process.env.JIRA_PROJECT_KEY;
The project key is not secret, but it controls which Jira project receives write operations. Misconfiguration can direct automation to the wrong project.
低
Environment variable object
const JIRA_BASE_URL = process.env.JIRA_BASE_URL;
The code reads the Jira base URL from the environment and later sends authenticated requests to that destination. This is configuration, but it affects credential exposure boundaries.
低
Environment variable object
const PROJECT_KEY = process.env.JIRA_PROJECT_KEY;
The project key is not secret, but it controls which Jira project receives write operations. Misconfiguration can direct automation to the wrong project.
低
Environment variable access (dot notation)
const JIRA_BASE_URL = process.env.JIRA_BASE_URL;
The code reads the Jira base URL from the environment and later sends authenticated requests to that destination. This is configuration, but it affects credential exposure boundaries.
低
Environment variable access (dot notation)
const PROJECT_KEY = process.env.JIRA_PROJECT_KEY || 'SCRUM';
The project key is not secret, but it controls which Jira project receives write operations. Misconfiguration can direct automation to the wrong project.
低
Environment variable object
const JIRA_BASE_URL = process.env.JIRA_BASE_URL;
The code reads the Jira base URL from the environment and later sends authenticated requests to that destination. This is configuration, but it affects credential exposure boundaries.
低
Environment variable object
const PROJECT_KEY = process.env.JIRA_PROJECT_KEY || 'SCRUM';
The project key is not secret, but it controls which Jira project receives write operations. Misconfiguration can direct automation to the wrong project.
低
Python environment access
JIRA_BASE_URL = os.environ.get('JIRA_BASE_URL')
The code reads the Jira base URL from the environment and later sends authenticated requests to that destination. This is configuration, but it affects credential exposure boundaries.
低
Python environment access
PROJECT_KEY = os.environ.get('JIRA_PROJECT_KEY', 'SCRUM')
The project key is not secret, but it controls which Jira project receives write operations. Misconfiguration can direct automation to the wrong project.
低
Environment variable access (dot notation)
const JIRA_BASE_URL = process.env.JIRA_BASE_URL;
The code reads the Jira base URL from the environment and later sends authenticated requests to that destination. This is configuration, but it affects credential exposure boundaries.
低
Environment variable access (dot notation)
const PROJECT_KEY = process.env.JIRA_PROJECT_KEY || 'SCRUM';
The project key is not secret, but it controls which Jira project receives write operations. Misconfiguration can direct automation to the wrong project.
低
Environment variable object
const JIRA_BASE_URL = process.env.JIRA_BASE_URL;
The code reads the Jira base URL from the environment and later sends authenticated requests to that destination. This is configuration, but it affects credential exposure boundaries.
低
Environment variable object
const PROJECT_KEY = process.env.JIRA_PROJECT_KEY || 'SCRUM';
The project key is not secret, but it controls which Jira project receives write operations. Misconfiguration can direct automation to the wrong project.
低
Python environment access
JIRA_BASE_URL = os.environ.get('JIRA_BASE_URL')
The code reads the Jira base URL from the environment and later sends authenticated requests to that destination. This is configuration, but it affects credential exposure boundaries.
低
Python environment access
PROJECT_KEY = os.environ.get('JIRA_PROJECT_KEY', 'SCRUM')
The project key is not secret, but it controls which Jira project receives write operations. Misconfiguration can direct automation to the wrong project.
低
Environment variable access (dot notation)
const JIRA_BASE_URL = process.env.JIRA_BASE_URL;
The code reads the Jira base URL from the environment and later sends authenticated requests to that destination. This is configuration, but it affects credential exposure boundaries.
低
Environment variable access (dot notation)
const PROJECT_KEY = process.env.JIRA_PROJECT_KEY || 'SCRUM';
The project key is not secret, but it controls which Jira project receives write operations. Misconfiguration can direct automation to the wrong project.
低
Environment variable object
const JIRA_BASE_URL = process.env.JIRA_BASE_URL;
The code reads the Jira base URL from the environment and later sends authenticated requests to that destination. This is configuration, but it affects credential exposure boundaries.
低
Environment variable object
const PROJECT_KEY = process.env.JIRA_PROJECT_KEY || 'SCRUM';
The project key is not secret, but it controls which Jira project receives write operations. Misconfiguration can direct automation to the wrong project.
低
Python environment access
JIRA_BASE_URL = os.environ.get('JIRA_BASE_URL')
The code reads the Jira base URL from the environment and later sends authenticated requests to that destination. This is configuration, but it affects credential exposure boundaries.
