CtrlK
BlogDocsLog inGet started
Tessl Logo
PluginPublic

testland/bug-tracker-workflow

Use when defect counts or reports are wrong (missing top-severity bugs, fixed items counted as new, unmerged duplicates) or bug filing and transitions need automating. One workflow for Jira, Linear, GitHub Issues and Azure DevOps: dedupe before filing, severity vs priority, lifecycle and CI filing.

Quality

86%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files
Low

W011: Third-party content exposure detected (indirect prompt injection risk).

What this means

The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.

Why it was flagged

The workflow reads bug trackers (Jira, Linear, GitHub Issues, Azure DevOps) where outsider-submitted issues, bug descriptions, and comments are ingested and searched.

Where we found it

your-tenant.atlassian.net

domain · 6 sites

The plugin fetches Jira Cloud REST API v3 at the tenant's atlassian.net domain to search, create, and transition issues; issue titles, descriptions, and comments submitted by outsiders are ingested and acted upon.

api.linear.app

domain · 5 sites

The plugin queries the Linear GraphQL API at api.linear.app to search, create, and update issues; issue titles and descriptions written by outsiders are ingested and acted upon.

references/linear.md

31

ENDPOINT = "https://api.linear.app/graphql"

references/linear.md

66

r = requests.post(ENDPOINT, json={"query": QUERY, "variables": variables}, headers=HEADERS_KEY)

references/linear.md

103

r = requests.post(ENDPOINT, json={"query": STATES_QUERY, "variables": {"teamId": team_id}}, headers=HEADERS_KEY)

references/linear.md

147

r = requests.post(ENDPOINT, json={"query": UPDATE_QUERY, "variables": variables}, headers=HEADERS_KEY)

references/linear.md

172

r = requests.post(ENDPOINT, json={"query": SEARCH_QUERY, ...}, headers=HEADERS_KEY)

api.github.com

domain · 4 sites

The plugin fetches GitHub Issues REST API at api.github.com to search issues and read their titles/bodies; outsider-submitted issue content is ingested and acted upon.

references/github-issues.md

24

BASE = f"https://api.github.com/repos/{os.environ['GITHUB_REPO']}"

references/github-issues.md

51

r = requests.post(f"{BASE}/issues", json=payload, headers=HEADERS)

references/github-issues.md

125

"https://api.github.com/search/issues"

references/github-issues.md

139

r = requests.post(f"{BASE}/issues/{issue_number}/comments", json={"body": body}, headers=HEADERS)

dev.azure.com

domain · 5 sites

The plugin queries Azure DevOps Work Item Tracking REST API at dev.azure.com to search, create, and update Bug work items; outsider-submitted bug titles, descriptions, and comments are ingested and acted upon.

references/azuredevops.md

20

export ADO_ORG="https://dev.azure.com/my-org"

references/azuredevops.md

35

BASE = os.environ["ADO_ORG"]

references/azuredevops.md

72

r = requests.post(f"{BASE}/{PROJECT}/_apis/wit/workitems/$Bug?api-version=7.1", json=body, headers=HEADERS)

references/azuredevops.md

134

r = requests.post(f"{BASE}/{PROJECT}/_apis/wit/wiql?$top={top}&api-version=7.1", json={"query": query}, headers=...)

references/azuredevops.md

177

r = requests.get(f"{BASE}/_apis/wit/workitems?ids={ids_param}&fields={fields_param}&api-version=7.1", headers=...)

Report incorrect finding
Audited
Security analysis
Snyk