技能 github-elements-tracking
📦
github-elements-tracking
內容修訂 r1 高風險 ⚙️ 外部命令📁 檔案系統存取🔑 環境變數🌐 網路存取
協調 GitHub Issue 工作流程
長時間執行的 AI 任務會在不同工作階段之間遺失上下文與協調狀態。此 skill 使用 GitHub Issues、檢查點與 worktrees 來保留狀態並引導階段轉換。
支援: Claude Codex Code(CC)
安裝前請停止並請求確認。
請審查安裝計畫，並在變更檔案前取得使用者明確同意。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "github-elements-tracking" from https://skillstore.io/skills/emasoft-github-elements-tracking.md and its manifest at https://skillstore.io/api/skills/emasoft-github-elements-tracking/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「github-elements-tracking」。 在上下文壓縮後繼續 authentication 功能。
預期結果:
助理會摘要 issue 歷史、識別目前階段、列出阻礙，並發布新的檢查點。
正在使用「github-elements-tracking」。 協調三個代理處理同一個 epic。
預期結果:
助理會分離 DEV、TEST 和 REVIEW threads、記錄 issue 範圍，並標示重疊的檔案所有權。
正在使用「github-elements-tracking」。 為已完成的 branch 準備審查交接。
預期結果:
助理會彙整檢查點、測試狀態、已變更檔案與審查標準，並整理成 GitHub issue 更新。
安全審計
高風險v9 • 2026/7/5 開啟版本化報告
Most static hits are documentation artifacts, especially Markdown code spans, example links, and workflow prose. Confirmed risks remain because the skill directs agents to run shell and GitHub CLI commands, write parent worktree paths, modify hidden Claude configuration, install an external MCP package, and install GitHub automation with write permissions.
12
已掃描檔案
10,750
分析行數
81
複核項目
0
已忽略的誤報
已確認的安全問題 (3)
高
Prompt Injection Attempt Detected
The skill states that its law is absolute and that every user word must be followed verbatim. This can pressure an assistant to treat skill text as higher priority than safety or security review.
The wording uses absolute authority language and directs verbatim obedience to user specifications. It does not explicitly say to ignore system instructions, so confidence is high but not maximal.
高
Unpinned Third-Party MCP Installation
The setup workflow tells users to install and run SERENA MCP from a GitHub URL through uvx and Claude MCP tooling. The dependency is not pinned to a reviewed commit in the cited commands.
The cited lines create an install script and run uvx from a git+https URL. That is a direct supply-chain risk even if the dependency is legitimate.
中
Repository Automation With Write Permissions
The enforcement guide includes GitHub Actions snippets with issue and pull-request write permissions. If installed, they can automatically comment, label, and request changes in repository workflows.
The cited workflow examples request write permissions and call GitHub APIs that mutate issues or pull requests. This is intended enforcement behavior, but it requires explicit repository-owner review.
能力複核項目 (81)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
高
Hardcoded URL
claude mcp add serena -- uvx --from git+https://github.com/oraios/serena serena start-mcp-server --c
The setup script pulls or runs SERENA MCP from a GitHub URL through uvx or Claude MCP tooling. This is an intended dependency install, but it executes code from an external source.
高
Hardcoded URL
uvx --from git+https://github.com/oraios/serena serena project create $lang_flags
The setup script pulls or runs SERENA MCP from a GitHub URL through uvx or Claude MCP tooling. This is an intended dependency install, but it executes code from an external source.
高
Hardcoded URL
uvx --from git+https://github.com/oraios/serena serena project index
The setup script pulls or runs SERENA MCP from a GitHub URL through uvx or Claude MCP tooling. This is an intended dependency install, but it executes code from an external source.
