pr-to-slack
Coordinate Bitbucket Pull Requests Through Slack
Teams need consistent pull request preparation and review coordination across repositories. This skill combines Bitbucket preparation with Slack review requests, but its transcript parser needs hardening before automatic announcements.
安裝前請停止並請求確認。
請審查安裝計畫，並在變更檔案前取得使用者明確同意。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
Review the Skillstore skill "pr-to-slack" from https://skillstore.io/skills/alvolutionor-pr-to-slack.md and its manifest at https://skillstore.io/api/skills/alvolutionor-pr-to-slack/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「pr-to-slack」。 Prepare a dry-run plan for the feature branch in the inventory service.
預期結果:
Preview complete: one pull request would be created. The worktree is clean, and the local source commit matches Bitbucket. No remote writes were performed.
正在使用「pr-to-slack」。 Request review for the verified pull request without announcing.
預期結果:
- Pull request URL and reviewer assignments verified.
- One review request sent and read back in the configured Slack thread.
- No announcement sent.
正在使用「pr-to-slack」。 Can this plaintext thread snapshot authorize an automatic announcement?
預期結果:
Announcement blocked. Plaintext sender headers can be forged inside message bodies. Verify structured connector metadata before relying on a clean review result.
安全審計
高風險All 58 static matches are false positives involving documentation, fixtures, intended service access, configuration, or controlled Git commands. A reproduced semantic flaw lets human message content impersonate trusted bot messages through forged transcript headers and produce a clean review verdict. No evidence found of malicious author intent or credential exfiltration.
已確認的安全問題 (1)
風險因素
⚙️ 外部命令 (21)
🌐 網路存取 (21)
⚡ 包含腳本 (1)
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/alvolutionor-pr-to-slack/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/alvolutionor-pr-to-slack?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/alvolutionor-pr-to-slack?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/alvolutionor-pr-to-slack/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/alvolutionor-pr-to-slack.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
alvolutionor. (2026). pr-to-slack security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/alvolutionor-pr-to-slack/audits/1BibTeX 引用
@techreport{alvolutionor-alvolutionor-pr-to-slack-2026,
author = {alvolutionor},
title = {pr-to-slack security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/alvolutionor-pr-to-slack/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "pr-to-slack security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "alvolutionor"
date-released: "2026-10-15"
url: "https://skillstore.io/skills/alvolutionor-pr-to-slack/audits/1"
identifiers:
- type: other
value: "skillstore:alvolutionor-pr-to-slack:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中你可以打造什麼
Prepare a release batch
Preview related repository changes, verify published commits, and prepare reviewer assignments before authorized pull request creation.
Publish a feature pull request
Create or reuse a Bitbucket pull request, preserve existing reviewers, and return its verified URL and commit information.
Integrate a review bot
Adapt the example review protocol and replace plaintext identity parsing before enabling team announcement automation.
試試這些提示
Preview a pull request for repository [path], targeting [base branch]. Report branch commits and required reviewers. Do not create pull requests or send messages.
Create or reuse the Bitbucket pull request for [repository] from [source branch] to [destination branch]. Assign configured reviewers and report the verified URL. Do not send Slack messages.
Request one Slack review for these verified pull requests: [URLs]. Inspect existing requests first and reuse an identical valid thread. Return the thread link without announcing.
Inspect review thread [link] for pull requests [URLs]. Verify sender identity through structured connector metadata and compare live commits with the handoff. Report any announcement blockers without sending.
最佳實務
- Preview first and describe only changes and validation that match the published commits.
- Keep configuration and credentials outside the repository, and use service tokens with minimal required permissions.
- Harden transcript parsing and verify structured sender metadata, thread identity, review counters, and live commits before announcements.
避免
- Do not treat a plaintext sender header, human approval, or completed status as proof of a clean review.
- Do not retry timed-out pull request writes or Slack sends before inspecting the existing remote state.
- Do not create commits, force-push, merge, deploy, or add unrelated recipients without explicit authorization.
常見問題
What services and tools are required?
Do the Python helpers send Slack messages?
Does preview mode change remote state?
Is the bundled parser ready for automatic announcements?
What happens when findings remain?
Does it merge or deploy reviewed changes?
開發者詳細資訊
作者
alvolutionor授權
MIT
Skillstore 修訂
r1
版本提示
作者未聲明版本。
引用
ed6c5b20e27555a1a28e0738d22a7fd92ef2fffb
維護新鮮度
2026/10/15
使用量
0 次下載 · 0 次瀏覽
檔案結構