安全审计
- 作者仓库星标 5,517
- 作者更新于 实时读取
- 作者仓库 msbuild
- 领域
- 安全
- 兼容 Agent
-
- Claude Code
- Cursor
- Cline
- Codex
- Windsurf
- Gemini CLI
- +20
- 信任分
- 88 / 100 · 社区维护
- 作者 / 版本 / 许可
- @dotnet · 未声明 license
- Token 消耗评级
- 中等消耗
- 接入复杂程度
- 需手动接入
- 是否需要外部 API Key
- 不需要
- 兼容的系统
- macOS · Linux · Windows
- 底层运行要求
- Node.js · Python
- 文件与系统权限
-
- 只读
- 允许写入 / 修改
- Shell 执行
- 网络行为
- 允许外网请求
- 安装命令数
- 26 条
档案由构建时根据 SKILL.md 与安装命令自动衍生,可能与作者实际意图存在差异。
需要注意: 未限定 allowed-tools,默认拥有全部工具权限。
---
name: project-management
description: GitHub issue and project-board management for the dotnet/msbuild repo. Use when asked to file/tr…
category: 安全
runtime: Node.js / Python
---
# project-management 输出预览
## PART A: 任务判断
- 适用问题:安全审计、密钥扫描、权限检查或风险分析。
- 输入要求:目标材料、限制条件、期望输出和验收方式。
- 证据边界:围绕“Where things live / Stable identifiers for project 117 / Tooling preference”读取原文规则,不把推断写成作者承诺。
## PART B: 执行结果
- **01** 任务判断:确认你的需求是否属于安全审计、密钥扫描、权限检查或风险分析,并标出输入、限制和预期结果。
- **02** 执行计划:优先按“Where things live / Stable identifiers for project 117 / Tooling preference”拆成步骤,说明每一步会读取什么、修改什么、产出什么。
- **03** 交付结果:给出可复制的命令、文件改动、检查清单或内容草稿,并说明如何继续迭代。
- **04** 风险边界:结合 读取文件、写入/修改文件、执行终端命令、会按任务需要访问外部网络、通常不需要额外 API Key 给出执行前确认项。
## Running Rules
- 读取文件、写入/修改文件、执行终端命令;会按任务需要访问外部网络;通常不需要额外 API Key。
- 先小样例验证,再放大到真实任务。
- 交付时同时给结果、检查口径和下一步迭代建议。 原文没有稳定的斜杠命令要求。安装验证后通常全局生效,直接在对话里点名这个 Skill 并描述任务即可。
告诉 Agent 目标文件或材料、期望结果、不可改范围、是否允许联网或执行命令。本 Skill 的权限画像是:读取文件、写入/修改文件、执行终端命令。
先用一个小任务确认它会围绕“Where things live / Stable identifiers for project 117 / Tooling preference”工作;涉及文件或命令时,先看 diff、日志、预览或测试结果。
检查最终产物是否包含明确结果、必要证据和下一步动作;如果输出泛泛而谈,就补充输入、边界和验收标准后重跑。
---
name: project-management
description: GitHub issue and project-board management for the dotnet/msbuild repo. Use when asked to file/tr…
category: 安全
source: dotnet/msbuild
---
# project-management
## 什么时候使用
- 把安全方向的常用动作沉淀成 Agent 可调用的技能 适合处理安全审计、密钥扫描、权限检查和风险分析,核心价值是把输入、判断、执行、验证和交付边界固定下来,避免 Agent 泛泛回答。 把任务拆成可执行、可检查、可继续迭代的步骤;通常不…
- 面向安全审计、密钥扫描、权限检查或风险分析,优先处理能明确输入、步骤和验收标准的工作。
## 需要提供什么
- 目标材料、目录范围、期望结果和不可改动内容。
- 是否允许联网、执行命令、读写文件或调用外部服务。
## 执行规则
- 围绕「Where things live / Stable identifiers for project 117 / Tooling preference」组织步骤,不把推断写成作者事实。
- 读取文件、写入/修改文件、执行终端命令;会按任务需要访问外部网络;通常不需要额外 API Key。
- 先跑小样例,确认结果可检查后再扩大任务范围。
## 输出要求
- 给出最终产物、关键证据、验证方式和下一步动作。
- 信息不足时标记 unknown,不编造命令、平台或依赖。 作者原文负责流程事实;仓库文件负责来源和命令;流狐只补充适用场景、限制和质量判断。
skill "project-management" {
输入层 -> 用户目标 + 目标文件 + 禁止范围 + 验收标准
上下文层 -> Where things live / Stable identifiers for project 117 / Tooling preference
规则层 -> SKILL.md 触发条件 / 执行顺序 / 输出格式
运行层 -> Node.js / Python | 读取文件、写入/修改文件、执行终端命令 | 会按任务需要访问外部网络
安全层 -> 通常不需要额外 API Key + 小任务验证 + diff / 日志复核
输出层 -> 可复制结果 + 检查清单 + 下一步迭代
} Project Management for dotnet/msbuild
This skill covers everything you need to manage issues and the project board for the MSBuild repository: querying, commenting, editing, creating issues, and bulk operations on the project board (sprints, status, assignees, etc.).