高
Path traversal sequence
**Standard Worktree Location**: `../ghe-worktrees/issue-{N}/`
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
高
Path traversal sequence
mkdir -p ../ghe-worktrees
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
高
Path traversal sequence
git worktree add ../ghe-worktrees/issue-${ISSUE_NUM} -b issue-${ISSUE_NUM} main
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
高
Path traversal sequence
cd ../ghe-worktrees/issue-${ISSUE_NUM}
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
高
Path traversal sequence
echo "Create worktree: git worktree add ../ghe-worktrees/issue-N -b issue-N main"
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
高
Path traversal sequence
echo "WARNING: Not in a worktree. Should be in ../ghe-worktrees/issue-N/"
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
高
Path traversal sequence
| Claim DEV | `git worktree add ../ghe-worktrees/issue-N -b issue-N main` |
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
高
Path traversal sequence
cd ../ghe-worktrees/issue-${ISSUE_NUM}
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
高
Path traversal sequence
| `GHE_WORKTREES_DIR` | ../ghe-worktrees | Worktrees directory |
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
高
Path traversal sequence
safe_worktree_cleanup "../ghe-worktrees/issue-123" true
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
高
Path traversal sequence
if ! verify_worktree_health "../ghe-worktrees/issue-123"; then
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
高
Path traversal sequence
safe_worktree_cleanup "../ghe-worktrees/issue-123" true
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
高
Path traversal sequence
git worktree add ../ghe-worktrees/issue-123 -b issue-123 main
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
高
Path traversal sequence
| **Work on main branch** | Breaks isolation, pollutes main | ALL work in worktrees: `../ghe-worktre
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
高
Hidden file in home directory
- ~/.claude (for plugin/settings fixes)
The skill explicitly allows background agents to write under ~/.claude for plugin or settings fixes. Writing hidden user configuration is a real security-sensitive filesystem action.
中
Shell command substitution
TIMESTAMP="$(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC"
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
CURRENT=$(gh issue view $ISSUE --json assignees --jq '.assignees | length')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
TIMESTAMP="$(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC"
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
CURRENT_BODY=$(gh issue view $ISSUE --json body --jq '.body')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
Started: $(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
TIMESTAMP="$(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC"
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
TIMESTAMP="$(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC"
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
SUB_ISSUE=$(gh issue list --limit 1 --json number --jq '.[0].number')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
EPIC_LABEL=$(gh issue view $MY_ISSUE --json labels --jq '.labels[].name | select(startswith("epic:")
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Temp directory access
gh issue edit $ISSUE --body-file /tmp/updated_body.md
The skill instructs agents to write or edit temporary files under /tmp before updating GitHub Issues. This is a real filesystem side effect, although the intended use is transient issue-body editing.
中
Temp directory access
gh issue view $ISSUE --json body --jq '.body' > /tmp/body.md
The skill instructs agents to write or edit temporary files under /tmp before updating GitHub Issues. This is a real filesystem side effect, although the intended use is transient issue-body editing.
中
Temp directory access
# Edit /tmp/body.md to check completed task boxes, add links
The skill instructs agents to write or edit temporary files under /tmp before updating GitHub Issues. This is a real filesystem side effect, although the intended use is transient issue-body editing.
中
Temp directory access
gh issue edit $ISSUE --body-file /tmp/body.md
The skill instructs agents to write or edit temporary files under /tmp before updating GitHub Issues. This is a real filesystem side effect, although the intended use is transient issue-body editing.
