creating-block-issues — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited creating-block-issues (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The target repo is a Spec Kit project: .specify/ exists at repo root, and at least one specs/<NNN>-<feature>/tasks.md is present with #### Block <X> — <name> PR-stack headings (the structure produced by /coding-skills:speckit-tasks and aligned with implementing-blocks). The repo has a GitHub origin remote.
This skill creates one tracking issue per Block, not per task. No epic, no per-task issues. Whoever picks up the issue (a human assignee or an automation pipeline that polls GitHub) runs the block-implement loop. The issue body is intentionally minimal (4 short bullets: pointer, heading, a 1-2 sentence summary, task IDs) and points at tasks.md as the source of truth; constitution, scars, conventions, and per-task acceptance criteria are NOT duplicated per issue (the assignee reads them from the file at implementation time).
If the repo is not a Spec Kit project, or tasks.md does not use the #### Block <X> structure, fall back to manual gh issue create per the project's own issue conventions.
Every block-issue body MUST match this exact shape — keeping the body minimal is the contract. Drift between issue and tasks.md is what we are explicitly avoiding:
- **Spec:** `specs/<NNN>-<feature>/tasks.md`
- **Block:** Block <X> — <name> (verbatim from the `####` heading in tasks.md)
- **What:** <1-2 sentences: what the block builds and why it exists, derived from the parent user story's **Goal** line and the block's task texts. Plain language, no FR/DI recap.>
- **Tasks:** T0NN-T0NN (tests), T0NN-T0NN (impl)
- **Notes:** <only when something is NOT already in tasks.md — human override, hint, or extra context. Omit the line if there's nothing to add.>That is the entire body. No "ready criteria" recap, no scar list, no dispatch boilerplate. The What line is a hook for humans scanning the issue list (and for the dispatch daemon's logs), not a second spec: hard cap of 2 sentences, summarize rather than enumerate, and never let it contradict tasks.md — when in doubt, say less and let the pointer carry the detail.
Cross-block dependencies are NOT recorded in the body. They go through GitHub's native Issue Dependencies feature (right sidebar → Development / Dependencies → Blocked by). Body-field "Blocked by: #N" lines drift away from reality the moment an issue closes; the native graph stays accurate.
Every issue this skill creates carries the swa-impl-block label. The label is the dispatch signal a downstream coder-agent daemon polls for; an unlabeled block-issue silently never gets picked up. The skill auto-creates the label in the target repo if missing (color #0E8A16, description Spec Kit block-implement dispatch (coder-agent)).
Additional project-specific labels (ready, priority, milestone) are NOT applied here — add them after creation with gh issue edit <N> --add-label <name> or via the GitHub UI.
If a consuming repo wants a different dispatch label name (or none), it can override at invocation time by passing --label <name> / --no-label through the wrapping /coding-skills:block-issues command. The default stays swa-impl-block.
.specify/feature.json for feature_directory. If absent, fall back to the current branch's <NNN>-<feature> prefix. Resolve to specs/<feature>/tasks.md. Abort with a clear error message if no Spec Kit feature is detectable.git config --get remote.origin.url. Must be a GitHub URL (github.com:owner/repo.git or https://github.com/owner/repo.git). Echo the resolved <owner>/<repo> back to the user before any state-changing operation. Never create issues in a repo whose `origin` URL was not just echoed.#### Block <X> — <name> headings. For each block:— ).#### or ### boundary in the "Tests for User Story" parent) + impl subsection (same scoping in the "Implementation for User Story" parent).3a. Coverage check (every task belongs to a block). Collect every - [ ] T\d{3} task ID in the file and verify each falls inside some block's heading-to-next-boundary range. Tasks outside any block (the classic case: a final "Polish & Cross-Cutting" phase with no #### Block heading) are an ERROR, not a silent skip — they would never get an issue and the feature ships without its closeout (scar: swell-storage-contracts 001 and 002 both needed manual post-hoc closeouts for exactly this). On uncovered tasks: report the orphaned IDs and ask the user whether to (a) fix tasks.md first by wrapping them in a ### Block <X>: Closeout (PR-<X>) heading (preferred; re-run after), or (b) proceed creating issues for covered blocks only, explicitly accepting the gap. Never proceed silently.
<owner>/<repo> + the would-be issue titles to the user. If the caller passed --dry-run, stop here and also render each issue's body verbatim; do NOT proceed to issue creation.gh issue list --search "Implement Block <X> in:title" --state all for each block. If any return a non-empty match, abort and report the existing issue numbers. Ask the user how to proceed (re-open via UI, skip the block, supersede with a new issue manually). Never overwrite or auto-close.--no-label was passed). Resolve the label name (default swa-impl-block, override via --label <name>). Run gh label list --search <name> to check. If absent, create it idempotently: gh label create swa-impl-block \
--description "Spec Kit block-implement dispatch (coder-agent)" \
--color "0E8A16"If gh label create fails because the label already exists (race), proceed silently. If it fails for any other reason (permissions), abort before creating any issues.
gh issue create \
--title "Implement Block <X> — <name>" \
--body "<rendered template>" \
--label swa-impl-blockOmit --label only when --no-label was passed. Capture the returned issue number per block.