低
Python environment access
PROJECT_KEY = os.environ.get('JIRA_PROJECT_KEY', 'SCRUM')
The project key is not secret, but it controls which Jira project receives write operations. Misconfiguration can direct automation to the wrong project.
低
Fetch API call
const projectInfo = await fetch(`${JIRA_URL}/rest/api/3/project/${PROJECT_KEY}`, { headers });
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
低
Fetch API call
const epicResponse = await fetch(`${JIRA_URL}/rest/api/3/issue`, {
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
低
Fetch API call
const storyResponse = await fetch(`${JIRA_URL}/rest/api/3/issue`, {
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
低
Fetch API call
const storyResponse = await fetch(`${JIRA_URL}/rest/api/3/issue`, {
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
低
Fetch API call
const subtaskResponse = await fetch(`${JIRA_URL}/rest/api/3/issue`, {
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
低
Fetch API call
const response = await fetch(`${JIRA_URL}/rest/api/3/field`, { headers });
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
低
Fetch API call
const searchResponse = await fetch(
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
低
Fetch API call
const response = await fetch(url, { ...options, headers });
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
風險因素
⚙️ 外部命令 (207)
jira-workflow/SKILL.md:11 jira-workflow/SKILL.md:12 jira-workflow/SKILL.md:13 jira-workflow/SKILL.md:14 jira-workflow/SKILL.md:15 jira-workflow/SKILL.md:17 jira-workflow/SKILL.md:31-37 jira-workflow/SKILL.md:37-41 jira-workflow/SKILL.md:41-42 jira-workflow/SKILL.md:42-50 jira-workflow/SKILL.md:50-64 jira-workflow/SKILL.md:64-74 jira-workflow/SKILL.md:74-77 jira-workflow/SKILL.md:77-79 jira-workflow/SKILL.md:79-101 jira-workflow/SKILL.md:101-109 jira-workflow/SKILL.md:109-137 jira-workflow/SKILL.md:137-145 jira-workflow/SKILL.md:145-151 jira-workflow/SKILL.md:151-153 jira-workflow/SKILL.md:153-174 jira-workflow/SKILL.md:174-182 jira-workflow/SKILL.md:182-186 jira-workflow/SKILL.md:186-209 jira-workflow/SKILL.md:209-217 jira-workflow/SKILL.md:217-226 jira-workflow/SKILL.md:226-230 jira-workflow/SKILL.md:230-256 jira-workflow/SKILL.md:256-261 jira-workflow/SKILL.md:261-262 jira-workflow/SKILL.md:262-263 jira-workflow/SKILL.md:263-278 jira-workflow/SKILL.md:278-300 jira-workflow/SKILL.md:300-308 jira-workflow/SKILL.md:308-311 jira-workflow/SKILL.md:311-316 jira-workflow/SKILL.md:316-322 jira-workflow/SKILL.md:322-326 jira-workflow/SKILL.md:326-338 jira-workflow/SKILL.md:338-339 jira-workflow/SKILL.md:339-340 jira-workflow/SKILL.md:340-345 jira-workflow/SKILL.md:345-355 jira-workflow/SKILL.md:355-358 jira-workflow/SKILL.md:358-361 jira-workflow/SKILL.md:361-365 jira-workflow/SKILL.md:365-369 jira-workflow/SKILL.md:369-375 jira-workflow/SKILL.md:375-381 jira-workflow/SKILL.md:381-387 jira-workflow/SKILL.md:387-389 jira-workflow/SKILL.md:389-397 jira-workflow/SKILL.md:397-413 jira-workflow/SKILL.md:413-422 jira-workflow/SKILL.md:422-425 jira-workflow/SKILL.md:425-428 jira-workflow/SKILL.md:428-432 jira-workflow/SKILL.md:432-436 jira-workflow/SKILL.md:436-475 jira-workflow/SKILL.md:475-485 