中
Shell command substitution
--body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
EPIC=$(gh issue list --limit 1 --json number --jq '.[0].number')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
--body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
--body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
--body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
EPIC=$(gh issue view $REVIEW_ISSUE --json labels --jq '.labels[] | select(.name | startswith("epic:"
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
DEV_OPEN=$(gh issue list --label "epic:$EPIC" --label "phase:dev" --state open --json number --jq 'l
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
TEST_OPEN=$(gh issue list --label "epic:$EPIC" --label "phase:test" --state open --json number --jq
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
TEST_ISSUE=$(gh issue list --label "epic:$EPIC" --label "phase:test" --state closed --json number --
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
gh issue comment $ISSUE --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
## Review Started - $(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
EPIC=$(gh issue view $ISSUE --json labels --jq '.labels[] | select(.name | startswith("epic:")) | .n
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
## Review Progress - $(date -u +%H:%M) UTC
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
EPIC=$(gh issue view $ISSUE --json labels --jq '.labels[] | select(.name | startswith("epic:")) | .n
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
## Re-Review - $(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
$ gh issue comment 201 --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
ASSIGNEE=$(gh issue view $ISSUE --json assignees --jq '.assignees[0].login')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
LABELS=$(gh issue view $ISSUE --json labels --jq '.labels[].name')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
EPIC_LABEL=$(gh issue view $MY_ISSUE --json labels --jq '.labels[] | select(.name | startswith("epic
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
EPIC=$(gh issue view $ISSUE --json labels --jq '.labels[] | select(.name | startswith("epic:")) | .n
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
--body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
--body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
$ gh issue comment 201 --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
CURRENT=$(gh issue view $TEST_ISSUE --json assignees --jq '.assignees | length')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
gh issue comment $TEST_ISSUE --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
## [TEST Session 1] $(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC - @me
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
gh issue comment $TEST_ISSUE --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
gh issue comment $TEST_ISSUE --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
gh issue comment $DEV_ISSUE --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
gh issue comment $TEST_ISSUE --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
## [TEST Session N - COMPLETE] $(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC - @me
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
PROJECT_DIR=$(pwd)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
CURRENT_BRANCH=$(git branch --show-current)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
REVIEW_DATE=$(date +%Y-%m-%d)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
BEHIND=$(git rev-list --count HEAD..origin/main)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
attempt=$((attempt + 1))
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
local start=$(date +%s)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
while [ $(check_merge_lock) -gt 0 ]; do
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
local now=$(date +%s)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
local elapsed=$((now - start))
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Shell command substitution
gh pr edit 456 --body "$(gh pr view 456 --json body --jq .body)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
中
Template literal with command substitution
```bash
The flagged location opens a bash command block that includes variable expansion and operational commands. The exact label is broad, but the surrounding guidance still asks agents to execute shell workflows.
中
Template literal with command substitution
```bash
The flagged location opens a bash command block that includes variable expansion and operational commands. The exact label is broad, but the surrounding guidance still asks agents to execute shell workflows.
中
Template literal with command substitution
```bash
The flagged location opens a bash command block that includes variable expansion and operational commands. The exact label is broad, but the surrounding guidance still asks agents to execute shell workflows.
中
Template literal with command substitution
```bash
The flagged location opens a bash command block that includes variable expansion and operational commands. The exact label is broad, but the surrounding guidance still asks agents to execute shell workflows.
中
Template literal with command substitution
```bash
The flagged location opens a bash command block that includes variable expansion and operational commands. The exact label is broad, but the surrounding guidance still asks agents to execute shell workflows.
中
Template literal with command substitution
```bash
The flagged location opens a bash command block that includes variable expansion and operational commands. The exact label is broad, but the surrounding guidance still asks agents to execute shell workflows.
中
Unix shell invocation
#!/bin/bash
The finding is a bash script entry point in setup or verification guidance. Running it can execute local commands and modify tool configuration or repository state.
中
Unix shell invocation
#!/bin/bash
The finding is a bash script entry point in setup or verification guidance. Running it can execute local commands and modify tool configuration or repository state.
中
Hidden file access
- ~/.claude (for plugin/settings fixes)
The skill explicitly allows background agents to write under ~/.claude for plugin or settings fixes. Writing hidden user configuration is a real security-sensitive filesystem action.
