issue-suggest-component — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited issue-suggest-component (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Suggest a focused set of Jira components for a ticket — adding only what's clearly supported by evidence in the ticket, linked Confluence pages, and related GitLab activity. Confirm every change with the user.
| Trigger | Mode | Behavior |
|---|---|---|
/issue-suggest-component PROJ-1234 | Single | Deep context gather + suggest + per-change confirm |
/issue-suggest-component (no key) | Bulk | Loop highest-key-first, max 250 open tickets in the default project (resolved from memory: reference_jira_default_project.md) |
/issue-suggest-component ABC (project key only) | Bulk | Same as bulk, override project |
If the input is ambiguous, ask once.
Be conservative. Suggesting nothing is acceptable and often correct. Only propose a component when there is direct evidence in the ticket text, comments, linked Confluence, or related MRs/commits. Do not infer from issue key alone, from the assignee, or from "tickets nearby usually have X."
create_component tool is exposed (run discover_tools to check), surface the recommendation and instruct the user to create it manually in Jira.Single Progress:
- [ ] Phase 1: Resolve project + load existing components
- [ ] Phase 2: Gather ticket context (Jira)
- [ ] Phase 3: Pull related signals (Confluence + GitLab)
- [ ] Phase 4: Propose components with evidence
- [ ] Phase 5: Per-change confirm + applyPROJ-1234 → PROJ).jira_get_project_components to load the canonical component list. Cache it for the session.jira_get_issue — summary, description, type, priority, status, current components, labels, fixVersion, environment.jira_get_comments — investigation notes and additional context users provided.jira_get_remote_links — Confluence pages, MR URLs, dashboards.jira_get_changelog — note prior component changes (someone may have removed a component intentionally — respect that signal).confluence_get_page and skim for system/component names. If no remote links exist, skip — do not invent searches.get_merge_request and capture the file paths touched. These map most reliably to components.search_project_code to locate the owning module(s). Skip if no high-signal token.For each candidate, write one sentence of evidence. Map evidence → component using the existing component list. Format:
## Component suggestions for {KEY} — {summary}
**Currently set:** {list, or "none"}
### Proposed additions
| Component | Status | Evidence |
| --- | --- | --- |
| `auth-service` | existing | Stack trace in description references `auth/middleware.go`; MR !4521 touches that file. |
| `payments-ui` | **NEW** | Description mentions "checkout button"; no existing component covers the React checkout flow. |
### Suggested removals
_None._ (or list with reasoning)
### No change
_The ticket already has the right components._ (use this when applicable)If you have nothing to suggest, say so plainly: "No component changes proposed — current set looks correct given the available evidence." Then stop.
For each proposed addition (existing component), ask via AskUserQuestion:
For each proposed new component, ask a two-step question:
create_component tool exists, fall back: tell the user to create it manually in Jira and re-run the skill, then skip the addition for this ticket.After confirmations, apply additions in one jira_update_issue call setting the components field to the union of existing + approved-new. Confirm to the user with the final list.
If the user rejects every suggestion, end with one line: "No changes applied."
Bulk Progress:
- [ ] Phase B1: Resolve project + create scratch folder + load components
- [ ] Phase B2: Fetch open tickets (highest key first, cap 250)
- [ ] Phase B3: Per-ticket loop: light context + suggest + confirm
- [ ] Phase B4: Write rolling report
- [ ] Phase B5: Final summary + cleanup decisionreference_jira_default_project.md → **Default Jira project key:**). If memory is empty, prompt via AskUserQuestion and save the answer there. Accept per-invocation override.C:\temp\issue-suggest-component-{PROJECT}-{YYYYMMDD-HHMM}\ and tell the user the path once.jira_get_project_components.report.md in the scratch folder with a header.JQL: project = {KEY} AND statusCategory != Done ORDER BY key DESC
Paginate jira_search with max_results: 100 until you reach 250 issues or the project is exhausted, whichever comes first. Persist the harvested list to tickets.json in the scratch folder.
For each ticket capture only what's needed for triage: key, summary, description (first 1500 chars), components, labels, priority, created, plus any remote links to Confluence/GitLab.
For each ticket, light depth only:
jira_get_comments or jira_get_changelog per ticket — too expensive across 250 tickets.no-change and move to the next ticket without prompting the user.AskUserQuestion with options:For new-component proposals, do the two-step new-component flow from Phase 5.
Append the outcome (applied / skipped / stopped / no-change) to report.md after each ticket. This protects the report if the run is interrupted.
# Component Suggestion Sweep — {PROJECT}
**Started:** {YYYY-MM-DD HH:MM} · **Tickets scanned:** {N of 250} · **Project:** {KEY}
## Results
### {KEY-9999} — {summary}
- **Status:** applied · **Added:** `comp-a`, `comp-b` · **New created:** `comp-b`
- Evidence: {one-line summary of the strongest evidence}
### {KEY-9998} — {summary}
- **Status:** no-change · current components look correct.
### {KEY-9997} — {summary}
- **Status:** skipped · user declined.
...
## Summary
- Applied: {n}
- Skipped: {n}
- No-change: {n}
- New components created: {n} ({list})
- New components recommended (manual): {n} ({list})Print a one-screen summary of the totals. Ask via AskUserQuestion whether to keep or remove the scratch folder:
If the run aborted with an error, always keep the scratch folder and surface the path: "Partial state retained at {path}."
| Signal | Weight |
|---|---|
| Stack trace / file path / function name in ticket → matches a known module | Strong |
| GitLab MR linked from ticket touches files in a known module | Strong |
| Confluence design doc linked from ticket explicitly names a system | Strong |
| Ticket summary contains a system/feature name that matches a component verbatim | Medium |
| Reporter or assignee historically works on a component | Weak — do not use as primary evidence |
| "Looks like it might fit" with no concrete signal | Insufficient — do not suggest |
When in doubt, suggest nothing. The cost of an over-tagged ticket is higher than an under-tagged one because it pollutes filters and reports.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.