jira-workflow/SKILL.md:485-493 jira-workflow/SKILL.md:493-508 jira-workflow/SKILL.md:508-528 jira-workflow/SKILL.md:528-538 jira-workflow/SKILL.md:538-551 jira-workflow/SKILL.md:551-555 jira-workflow/SKILL.md:555-580 jira-workflow/SKILL.md:580-604 jira-workflow/SKILL.md:604-605 jira-workflow/SKILL.md:605-606 jira-workflow/SKILL.md:606-607 jira-workflow/SKILL.md:607-608 jira-workflow/SKILL.md:608-609 jira-workflow/SKILL.md:609-610 jira-workflow/SKILL.md:610-611 jira-workflow/SKILL.md:611-623 jira-workflow/SKILL.md:623-628 jira-workflow/SKILL.md:628-647 jira-workflow/SKILL.md:647-657 jira-workflow/SKILL.md:657-665 jira-workflow/SKILL.md:665-669 jira-workflow/SKILL.md:669-683 jira-workflow/SKILL.md:683-689 jira-workflow/SKILL.md:689 jira-workflow/SKILL.md:690 jira-workflow/SKILL.md:691 jira-workflow/SKILL.md:692 scripts/add-subtasks.mjs:20 scripts/add-subtasks.mjs:23 scripts/add-subtasks.mjs:34 scripts/add-subtasks.mjs:52 scripts/add-subtasks.mjs:60 scripts/add-subtasks.mjs:80 scripts/add-subtasks.mjs:88 scripts/add-subtasks.mjs:108 scripts/add-subtasks.mjs:119 scripts/add-subtasks.mjs:125 scripts/add-subtasks.mjs:128 scripts/add-subtasks.mjs:137 scripts/add-subtasks.mjs:138 scripts/add-subtasks.mjs:139 scripts/add-subtasks.mjs:140 scripts/add-subtasks.mjs:152 scripts/add-subtasks.mjs:156 scripts/add-subtasks.mjs:160 scripts/add-subtasks.mjs:161 scripts/add-subtasks.mjs:165 scripts/add-subtasks.mjs:169 scripts/add-subtasks.mjs:172 scripts/add-subtasks.mjs:181 scripts/add-subtasks.mjs:182 scripts/add-subtasks.mjs:183 scripts/add-subtasks.mjs:184 scripts/create-mvp.mjs:18 scripts/create-mvp.mjs:21 scripts/create-mvp.mjs:31 scripts/create-mvp.mjs:36 scripts/create-mvp.mjs:729 scripts/create-mvp.mjs:730 scripts/create-mvp.mjs:732 scripts/create-mvp.mjs:760 scripts/create-mvp.mjs:761 scripts/create-mvp.mjs:776 scripts/create-mvp.mjs:780 scripts/create-mvp.mjs:789 scripts/create-mvp.mjs:790 scripts/create-mvp.mjs:799 scripts/create-mvp.mjs:800 scripts/create-mvp.mjs:801 scripts/create-mvp.mjs:804 scripts/create-mvp.mjs:805 scripts/create-mvp.mjs:816 scripts/create-mvp.mjs:822 scripts/create-mvp.mjs:823 scripts/create-mvp.mjs:824 scripts/create-two-level.mjs:19 scripts/create-two-level.mjs:21 scripts/create-two-level.mjs:61 scripts/create-two-level.mjs:69 scripts/create-two-level.mjs:486 scripts/create-two-level.mjs:497 scripts/create-two-level.mjs:514 scripts/create-two-level.mjs:530 scripts/create-two-level.mjs:533 scripts/create-two-level.mjs:541 scripts/create-two-level.mjs:547 scripts/create-two-level.mjs:555 scripts/create-two-level.mjs:556 scripts/create-two-level.mjs:557 scripts/create-two-level.mjs:561 scripts/create-two-level.mjs:563 scripts/create-two-level.mjs:567 scripts/create-two-level.mjs:568 SKILL.md:24 SKILL.md:25 SKILL.md:26 SKILL.md:27 SKILL.md:30-31 SKILL.md:31-34 SKILL.md:34-38 SKILL.md:38-44 SKILL.md:44-50 SKILL.md:50-98 SKILL.md:98-102 SKILL.md:102-189 SKILL.md:189-193 SKILL.md:193-205 SKILL.md:205-211 SKILL.md:211-214 SKILL.md:214 SKILL.md:220-228 SKILL.md:228-232 SKILL.md:232-242 SKILL.md:242-250 SKILL.md:250-256 SKILL.md:256-264 SKILL.md:264-268 SKILL.md:268-271 SKILL.md:271 SKILL.md:284-291 SKILL.md:291-299 SKILL.md:299-321 SKILL.md:321-327 SKILL.md:327-329 SKILL.md:329-339 SKILL.md:339-343 SKILL.md:343-346 SKILL.md:346-348 SKILL.md:348-355 SKILL.md:355-359 SKILL.md:359-365 SKILL.md:365-370 SKILL.md:370-371 SKILL.md:371-382 SKILL.md:382-386 SKILL.md:386-389 SKILL.md:389-395 SKILL.md:395-401 SKILL.md:401-402 SKILL.md:402-409 SKILL.md:409-410 SKILL.md:410-417 SKILL.md:417-418 SKILL.md:418-419 SKILL.md:419-431 SKILL.md:431-437 SKILL.md:437-443
