技能 ghe-thread-manager
📦
ghe-thread-manager
內容修訂 r1 高風險 ⚙️ 外部命令📁 檔案系統存取
管理 GitHub Issue 討論串
當 AI 工作在 GitHub issue 與背景任務之間移動時，團隊會失去脈絡。此技能可協助 Claude、Codex 和 Claude Code 追蹤目前作用中的 issue、管理轉錄狀態，並建立審查討論串。
支援: Claude Codex Code(CC)
安裝前請停止並請求確認。
請審查安裝計畫，並在變更檔案前取得使用者明確同意。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "ghe-thread-manager" from https://skillstore.io/skills/emasoft-ghe-thread-manager.md and its manifest at https://skillstore.io/api/skills/emasoft-ghe-thread-manager/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「ghe-thread-manager」。 What are we working on?
預期結果:
助理會回報是否已選取 issue，並說明轉錄是開啟還是私密。
正在使用「ghe-thread-manager」。 Switch to issue 42.
預期結果:
助理會變更作用中的 issue，宣布轉錄已啟用，並說明 GitHub 將接收未來的交流內容。
正在使用「ghe-thread-manager」。 Implement dark mode.
預期結果:
助理會為該工作建立背景 issue，並說明主要對話是維持私密，還是停留在目前的 issue 上。
安全審計
高風險v8 • 2026/7/6 開啟版本化報告
Most static backtick findings are false positives from Markdown code fences and inline command names. Confirmed issues remain for hidden home-directory writes, predictable temporary issue state, public GitHub transcription, absolute prompt-priority language, and shell commands that may receive user-controlled text. The author should tighten permissions, state storage, command invocation, and consent boundaries before publication.
1
已掃描檔案
593
分析行數
4
複核項目
0
已忽略的誤報
已確認的安全問題 (3)
高
Prompt Injection Attempt Detected
SKILL.md declares an absolute IRON LAW that requires the agent to follow every user word verbatim. This instruction-priority language can conflict with platform policy or security review.
The finding is based on explicit absolute-priority wording in the skill. The language is not framed as optional workflow guidance.
高
Public Conversation Transcription to GitHub
The skill intentionally posts user and assistant exchanges to a GitHub issue when transcription is active. Notifications reduce surprise, but sensitive content can still be exposed.
The skill explicitly states that everything the user says becomes public on GitHub and includes commands to activate issue transcription.
高
User-Controlled Shell Argument Risk
The background thread command template passes title and description placeholders through a shell command. If user text is interpolated without safe argument handling, crafted input could alter command behavior.
The command template clearly includes title and description placeholders. The risk depends on how the agent substitutes user text, so confidence is high enough to retain but not absolute.
能力複核項目 (4)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
高
Hidden file in home directory
- ~/.claude (for plugin/settings fixes)
The skill explicitly allows background agents to write to ~/.claude for plugin and settings fixes. That can persistently alter agent configuration outside the project workspace.
高
Hidden file access
- ~/.claude (for plugin/settings fixes)
The skill explicitly allows background agents to write to ~/.claude for plugin and settings fixes. That can persistently alter agent configuration outside the project workspace.
中
Temp directory access
echo "42" > /tmp/ghe_previous_issue
The skill uses a predictable /tmp/ghe_previous_issue path for issue control state. In shared environments, tampering could change which GitHub issue receives transcription.
中
Temp directory access
PREVIOUS=$(cat /tmp/ghe_previous_issue 2>/dev/null)
The skill uses a predictable /tmp/ghe_previous_issue path for issue control state. In shared environments, tampering could change which GitHub issue receives transcription.