風險因素
⚙️ 外部命令 (442)
references/P1-task-agent-playbook.md:141-142 references/P1-task-agent-playbook.md:142-149 references/P1-task-agent-playbook.md:445-452 references/P1-task-agent-playbook.md:584-596 references/P1-task-agent-playbook.md:206 references/P1-task-agent-playbook.md:237 references/P1-task-agent-playbook.md:247 references/P1-task-agent-playbook.md:280 references/P1-task-agent-playbook.md:364 references/P1-task-agent-playbook.md:406 references/P1-task-agent-playbook.md:547 references/P1-task-agent-playbook.md:645 references/P1-task-agent-playbook.md:664 references/P10-bug-triage-protocol.md:100-103 references/P2-epic-coordinator-playbook.md:200-217 references/P2-epic-coordinator-playbook.md:240 references/P2-epic-coordinator-playbook.md:338-368 references/P2-epic-coordinator-playbook.md:532-540 references/P2-epic-coordinator-playbook.md:562-570 references/P3-review-agent-playbook.md:262-270 references/P3-review-agent-playbook.md:99 references/P3-review-agent-playbook.md:102 references/P3-review-agent-playbook.md:110 references/P3-review-agent-playbook.md:118 references/P3-review-agent-playbook.md:180-181 references/P3-review-agent-playbook.md:181 references/P3-review-agent-playbook.md:206 references/P3-review-agent-playbook.md:221 references/P3-review-agent-playbook.md:377 references/P3-review-agent-playbook.md:391 references/P4-compaction-recovery-walkthrough.md:142-149 references/P4-compaction-recovery-walkthrough.md:194-201 references/P4-compaction-recovery-walkthrough.md:306-319 references/P4-compaction-recovery-walkthrough.md:364-368 references/P4-compaction-recovery-walkthrough.md:430-444 references/P4-compaction-recovery-walkthrough.md:644-645 references/P4-compaction-recovery-walkthrough.md:645-663 references/P4-compaction-recovery-walkthrough.md:663-673 references/P4-compaction-recovery-walkthrough.md:714-729 references/P4-compaction-recovery-walkthrough.md:800-810 references/P4-compaction-recovery-walkthrough.md:413-417 references/P5-multi-instance-protocol.md:164-180 references/P5-multi-instance-protocol.md:331-344 references/P5-multi-instance-protocol.md:93 references/P5-multi-instance-protocol.md:102 references/P5-multi-instance-protocol.md:317 references/P5-multi-instance-protocol.md:364 references/P6-enforcement-setup.md:112 references/P6-enforcement-setup.md:116-135 references/P6-enforcement-setup.md:138 references/P6-enforcement-setup.md:140-154 references/P6-enforcement-setup.md:159 references/P6-enforcement-setup.md:167 references/P6-enforcement-setup.md:171-173 references/P6-enforcement-setup.md:227-270 references/P6-enforcement-setup.md:270-278 references/P6-enforcement-setup.md:286-295 references/P6-enforcement-setup.md:301-305 references/P6-enforcement-setup.md:345-370 references/P6-enforcement-setup.md:374-378 references/P6-enforcement-setup.md:378-430 references/P6-enforcement-setup.md:430-438 references/P6-enforcement-setup.md:444-447 references/P6-enforcement-setup.md:486 references/P6-enforcement-setup.md:489 references/P6-enforcement-setup.md:499 references/P6-enforcement-setup.md:501-504 references/P6-enforcement-setup.md:572-575 references/P6-enforcement-setup.md:652-659 references/P6-enforcement-setup.md:682-685 