
from fufan-vibecodingcourse41
Orchestrates fetching GitHub issues, spawning fix & review sub-agents to open PRs and address review comments, with cron and watch modes for automation.
gh-issues is an orchestration skill that fetches GitHub issues, runs pre-flight checks, and spawns parallel sub-agents to implement fixes and open pull requests. It also monitors PR review comments and can spawn review-fix agents to address feedback. The skill supports interactive confirm flows, cron-safe single-issue spawning, and watch mode for continuous polling. All GitHub operations are performed via curl+REST (no gh CLI).
Use gh-issues when you want automated handling of GitHub issues: triage, auto-fix routine bugs, continuously process a backlog with cron, or respond to review comments automatically. It's suited for maintainers who want to reduce manual PR creation for straightforward fixes and for automation pipelines that integrate agent-based code fixes.
Designed for OpenClaw-style agents and sub-agents that can run shell commands and sessions_spawn. Works well with agents capable of git/curl operations and parallel sub-agent orchestration (e.g., Cursor, Claude Code-like orchestrators).
gh-issues is a comprehensive GitHub issue orchestration skill that fetches issues, spawns sub-agents to implement fixes, and monitors PR review comments. It uses curl + GitHub REST API exclusively (no gh CLI). The skill_md is thorough with 6 well-defined phases, argument parsing, fork mode, cron mode, watch mode, and claim-based deduplication. No bundled scripts to test.
Security deductions: -12 for shell injection risk (unquoted variables in curl commands like {SOURCE_REPO}, {title}, {body} in JSON templates), -15 for credential exposure (token in git remote URLs visible via git remote -v), -8 for global git config modification (credential.helper cleared globally), -3 for jq string interpolation without sanitization. The skill is well-structured and genuinely useful but the security model relies on the agent executing commands in a controlled environment. No evidence of malicious intent. No curl|bash, no hardcoded credentials, no data exfiltration, no auto-update mechanisms. The skill uses proper GitHub API auth patterns. Architecture is strong with clear phase separation, though the monolithic SKILL.md could benefit from splitting scripts/ references.