from-issue — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited from-issue (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Given a Jira issue key (e.g. SW-123), this skill reads the ticket via the Atlassian MCP, normalizes its requirement in whatever form it was written (narrative, Given/When/Then, bullet ACs, prose, or mixed), generates a set of Playwright tests, runs them locally, and opens a GitHub PR with a structured description. The PR is the review gate, and the GitHub-for-Jira app auto-links it onto the ticket. See ADR-0011.
Tell Claude what you want:
Use the from-issue skill on SW-123.
Or for experimentation (skip push/PR):
Use the from-issue skill on SW-123 with dry-run.
If the ticket's feature already has a generated spec, the skill augments that file (adds the new tests, and adds/modifies the Page Object as needed) instead of creating a new file — see ADR-0010. Re-running any ticket that already contributed to the file refuses. To force a separate file instead of augmenting:
Use the from-issue skill on SW-123 with --new-file.
The full procedural workflow is in references/workflow.md. Read that file before executing the skill.
Setup note: the Atlassian MCP must be connected (OAuth) for the Step 2 ticket read — defined at project scope in.mcp.json. Its read tools (mcp__atlassian__getAccessibleAtlassianResources,mcp__atlassian__getJiraIssue) are pre-authorized inallowed-toolsabove so reads don't prompt each run. If a future Atlassian MCP build renames those tools, update theallowed-toolsline to match.
references/workflow.md — the procedural workflowreferences/test-template.md — canonical test-file templatereferences/pr-description-template.md — structured PR body templatereferences/bucket-classification.md — Positive/Negative/Edge bucket definitions + worked examples (C.2.b)references/smoke-policy.md — @smoke selection criteria + worked examples (C.2.c)references/qa-analysis.md — Senior QA SDET judgment: when to merge/split/skip ACs (D.1)references/test-principles.md — F.I.R.S.T. principles for generated tests (D.1)references/playwright-conventions.md — Playwright best practices the skill follows (D.1)references/data-placement.md — inline vs. externalized (data/) test data decision rule (D.1.4)references/harness.md — data-driven config + autonomous harness growth (Phase H / ADR-0014)This skill invokes /scaffold-page-object (C.1) when a Page Object inferred from the AC text has no matching file in src/pages/.
docs/from-issue.md — learning guide with worked examplesdocs/adr/0008-custom-skills-pattern.md — why custom skills follow this layout~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.