references/P6-enforcement-setup.md:748 references/P6-enforcement-setup.md:750 references/P6-enforcement-setup.md:753 references/P6-enforcement-setup.md:755 references/P6-enforcement-setup.md:757-760 references/P6-enforcement-setup.md:817-820 references/P7-validation-checklist.md:838-839 references/P7-validation-checklist.md:839-846 references/P8-complete-lifecycle-example.md:76-108 references/P8-complete-lifecycle-example.md:199-209 references/P8-complete-lifecycle-example.md:277-288 references/P8-complete-lifecycle-example.md:311-325 references/P8-complete-lifecycle-example.md:325-345 references/P8-complete-lifecycle-example.md:400-409 references/P8-complete-lifecycle-example.md:423-427 references/P8-complete-lifecycle-example.md:502-517 references/P8-complete-lifecycle-example.md:517-533 references/P8-complete-lifecycle-example.md:836-837 references/P8-complete-lifecycle-example.md:837-847 references/P8-complete-lifecycle-example.md:306-324 references/P8-complete-lifecycle-example.md:497-515 references/P8-complete-lifecycle-example.md:628-632 references/P9-test-agent-playbook.md:217-218 references/P9-test-agent-playbook.md:218-223 references/P9-test-agent-playbook.md:271-274 references/P9-test-agent-playbook.md:292-296 references/P9-test-agent-playbook.md:476-484 references/P9-test-agent-playbook.md:121 references/P9-test-agent-playbook.md:134-135 references/P9-test-agent-playbook.md:135 references/P9-test-agent-playbook.md:176-177 references/P9-test-agent-playbook.md:321-330 references/P9-test-agent-playbook.md:362-372 references/P9-test-agent-playbook.md:392-393 references/P9-test-agent-playbook.md:393 references/templates/issue-comment-format.md:52-53 references/templates/issue-comment-format.md:83-84 references/templates/issue-comment-format.md:84-89 SKILL.md:40 SKILL.md:41 SKILL.md:44 SKILL.md:45 SKILL.md:46 SKILL.md:47 SKILL.md:62 SKILL.md:66 SKILL.md:67 SKILL.md:68 SKILL.md:69 SKILL.md:70 SKILL.md:71 SKILL.md:127-133 SKILL.md:133-186 SKILL.md:186-194 SKILL.md:194 SKILL.md:204 SKILL.md:205 SKILL.md:206 SKILL.md:207 SKILL.md:210 SKILL.md:234-261 SKILL.md:261-267 SKILL.md:267-287 SKILL.md:287-307 SKILL.md:307-310 SKILL.md:310-322 SKILL.md:322-334 SKILL.md:334 SKILL.md:335-336 SKILL.md:336 SKILL.md:346-348 SKILL.md:348-392 SKILL.md:392-395 SKILL.md:395-400 SKILL.md:400-405 SKILL.md:405-407 SKILL.md:407-411 SKILL.md:411-420 SKILL.md:420-433 SKILL.md:433-437 SKILL.md:437-440 SKILL.md:440-447 SKILL.md:447-451 SKILL.md:451-453 SKILL.md:453-467 SKILL.md:467-473 SKILL.md:473-490 SKILL.md:490-494 SKILL.md:494-512 SKILL.md:512-518 SKILL.md:518 SKILL.md:519 SKILL.md:520 SKILL.md:525-537 SKILL.md:537-540 SKILL.md:540-552 SKILL.md:552-555 SKILL.md:555-564 SKILL.md:564-570 SKILL.md:570-573 SKILL.md:573-574 SKILL.md:574-580 SKILL.md:580-591 SKILL.md:591-599 SKILL.md:599-607 SKILL.md:607-614 SKILL.md:614-618 SKILL.md:618-620 SKILL.md:620-622 SKILL.md:622-626 SKILL.md:626-671 SKILL.md:671-677 SKILL.md:677-697 SKILL.md:697-737 SKILL.md:737-753 SKILL.md:753-755 SKILL.md:755-765 SKILL.md:765-818 SKILL.md:818-824 SKILL.md:824-861 SKILL.md:861-892 SKILL.md:892-894 SKILL.md:894-896 SKILL.md:896-929 SKILL.md:929-935 SKILL.md:935-961 SKILL.md:961-970 SKILL.md:970-976 