風險因素
⚙️ 外部命令 (97)
SKILL.md:53 SKILL.md:54 SKILL.md:76-79 SKILL.md:79-103 SKILL.md:103-105 SKILL.md:105-108 SKILL.md:108-110 SKILL.md:110-123 SKILL.md:123-160 SKILL.md:160-183 SKILL.md:183-194 SKILL.md:194-204 SKILL.md:204-206 SKILL.md:206-215 SKILL.md:215-217 SKILL.md:217-234 SKILL.md:234-240 SKILL.md:240-253 SKILL.md:253-255 SKILL.md:255-266 SKILL.md:266-272 SKILL.md:272-281 SKILL.md:281-283 SKILL.md:283-291 SKILL.md:291-295 SKILL.md:295-312 SKILL.md:312-314 SKILL.md:314-332 SKILL.md:332-338 SKILL.md:338-351 SKILL.md:351-360 SKILL.md:360-364 SKILL.md:364-372 SKILL.md:372-382 SKILL.md:382-384 SKILL.md:384-394 SKILL.md:394 SKILL.md:398-407 SKILL.md:407-411 SKILL.md:411-414 SKILL.md:414-417 SKILL.md:417-420 SKILL.md:420-424 SKILL.md:424-430 SKILL.md:430-433 SKILL.md:433-434 SKILL.md:434-439 SKILL.md:439-441 SKILL.md:441-458 SKILL.md:458-474 SKILL.md:474-475 SKILL.md:475-476 SKILL.md:476-477 SKILL.md:477-478 SKILL.md:478-479 SKILL.md:479-480 SKILL.md:480-481 SKILL.md:481-482 SKILL.md:482-483 SKILL.md:483-484 SKILL.md:484-485 SKILL.md:485-486 SKILL.md:486-494 SKILL.md:494-497 SKILL.md:497-559 SKILL.md:559-560 SKILL.md:560-561 SKILL.md:561-562 SKILL.md:562-563 SKILL.md:563-564 SKILL.md:564-565 SKILL.md:565-566 SKILL.md:566-580 SKILL.md:580-582 SKILL.md:205 SKILL.md:236 SKILL.md:268 SKILL.md:293 SKILL.md:313 SKILL.md:334 SKILL.md:356 SKILL.md:365 SKILL.md:418 SKILL.md:443 SKILL.md:446 SKILL.md:449 SKILL.md:450 SKILL.md:204-206 SKILL.md:234-240 SKILL.md:266-272 SKILL.md:291-295 SKILL.md:312-314 SKILL.md:332-338 SKILL.md:351-360 SKILL.md:364-372 SKILL.md:417-420 SKILL.md:441-458
📁 檔案系統存取 (6)
審計單位: codex 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/emasoft-ghe-thread-manager/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/emasoft-ghe-thread-manager?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/emasoft-ghe-thread-manager?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/emasoft-ghe-thread-manager/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/emasoft-ghe-thread-manager.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
Emasoft. (2026). ghe-thread-manager security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/emasoft-ghe-thread-manager/audits/8BibTeX 引用
@techreport{emasoft-emasoft-ghe-thread-manager-2026,
author = {Emasoft},
title = {ghe-thread-manager security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/emasoft-ghe-thread-manager/audits/8},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "ghe-thread-manager security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
- name: "Emasoft"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/emasoft-ghe-thread-manager/audits/8"
identifiers:
- type: other
value: "skillstore:emasoft-ghe-thread-manager:audit:8"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 55
架構
85
可維護性
85
內容
70
社群
87
規範符合度
你可以打造什麼
切換作用中 Issue 脈絡
在 GitHub issues 之間移動，同時保留轉錄狀態與使用者通知。
協調背景工作
建立功能或錯誤討論串，同時讓主要對話維持在目前的 issue 上。
安全加入審查討論串
進入審查 issue、了解新的轉錄目標，並返回先前脈絡。
試試這些提示
檢查目前 Issue
What issue are we working on right now?
切換到某個 Issue
Switch to issue 42 and tell me whether transcription is active.
建立背景工作
Create a background feature thread for adding dark mode, but keep this chat in its current transcription state.
復原並恢復脈絡
Find the last active issue, summarize it, and ask before resuming transcription.
最佳實務
- 在討論私密或客戶資料前，確認作用中的 issue。
- 在分享機密或敏感脈絡前，使用 go private 或 stop tracking。
- 在啟用此技能前，保持 GHE 輔助指令碼已經過審查並固定版本。
避免
- 加入或切換 issues 後，不要假設轉錄是私密的。
- 若沒有目標儲存庫的 GitHub 權限，請勿使用此技能。
- 不要讓背景 issue 建立動作變更主要對話狀態。
常見問題
此技能會將訊息發布到 GitHub 嗎？
會，在轉錄處於作用中時。它需要通知文字來說明作用中的 GitHub issue 目標。
我可以停止轉錄嗎？
可以。要求 stop tracking、go private 或 stop transcribing 即可關閉轉錄。
建立背景討論串會切換我作用中的 issue 嗎？
不會。背景功能與錯誤討論串獨立於主要對話狀態。
此技能需要哪些工具？
它需要 GHE 輔助指令碼、有效的外掛程式根目錄，以及用於 issue 查詢的 GitHub CLI 存取權。
它可以找到上一個作用中的 issue 嗎？
可以。它可以檢查已儲存的狀態，並可搜尋近期 GitHub issues 作為備援。
它適合用於機密資訊嗎？
不適合。請將作用中轉錄視為公開發布到 GitHub，並在分享機密前停止追蹤。