Where things live
- Repository:
dotnet/msbuild— all issues, PRs, and discussions. - Project board:
dotnet/projects/117— title "MSBuild". This is the canonical project board for the team. Most issues created indotnet/msbuildare auto-added or manually added here for sprint planning. - Sprints are tracked via the Sprint iteration field on project 117. Iteration titles use the format
2026 May I,2026 May II,2026 June I, etc. (roughly two-week iterations).
Note: there are/were other auxiliary project boards for specific initiatives. Use project 117 unless the user explicitly points at another one.
Stable identifiers for project 117
| Identifier | Value |
|---|---|
| Project node ID | PVT_kwDOAIt-yc4ABM5F |
| Sprint field ID (iteration) | PVTIF_lADOAIt-yc4ABM5FzgAtMGI |
These IDs are stable but can be re-derived if the project is ever recreated or migrated:
# Project node ID
gh api graphql -f query='{ organization(login:"dotnet") { projectV2(number:117) { id } } }'
# All field IDs (Sprint, Status, Area, Priority, …)
gh project field-list 117 --owner dotnet --format json | jq '.fields[] | {id,name,type}'
Tooling preference
For GitHub work, prefer gh CLI over MCP tools (per repo convention).
- Use
gh issue ...for issue-level operations (create / view / comment / edit / close). - Use
gh project ...for project-board CRUD. - Use
gh api graphqlfor anythingghdoesn't expose directly (sprint values per item, project-level field values, bulk reads).
The default gh token may not include the project scope. If a gh project ... write call fails with a scope error, ask the user to run:
gh auth refresh -s project
Common single-issue actions
# View
gh issue view 13315 --repo dotnet/msbuild --json title,body,state,assignees,labels
# Comment (use --body-file to avoid shell-quoting traps with multi-line markdown)
gh issue comment 13315 --repo dotnet/msbuild --body-file ./comment.md
# Amend body (overwrite — there is no append; use view → edit → write)
gh issue edit 13597 --repo dotnet/msbuild --body-file ./new-body.md
# Create
gh issue create --repo dotnet/msbuild --title "Title" --body-file ./body.md
# Add labels / assignees
gh issue edit 13315 --repo dotnet/msbuild --add-label "Area: Server" --add-assignee someuser
When drafting comments / bodies that summarize internal discussions:
- Use neutral, team-voice language ("the team agreed", "open question").
- Scrub names, "X said Y", room/agent identifiers, and anything resembling internal politics.
- Always write to a file and use
--body-file. Don't try to inline multi-line markdown.
Querying issue → project field values (sprint, status, project-level assignees)
gh issue view does not return project-board field values. Use GraphQL via the repository → issue → projectItems path:
gh api graphql -f query='
query {
r: repository(owner:"dotnet", name:"msbuild") {
issue(number: 13315) {
id
projectItems(first: 5) {
nodes {
id
project { number title }
sprint: fieldValueByName(name: "Sprint") { ... on ProjectV2ItemFieldIterationValue { title iterationId } }
status: fieldValueByName(name: "Status") { ... on ProjectV2ItemFieldSingleSelectValue { name optionId } }
}
}
}
}
}'
fieldValueByNamereturnsnullwhen the field has no value set on that item — handle accordingly.