SKILL.md:976-996 SKILL.md:996-1000 SKILL.md:1000-1001 SKILL.md:1001-1002 SKILL.md:1002-1003 SKILL.md:1003-1004 SKILL.md:1004-1005 SKILL.md:1005-1012 SKILL.md:1012-1043 SKILL.md:1043 SKILL.md:1044-1045 SKILL.md:1045-1049 SKILL.md:1049-1071 SKILL.md:1071-1078 SKILL.md:1078-1088 SKILL.md:1088-1089 SKILL.md:1089-1090 SKILL.md:1090-1094 SKILL.md:1094-1097 SKILL.md:1097-1103 SKILL.md:1103-1128 SKILL.md:1128-1134 SKILL.md:1134-1135 SKILL.md:1135-1136 SKILL.md:1136-1137 SKILL.md:1137-1138 SKILL.md:1138 SKILL.md:1139-1140 SKILL.md:1140 SKILL.md:1141 SKILL.md:1142-1143 SKILL.md:1143-1159 SKILL.md:1159-1160 SKILL.md:1160-1161 SKILL.md:1161 SKILL.md:1162-1163 SKILL.md:1163-1164 SKILL.md:1164-1169 SKILL.md:1169-1180 SKILL.md:1180-1185 SKILL.md:1185-1190 SKILL.md:1190-1209 SKILL.md:1209-1212 SKILL.md:1212-1240 SKILL.md:1240-1243 SKILL.md:1243-1279 SKILL.md:1279-1282 SKILL.md:1282-1299 SKILL.md:1299-1302 SKILL.md:1302-1335 SKILL.md:1335-1343 SKILL.md:1343-1344 SKILL.md:1344-1345 SKILL.md:1345-1346 SKILL.md:1346-1347 SKILL.md:1347 SKILL.md:1348-1349 SKILL.md:1349-1350 SKILL.md:1350-1357 SKILL.md:1357-1360 SKILL.md:1360-1363 SKILL.md:1363 SKILL.md:1364 SKILL.md:1365 SKILL.md:1368-1372 SKILL.md:1372-1384 SKILL.md:1384-1385 SKILL.md:1385-1386 SKILL.md:1386-1387 SKILL.md:1387-1388 SKILL.md:1388-1394 SKILL.md:1394-1395 SKILL.md:1395-1396 SKILL.md:1396-1397 SKILL.md:1397-1403 SKILL.md:1403-1404 SKILL.md:1404-1405 SKILL.md:1405-1406 SKILL.md:1406-1407 SKILL.md:1407 SKILL.md:1408-1414 SKILL.md:1414-1415 SKILL.md:1415-1416 SKILL.md:1416-1422 SKILL.md:1422-1423 SKILL.md:1423-1424 SKILL.md:1424-1425 SKILL.md:1425-1426 SKILL.md:1426-1427 SKILL.md:1427-1428 SKILL.md:1428-1434 SKILL.md:1434-1435 SKILL.md:1435 SKILL.md:1441-1479 SKILL.md:1479-1485 SKILL.md:1485-1539 SKILL.md:1539-1597 SKILL.md:1597-1614 SKILL.md:1614-1635 SKILL.md:1635-1648 SKILL.md:1648-1654 SKILL.md:1654-1660 SKILL.md:1660-1661 SKILL.md:1661-1662 SKILL.md:1662-1666 SKILL.md:1666-1692 SKILL.md:1692-1698 SKILL.md:1698-1699 SKILL.md:1699-1700 SKILL.md:1700-1701 SKILL.md:1701-1702 SKILL.md:1702-1703 SKILL.md:1703-1709 SKILL.md:1709-1713 SKILL.md:1713-1721 SKILL.md:1721-1726 SKILL.md:1726-1727 SKILL.md:1727-1734 SKILL.md:1734-1753 SKILL.md:1753-1759 SKILL.md:1759-1775 SKILL.md:1775-1812 SKILL.md:1812-1820 SKILL.md:1820-1841 SKILL.md:1841-1843 SKILL.md:1843-1875 SKILL.md:1875-1883 SKILL.md:1883-1884 SKILL.md:1884-1885 SKILL.md:1885-1888 SKILL.md:1888-1895 SKILL.md:1895-1905 SKILL.md:1905-1912 SKILL.md:1912-1918 SKILL.md:1918-1919 SKILL.md:1919-1920 SKILL.md:1920-1926 SKILL.md:1926-1932 SKILL.md:1932-1961 SKILL.md:1961-1972 SKILL.md:1972-1984 SKILL.md:1984-1985 SKILL.md:1985-1986 SKILL.md:1986-1987 SKILL.md:1987-1988 SKILL.md:1988-1989 SKILL.md:1989-1990 SKILL.md:1990-1996 SKILL.md:1996-1997 SKILL.md:1997-1998 SKILL.md:1998-2004 SKILL.md:2004-2005 SKILL.md:2005-2006 SKILL.md:2006-2007 SKILL.md:2007-2021 SKILL.md:2021-2033 SKILL.md:2033-2039 SKILL.md:2039-2040 SKILL.md:2040-2041 SKILL.md:2041-2042 SKILL.md:2042-2043 SKILL.md:2043-2044 SKILL.md:2044-2045 SKILL.md:2045-2046 SKILL.md:2046-2047 SKILL.md:2047-2048 SKILL.md:2048-2049 SKILL.md:2049-2050 SKILL.md:2050-2051 SKILL.md:2051 SKILL.md:2052-2058 SKILL.md:2058-2061 SKILL.md:2061-2083 