🌐 網路存取 (39)
jira-workflow/SKILL.md:174 jira-workflow/SKILL.md:209 jira-workflow/SKILL.md:310 jira-workflow/SKILL.md:344 jira-workflow/SKILL.md:412 jira-workflow/SKILL.md:474 jira-workflow/SKILL.md:34 jira-workflow/SKILL.md:698 jira-workflow/SKILL.md:699 jira-workflow/SKILL.md:700 jira-workflow/SKILL.md:701 scripts/add-subtasks.mjs:44 scripts/add-subtasks.mjs:72 scripts/add-subtasks.mjs:89 scripts/add-subtasks.py:61 scripts/add-subtasks.py:86 scripts/add-subtasks.py:100 scripts/add-subtasks.py:106 scripts/add-subtasks.py:21 scripts/create-mvp.mjs:32 scripts/create-mvp.py:62 scripts/create-mvp.py:122 scripts/create-mvp.py:18 scripts/create-two-level.mjs:61 scripts/create-two-level.py:54 scripts/create-two-level.py:110 scripts/create-two-level.py:14 SKILL.md:31 SKILL.md:220 SKILL.md:242 SKILL.md:284 SKILL.md:299 SKILL.md:329 SKILL.md:347 SKILL.md:355 SKILL.md:433 SKILL.md:447 SKILL.md:448 SKILL.md:449
🔑 環境變數 (47)
jira-workflow/SKILL.md:146 jira-workflow/SKILL.md:147 jira-workflow/SKILL.md:148 jira-workflow/SKILL.md:149 jira-workflow/SKILL.md:146 jira-workflow/SKILL.md:147 jira-workflow/SKILL.md:148 jira-workflow/SKILL.md:149 scripts/add-subtasks.mjs:7 scripts/add-subtasks.mjs:8 scripts/add-subtasks.mjs:9 scripts/add-subtasks.mjs:10 scripts/add-subtasks.mjs:7 scripts/add-subtasks.mjs:8 scripts/add-subtasks.mjs:9 scripts/add-subtasks.mjs:10 scripts/add-subtasks.py:33 scripts/add-subtasks.py:38 scripts/add-subtasks.py:39 scripts/add-subtasks.py:40 scripts/add-subtasks.py:41 scripts/create-mvp.mjs:5 scripts/create-mvp.mjs:6 scripts/create-mvp.mjs:7 scripts/create-mvp.mjs:8 scripts/create-mvp.mjs:5 scripts/create-mvp.mjs:6 scripts/create-mvp.mjs:7 scripts/create-mvp.mjs:8 scripts/create-mvp.py:30 scripts/create-mvp.py:35 scripts/create-mvp.py:36 scripts/create-mvp.py:37 scripts/create-mvp.py:38 scripts/create-two-level.mjs:6 scripts/create-two-level.mjs:7 scripts/create-two-level.mjs:8 scripts/create-two-level.mjs:9 scripts/create-two-level.mjs:6 scripts/create-two-level.mjs:7 scripts/create-two-level.mjs:8 scripts/create-two-level.mjs:9 scripts/create-two-level.py:26 scripts/create-two-level.py:31 scripts/create-two-level.py:32 scripts/create-two-level.py:33 scripts/create-two-level.py:34
審計單位: codex 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/01000001-01001110-jira-safe/audits/11?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/01000001-01001110-jira-safe?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/01000001-01001110-jira-safe?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/01000001-01001110-jira-safe/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/01000001-01001110-jira-safe.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