Bulk / board-wide queries
The gh project item-list CLI command has internal limits and is unreliable for large boards (project 117 is in the thousands of items). Use GraphQL with pagination.
import subprocess, json
PROJECT_NUMBER = 117
ORG = "dotnet"
results = []
cursor = None
while True:
after = f', after: "{cursor}"' if cursor else ''
query = f'''query {{
organization(login: "{ORG}") {{
projectV2(number: {PROJECT_NUMBER}) {{
items(first: 100{after}) {{
pageInfo {{ hasNextPage endCursor }}
nodes {{
id
fieldValues(first: 20) {{
nodes {{
... on ProjectV2ItemFieldIterationValue {{
field {{ ... on ProjectV2IterationField {{ name }} }}
title
}}
... on ProjectV2ItemFieldUserValue {{
field {{ ... on ProjectV2Field {{ name }} }}
users(first: 10) {{ nodes {{ login }} }}
}}
... on ProjectV2ItemFieldSingleSelectValue {{
field {{ ... on ProjectV2SingleSelectField {{ name }} }}
name
}}
}}
}}
content {{
... on Issue {{ number title }}
... on PullRequest {{ number title }}
... on DraftIssue {{ title }}
}}
}}
}}
}}
}}
}}'''
try:
r = subprocess.run(['gh','api','graphql','-f',f'query={query}'],
capture_output=True, text=True, check=True)
except subprocess.CalledProcessError as e:
raise RuntimeError(f"GraphQL query failed: {e.stderr}") from e
page = json.loads(r.stdout)['data']['organization']['projectV2']['items']
for node in page['nodes']:
sprint = status = None
assignees = []
for fv in node.get('fieldValues', {}).get('nodes', []):
if not fv: # null entries for unset fields
continue
fname = (fv.get('field') or {}).get('name', '')
if fname == 'Sprint':
sprint = fv.get('title')
elif fname == 'Status':
status = fv.get('name')
elif fname == 'Assignees':
assignees = [u['login'] for u in (fv.get('users') or {}).get('nodes', [])]
results.append({'id': node['id'], 'sprint': sprint, 'status': status,
'assignees': assignees, 'content': node.get('content')})
if not page['pageInfo']['hasNextPage']:
break
cursor = page['pageInfo']['endCursor']
Updating project-board field values
Set a sprint (iteration) — first look up iteration IDs
Iteration IDs are short hex strings (e.g., 303c2425). They are not the same across projects; always look them up from project 117.
gh api graphql -f query='
query {
node(id: "PVTIF_lADOAIt-yc4ABM5FzgAtMGI") {
... on ProjectV2IterationField {
configuration {
iterations { id title startDate }
completedIterations { id title startDate }
}
}
}
}' | jq '.data.node.configuration | (.iterations + .completedIterations)[] | {id,title}'
Single-item field update — gh project item-edit
# Iteration / sprint
gh project item-edit \
--project-id PVT_kwDOAIt-yc4ABM5F \
--id <PROJECT_ITEM_ID> \
--field-id PVTIF_lADOAIt-yc4ABM5FzgAtMGI \
--iteration-id <ITERATION_ID>
# Single-select (Status, Area, Priority): use --single-select-option-id
# Text: --text | Number: --number | Date: --date YYYY-MM-DD
Single-item field update — GraphQL mutation (works the same)
gh api graphql -f query='
mutation {
updateProjectV2ItemFieldValue(input: {
projectId: "PVT_kwDOAIt-yc4ABM5F",
itemId: "<PROJECT_ITEM_ID>",
fieldId: "PVTIF_lADOAIt-yc4ABM5FzgAtMGI",
value: { iterationId: "<ITERATION_ID>" }
}) { projectV2Item { id } }
}'
Adding a freshly created issue to project 117
A newly-created issue is not always auto-added. To add and set its sprint:
ISSUE_NODE_ID=$(gh api graphql -f query='
query { repository(owner:"dotnet",name:"msbuild") { issue(number:13707) { id } } }' \
| jq -r '.data.repository.issue.id')
ITEM_ID=$(gh api graphql -f query='
mutation { addProjectV2ItemById(input:{
projectId:"PVT_kwDOAIt-yc4ABM5F",
contentId:"'"$ISSUE_NODE_ID"'"
}) { item { id } } }' | jq -r '.data.addProjectV2ItemById.item.id')
gh api graphql -f query='
mutation { updateProjectV2ItemFieldValue(input:{
projectId:"PVT_kwDOAIt-yc4ABM5F",
itemId:"'"$ITEM_ID"'",
fieldId:"PVTIF_lADOAIt-yc4ABM5FzgAtMGI",
value:{iterationId:"<ITERATION_ID>"}
}) { projectV2Item { id } } }'
Common errors and gotchas
1. Field 'fieldValueByName' has an argument conflict
gh api graphql --paginate (and several jq-style aliases) re-uses field names. If you call fieldValueByName(name:"Sprint") and fieldValueByName(name:"Status") in the same selection set without aliases, you'll get:
Field 'fieldValueByName' has an argument conflict: {name:"Sprint"} or {name:"Status"}?