SKILL.md:2083-2086 SKILL.md:2086-2092 SKILL.md:2092-2093 SKILL.md:2093-2094 SKILL.md:2094-2095 SKILL.md:2095-2096 SKILL.md:2096-2097 SKILL.md:2097-2098 SKILL.md:2098-2099 SKILL.md:2099-2100 SKILL.md:2100-2101 SKILL.md:2101-2102 SKILL.md:2102-2108 SKILL.md:2108-2109 SKILL.md:2109-2110 SKILL.md:2110-2111 SKILL.md:2111-2115 SKILL.md:2115-2126 SKILL.md:2126-2136 SKILL.md:2136-2146 SKILL.md:2146-2152 SKILL.md:2152-2160 SKILL.md:2160-2166 SKILL.md:2166-2171 SKILL.md:2171-2177 SKILL.md:2177-2190 SKILL.md:2190-2196 SKILL.md:2196-2201 SKILL.md:2201-2207 SKILL.md:2207 SKILL.md:2208-2209 SKILL.md:2209-2210 SKILL.md:2210-2211 SKILL.md:2211-2212 SKILL.md:2212-2218 SKILL.md:2218-2226 SKILL.md:2226-2262 SKILL.md:2262-2265 SKILL.md:2265-2267 SKILL.md:2267-2269 SKILL.md:2269-2517 SKILL.md:2517-2527 SKILL.md:2527-2530 SKILL.md:2530-2534 SKILL.md:2534-2544 SKILL.md:2544-2546 SKILL.md:2546-2561 SKILL.md:2561-2568 SKILL.md:2568-2585 SKILL.md:2585-2586 SKILL.md:2586-2587 SKILL.md:2587-2588 SKILL.md:2588-2589 SKILL.md:353 SKILL.md:475 SKILL.md:699 SKILL.md:775 SKILL.md:805 SKILL.md:833 SKILL.md:835 SKILL.md:836 SKILL.md:837 SKILL.md:1872 SKILL.md:348-392 SKILL.md:473-490 SKILL.md:697-737 SKILL.md:765-818 SKILL.md:824-861 SKILL.md:1843-1875 SKILL.md:349 SKILL.md:1442
📁 檔案系統存取 (59)
references/P1-task-agent-playbook.md:283 references/P1-task-agent-playbook.md:458 references/P1-task-agent-playbook.md:459 references/P1-task-agent-playbook.md:460 references/P5-multi-instance-protocol.md:870 references/P6-enforcement-setup.md:116 references/P6-enforcement-setup.md:171 references/P6-enforcement-setup.md:286 references/P6-enforcement-setup.md:38 references/P6-enforcement-setup.md:39 references/P6-enforcement-setup.md:40 references/P6-enforcement-setup.md:41 references/P6-enforcement-setup.md:42 references/P6-enforcement-setup.md:48 references/P6-enforcement-setup.md:49 references/P6-enforcement-setup.md:50 references/P6-enforcement-setup.md:51 references/P6-enforcement-setup.md:52 references/P6-enforcement-setup.md:53 references/P6-enforcement-setup.md:56 references/P6-enforcement-setup.md:57 references/P6-enforcement-setup.md:58 references/P6-enforcement-setup.md:59 references/P6-enforcement-setup.md:63 references/P6-enforcement-setup.md:65 references/P6-enforcement-setup.md:66 references/templates/issue-comment-format.md:10 references/templates/issue-comment-format.md:11 references/templates/issue-comment-format.md:12 references/templates/issue-comment-format.md:13 references/templates/issue-comment-format.md:14 references/templates/issue-comment-format.md:15 references/templates/issue-comment-format.md:16 references/templates/issue-comment-format.md:17 references/templates/issue-comment-format.md:18 references/templates/issue-comment-format.md:19 references/templates/issue-comment-format.md:20 references/templates/issue-comment-format.md:58 references/templates/issue-comment-format.md:73 SKILL.md:451 SKILL.md:457 SKILL.md:460 SKILL.md:463 SKILL.md:480 SKILL.md:486 SKILL.md:570 SKILL.md:702 SKILL.md:2060 SKILL.md:2111 SKILL.md:2159 SKILL.md:2181 SKILL.md:2185 SKILL.md:2188 SKILL.md:2262 SKILL.md:26 SKILL.md:26 SKILL.md:589 SKILL.md:1454 SKILL.md:1458
🔑 環境變數 (14)