01000001-01001110. (2026). jira-safe security audit report (audit version 11) [Author version unspecified]. Skillstore. https://skillstore.io/skills/01000001-01001110-jira-safe/audits/11BibTeX 引用
@techreport{01000001-01001110-01000001-01001110-jira-safe-2026,
author = {01000001-01001110},
title = {jira-safe security audit report (audit version 11)},
institution = {Skillstore},
year = {2026},
number = {11},
url = {https://skillstore.io/skills/01000001-01001110-jira-safe/audits/11},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "jira-safe security audit report (audit version 11)"
version: "unspecified"
type: report
authors:
- name: "01000001-01001110"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/01000001-01001110-jira-safe/audits/11"
identifiers:
- type: other
value: "skillstore:01000001-01001110-jira-safe:audit:11"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 45
架構
85
可維護性
87
內容
73
社群
83
規範符合度
你可以打造什麼
建立 SAFe Backlog
將產品需求轉換為 Jira epics、stories、驗收條件和 subtasks。
準備 Sprint 工作
在 sprint planning 前，將已核准的 features 拆解為實作 stories 和技術 subtasks。
同步工作狀態
使用 Jira 工作流程轉換模式，將 issues 移動到 Progressing、review 和 Done 狀態。
試試這些提示
草擬一則 Story
為此 feature 建立一則 SAFe 使用者故事。包含摘要、角色、目標、效益、驗收條件和 subtasks。
建立 Epic 計畫
將此產品目標轉換為一個 Jira epic，包含商業成果、成功指標、stories 和實作 subtasks。
準備 Jira 建立步驟
為團隊管理專案準備 Jira issue 建立計畫。顯示 parent links，並在任何寫入操作前確認。
審查工作流程自動化
在執行前，審查此 Jira 工作流程自動化計畫的安全性、專案欄位相容性、速率限制和復原步驟。
最佳實務
- 在建立或移動 Jira issues 前，確認專案類型和可用 transitions。
- 使用最低權限的 Jira API tokens，並先在沙盒專案中測試腳本。
- 在任何 Jira 寫入、刪除或批次操作前，先取得使用者核准。
避免
- 未審查產生的 backlog，就直接在生產 Jira 上執行示範腳本。
- 假設自訂欄位 ID 在所有 Jira 專案中都相同。
- 在沒有 dry run、allowlist 和輸入確認的情況下使用批次刪除輔助工具。
常見問題
此技能是否適用於團隊管理的 Jira 專案？
可以。範例著重於團隊管理專案，並使用 parent 欄位表示 epic 和 story 階層。
它是否需要 Jira 認證？
需要。腳本與 API 範例需要 Jira email、API token、base URL 和 project key 值。
它可以建立真實的 Jira issues 嗎？
可以。隨附腳本在使用有效認證執行時，可以建立 epics、stories 和 subtasks。
它可以更新工作流程狀態嗎？
可以。工作流程指引會展示如何查詢 transitions，並在已設定的 Jira states 之間移動 issues。
它對生產 Jira 專案安全嗎？
請謹慎使用。在寫入生產環境前，審查產生的工作內容、使用最低權限 tokens，並優先進行 dry-run 或沙盒測試。
它是否會自動處理自訂 Jira 欄位？
部分可以。它會說明常見欄位並包含查找指引，但每個 Jira instance 可能都需要驗證。
開發者詳細資訊
授權
MIT
Skillstore 修訂
r1
版本提示
作者未聲明版本。
引用
7ed2830f0283f3a8900137d8dc893e54072206f3
維護新鮮度
2026/7/18
使用量
83 次下載 · 405 次瀏覽
檔案結構
01000001-01001110 的更多技能
查看全部相關技能
查看全部📦
fusion-issue-authoring
81Draft and Publish Clear GitHub Issues
由 equinor
Unclear issue requests create rework, duplicates, and weak acceptance criteria. This skill produces reviewed GitHub issues with consistent structure and controlled publishing.
效率 查看
📦
linear-projects-write
81從 CLI 管理 Linear 專案
由 Bind
團隊需要快速、一致地設定 Linear 專案，而不必切換工具。此技能會引導 Claude、Codex 和 Claude Code 使用 Bun CLI 建立與更新 Linear 專案。
效率 查看
📦
web-cli-teleport
81選擇 Claude Code Web 或 CLI
由 DNYoussef
團隊若為任務選錯 Claude Code 介面，就會浪費時間。此技能會建議使用 Web、CLI 或混合式交接工作流程。
效率 查看
📦
track-management
80整理 Conductor 軌道
由 sickn33
當規格、計畫、狀態與中繼資料彼此脫節時，軌道工作可能會變得不清楚。此技能為 Claude、Codex 和 Claude Code 提供 Conductor 軌道工作流程的結構化指引。
效率 查看
📦
linear-milestones-read
80從 CLI 讀取 Linear 里程碑
由 Bind
團隊需要無需開啟 Web 應用程式即可快速掌握 Linear 里程碑。此技能會執行唯讀 CLI 工作流程，用於取得經篩選的里程碑清單。
效率 查看
📦
lark-workflow-standup-report
80產生 Lark 站會報告
由 larksuite
當會議和任務分散在不同的 Lark 應用程式中時，每日規劃會變得緩慢。此技能會將行事曆議程和未完成任務合併成一份可直接用於站會的摘要。
效率 查看