Fix: alias each call.
sprint: fieldValueByName(name: "Sprint") { ... }
status: fieldValueByName(name: "Status") { ... }
2. gh api graphql --paginate produces concatenated JSON, not one document
Each page is emitted as a separate JSON object on stdout; piping straight into jq fails with "Invalid numeric literal". Either:
- paginate manually in a loop (preferred for large reads), or
- use
jq --slurpto read the stream as an array.
3. "Selections can't be made directly on unions"
field on a project field value is a union; you can't select name directly. Use a typed inline fragment per concrete field type (ProjectV2Field, ProjectV2IterationField, ProjectV2SingleSelectField, …).
4. Issue-level assignees ≠ project-board "Assignees" column
The board's "No Assignees" slice is driven by the project-level Assignees field, not by Issue.assignees. They can diverge. When filtering by board state, always read ProjectV2ItemFieldUserValue from fieldValues.
5. null entries in fieldValues.nodes
GraphQL returns null for items where a particular field is unset. Always guard if not fv: continue before dereferencing.
6. DraftIssue items lack number / repository
content may be a DraftIssue that only exposes title, body, assignees. Code that joins to issue numbers must handle None.
7. gh project item-list is unreliable for large boards
It silently truncates. Always use the GraphQL pagination loop above instead.
8. Missing project scope on gh token
Reads work; writes (gh project item-edit, the addProjectV2ItemById / updateProjectV2ItemFieldValue mutations) fail. Have the user run gh auth refresh -s project.
9. gh issue edit --body overwrites — there is no append
To "append" to a body, fetch with gh issue view --json body, append, write back with --body-file. For status updates, prefer a comment.
Sanitization checklist for comments / body edits
When summarizing meetings or chat threads into GitHub:
- ✅ Use team voice ("the team agreed", "open question", "follow-up needed").
- ✅ Keep objective, decision-relevant content (problem statement, scope, exit criteria, repro steps, numbers).
- ❌ No personal names or "X said / Y replied".
- ❌ No full email addresses of external contributors (use GitHub handles instead).
- ❌ No internal-only identifiers (room names, recording IDs, agent fleet identifiers, partner-team contractor names).
- ❌ No speculation about other teams' motives or anything resembling internal politics.
- ❌ No confidential roadmap dates or unreleased product details unless already public.
- Always show the user the proposed comment / body before posting (unless they've explicitly preapproved).
Common workflows
| Goal | Sketch |
|---|---|
| Add a status comment to N issues | for n in 13315 13702 …; do gh issue comment $n --repo dotnet/msbuild --body-file ./c-$n.md; done |
| Replace a one-line issue body with a full Context / Exit-criteria / Out-of-scope spec | gh issue edit <n> --repo dotnet/msbuild --body-file ./body.md |
| Move all unassigned items from sprint X to sprint Y | GraphQL pagination loop above + gh project item-edit --iteration-id per item |
| File a new issue and put it in the current sprint | gh issue create → addProjectV2ItemById → updateProjectV2ItemFieldValue |
| Audit "what's in the current sprint that has no owner" | GraphQL pagination loop, filter on Sprint == "<current>" and empty Assignees |
先判断是否适合
作者设计意图
作者的方法与取舍
边界和复核