references/P2-epic-coordinator-playbook.md:416 references/P4-compaction-recovery-walkthrough.md:213 references/P4-compaction-recovery-walkthrough.md:225 references/P4-compaction-recovery-walkthrough.md:230 references/P4-compaction-recovery-walkthrough.md:232 references/P4-compaction-recovery-walkthrough.md:243 references/P4-compaction-recovery-walkthrough.md:251 references/P4-compaction-recovery-walkthrough.md:295 references/P4-compaction-recovery-walkthrough.md:314 references/P4-compaction-recovery-walkthrough.md:450 references/P5-multi-instance-protocol.md:257 references/P5-multi-instance-protocol.md:265 references/P5-multi-instance-protocol.md:282 references/P5-multi-instance-protocol.md:297
審計單位: codex 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/emasoft-github-elements-tracking/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/emasoft-github-elements-tracking?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/emasoft-github-elements-tracking?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/emasoft-github-elements-tracking/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/emasoft-github-elements-tracking.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
Emasoft. (2026). github-elements-tracking security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/emasoft-github-elements-tracking/audits/9BibTeX 引用
@techreport{emasoft-emasoft-github-elements-tracking-2026,
author = {Emasoft},
title = {github-elements-tracking security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/emasoft-github-elements-tracking/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "github-elements-tracking security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "Emasoft"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/emasoft-github-elements-tracking/audits/9"
identifiers:
- type: other
value: "skillstore:emasoft-github-elements-tracking:audit:9"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 50
架構
85
可維護性
85
內容
70
社群
70
規範符合度
你可以打造什麼
恢復長時間任務
透過讀取 issue 檢查點與階段狀態，在上下文遺失後恢復工作。
協調代理階段
在 GitHub issue threads 之間分離開發、測試與審查責任。
稽核功能歷史
從 issue comments 追蹤認領、決策、測試結果與審查成果。
試試這些提示
開始追蹤
為此功能建立 GitHub issue 工作流程。定義階段、範圍、驗收標準與第一個檢查點。
認領工作
認領 issue <number>，識別目前階段，宣告範圍內的檔案，並發布起始檢查點。
恢復工作階段
讀取 issue <number>，並重建目前狀態、阻礙、已完成工作與下一步行動。
協調 Epic
審查 epic issue，對應進行中的 DEV、TEST 和 REVIEW threads，找出衝突，並提出下一波計畫。
最佳實務
- 在執行 GitHub CLI commands 前，確認 repository、issue number 與 phase。
- 在有意義的狀態變更時發布簡短檢查點，而不是每次小幅編輯都發布。
- 在安裝強制執行工作流程前，審查自動化片段與 token 權限。
避免
- 不要在記錄 REVIEW 通過之前合併 branches。
- 當 issue comments 承載專案記憶時，不要將其視為可選項目。
- 不要在未先檢查 commands 的情況下執行 skill 中的 setup scripts。
常見問題
這個 skill 需要 GitHub 嗎？
是。此工作流程依賴 GitHub Issues、labels、comments，並且通常需要 GitHub CLI。
它可以在沒有 SERENA MCP 的情況下執行嗎？
可以，但大型文件儲存與專案記憶同步可能會受到限制。
它會自行建立程式碼變更嗎？
不會。它提供助理在開發工作期間可遵循的協定與 command 範例。
強制執行設定是自動的嗎？
不會。repository 擁有者必須審查並安裝任何 GitHub Actions snippets。
誰應該使用這個 skill？
適用於需要持久狀態與階段追蹤的長時間開發工作。
使用前應該審查哪些內容？
審查 shell commands、GitHub token scopes、worktree paths 與外部 MCP 安裝步驟。
開發者詳細資訊
作者
Emasoft授權
MIT
Skillstore 修訂
r1
版本提示
作者未聲明版本。
儲存庫
https://github.com/Emasoft/ghe-marketplace/tree/main/plugins/ghe/skills/github-elements-tracking引用
30c73eac2afe762f6aa9c4553158769369d47351
維護新鮮度
2026/7/18
使用量
4 次下載 · 224 次瀏覽