{blocked_issue: [blocking_issues...]} pairs. Then:a. Fetch node IDs for every created issue in one batched query:
gh api graphql -f query='
{ repository(owner: "<owner>", name: "<repo>") {
issue26: issue(number: <N1>) { id }
issue27: issue(number: <N2>) { id }
...
}
}' --jq '.data.repository'b. Fire `addBlockedBy` mutation per dep edge (issue node IDs, not numbers):
gh api graphql -f query='
mutation { addBlockedBy(input: {
issueId: "<blocked_node_id>",
blockingIssueId: "<blocking_node_id>"
}) { clientMutationId } }'c. Error handling: if a single edge fails (already-exists, insufficient scope, network), report the specific failure and continue with remaining edges; do NOT abort the run. The failing edges fall back to the human-instructions block below. Common failure modes:
Resource not accessible by integration → token lacks issues:write scope. Fall back to printing the human-readable Blocked-by instructions.An error occurred while validating the input: issue is already blocked by ... → idempotent no-op; treat as success.d. Fallback for unset / failed edges (only when at least one edge failed in step (b/c)): print the copy-pasteable instruction block so the user can finish via UI:
Could not auto-set the following Blocked-by relations
(right sidebar → Development → Dependencies → Blocked by):
- Issue #<B>: blocked by #<A>
- Issue #<D>: blocked by #<B> and #<C>In the all-success path, skip this block entirely.
Created N block-issues for feature <NNN>-<feature> in <owner>/<repo>
(label: swa-impl-block):
#<A> Implement Block A — <name>
#<B> Implement Block B — <name>
...
Blocked-by relations set: K of M edges via addBlockedBy.
(Or: "All M edges set successfully." / "K edges fell back to manual; see above.")
Next step:
- Apply any additional project-specific labels (`ready`, priority, milestone) via `gh issue edit <N> --add-label <name>` or the GitHub UI.Two modes:
Heading-driven. Creates one issue per #### Block <X> — <name> in tasks.md. Argument shape:
.specify/feature.json. Attaches the default swa-impl-block label.001-uptime-settlement) → override the active-feature resolution.gh. Always echo the parsed block list + dependency graph + resolved label in dry-run mode.Task-ID-driven. Creates exactly one issue covering an arbitrary subset of tasks — partial-block (e.g. Block A's SwellParameters half), cross-block (e.g. Fisher-Yates spanning Blocks B + C), or cross-phase (e.g. Phase 1 + Phase 2 + a Block A subset). The skill does NOT parse #### headings in this mode — the caller asserts the scope.
Triggered by the presence of --tasks. Required args:
T008,T025-T027,T048. Skill expands ranges (T025-T027 → T025,T026,T027) and validates each ID exists in tasks.md; aborts with the missing IDs if any.Implement Block <X> (<subset name>) — <description> so existing-issue search still works. Examples: Implement Block A (SwellParameters) — epochEmission extension, Implement Block C (FisherYates) — Knuth shuffle library.Optional args:
Mode-2 body shape:
- **Spec:** `specs/<NNN>-<feature>/tasks.md`
- **Scope:** <verbatim from --title, with the "Implement " prefix stripped>
- **What:** <1-2 sentences composed from the selected tasks' texts: what this subset builds and why it exists. Same cap and tone as Mode 1.>
- **Tasks:** <expanded comma-separated task IDs from --tasks>
- **Notes:** <--notes value, omitted if absent>Mode-2 differences from Mode 1's execution flow:
--tasks list (the What line is composed from those tasks' texts instead of a Goal line).--title exact match instead of the Implement Block <X> pattern.origin URL was not just echoed to the user.tasks.md / CLAUDE.md.swa-impl-block, or whatever the caller passed via --label). Additional project-specific labels are the consuming project's PM-workflow concern — they go in via gh issue edit afterward.gh issue create / gh label create / addBlockedBy invocation back to the user before running it.addBlockedBy fails for any edge, report it explicitly and surface that edge in the manual-fallback block.gh issue create.tasks.md at implementation time; the issue body just points at it.tasks.md, not the issue.swa-impl-block by default) is the contract — it tells the downstream coder-agent the issue is ready to pick up. Priority, milestone, ready, area/* etc. are the consuming project's PM-workflow concern and go on after creation via gh issue edit. Baking multiple labels in here couples the skill to one project's workflow.implementing-blocks — the skill that consumes these issues (TDD + review + PR + CI fix loop, one Block per invocation).~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.