spring-plugin-issue-delivery

spring-plugin-issue-delivery is a skill for Claude Code, Codex from explyt/spring-plugin. It costs 176 tokens per session (7,091 once invoked), scanned A, original, Apache-2.0.

An orchestration guide for taking a GitHub issue in the explyt/spring-plugin repository from requirements through review and merge. It coordinates separate agents in a shared checkout rather than writing the plugin code itself.

In plain words
What is it for?
It routes testing, coding, review, and question-answering tasks; writes briefs; checks results; and maintains task state for the issue.
Why use it?
It keeps issue work in a defined order, verifies each agent's result, and records decisions about pull-request splitting, stacking, and merging.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: agent in frontmatter; mentions subagents; mentions AGENTS.md.

Good fit It routes testing, coding, review, and question-answering tasks; writes briefs; checks results; and maintains task state for the issue.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/explyt/spring-plugin/spring-plugin-issue-delivery
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add explyt/spring-plugin --skill spring-plugin-issue-delivery
Clone the repo
git clone --depth 1 https://github.com/explyt/spring-plugin

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for spring-plugin-issue-delivery

README.md
[![agentmods](https://agentmods.dev/badge/skills/explyt/spring-plugin/spring-plugin-issue-delivery/github.svg)](https://agentmods.dev/skills/explyt/spring-plugin/spring-plugin-issue-delivery)
Your own site
<a href="https://agentmods.dev/skills/explyt/spring-plugin/spring-plugin-issue-delivery"><img src="https://agentmods.dev/badge/skills/explyt/spring-plugin/spring-plugin-issue-delivery/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for spring-plugin-issue-delivery

Your own site · 80×15
<a href="https://agentmods.dev/skills/explyt/spring-plugin/spring-plugin-issue-delivery"><img src="https://agentmods.dev/badge/skills/explyt/spring-plugin/spring-plugin-issue-delivery.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 176 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 7,091 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00176 $0.07091
Opus 5.5 $0.00070 $0.02836
Sonnet 5.5 $0.00035 $0.01418
Haiku 4.5 $0.00018 $0.00709

Measured yesterday against content hash 4b57ee30892b, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

spring-plugin-issue-delivery scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.explyt/skills/spring-plugin-issue-delivery/SKILL.md · 155 lines

How it starts

The opening of the file, as written. The whole thing — 155 lines — stays where its author put it; the contents beside it link to each section on GitHub.

spring-plugin issue delivery (orchestrator)

Role

You coordinate explyt/spring-plugin issues from research to merged, verified, documented behaviour. You own the order of steps, the briefs, the verification of every result, the user's decisions and the .tasks/<issue>/ state. Your direct actions are limited to: gitignored .tasks/ notes and memory; read-only git/gh; starting, waiting for and counting Gradle test runs; rebasing open PRs, resolving CHANGELOG-only conflicts and force-pushing the rebased commits (see Refreshing open PRs). Every code or test change happens inside a subagent or fork.

Issue/PR numbers below are evidence of past failures, not targets. Generic disciplines live in:

Concern Skill that owns it
Delegation, briefs, parallel waves, processing results orchestrator_routing
Red-green cycle test-driven-development
Evidence before any "done/green" claim verification-before-completion
Suite and environment checks before push finishing-a-development-branch
Code rules in this repo (threading, SPDX, bundles, tests) coding-guard
MCP tool contracts spring-mcp-contracts
IDE Java heap space, OOM, growth until restart, UI freezes jvm-heap-retention-attribution, intellij-freeze-attribution

Inputs: issue numbers and acceptance criteria; base public/main, which targets the latest supported IDEA line (262 when this was written; read AGENTS.md "Releases, branches and versions" before deciding backport lines); target modules (they decide backport line and PR shape). No issue yet (a defect found on the way, a follow-up, the next PR of a series) → a Code agent or fork files it with gh after a duplicate search over open and closed issues, citing line refs checked on public/main; read the number back before using it.

Critical constraints

  • One writer per checkout. Parallel writers each get their own sibling git worktree of the plugin checkout (git worktree add <plugin checkout>/../wt-<issue> -b <branch> public/main), never /tmp (VfsRootAccessNotAllowedError). Read-only agents and forks may run in parallel with anything. Never start Gradle in a checkout where another agent's Gradle run may still be alive: a parallel run in one checkout corrupted a CI-equivalent run and the sandbox index. At most one all-module run (:spring-bootstrap:test) at a time across all checkouts; module runs may overlap.
  • Do not wait for merges (user rule): independent issues run in parallel lanes; work that needs an unmerged PR stacks on that PR's branch (PR shapes).
  • Worktree lanes have no IDE index of their own: IDE tools given a relative path (read_file, edit_file, inspections) read the plugin checkout, not the worktree. Worktree briefs use absolute file paths and Gradle from the terminal. IDE MCP tools need projectPath=<plugin checkout> while several projects are open; an agent that omitted it died on "Unable to determine the target project".
  • Ask agents have no shell: never brief Ask to run git or gh. Git reads (git show public/main:<path>, git rev-parse, git log, git range-diff) and gh reads go to a Review agent or a fork briefed "read-only: change nothing, no push, no GitHub writes" (git fetch public is the one allowed ref update). Ask uses GitHub MCP reads only.
  • Never trust SHAs, issue/PR numbers, counts or reviewer claims from a report: verify SHAs, numbers and counts with your own read-only git/gh, and verify reviewer claims by reading the cited code. Fabricated SHAs, a swapped #633/#634 and several wrong review blockers happened; wrong counts in your own briefs stopped publish agents.
  • The user may rebase, merge or switch branches at any time, so the next writer's brief starts with reconciliation.
  • Destructive actions need the user's confirmation through ask_user_with_options (needs-user-decision until answered, refused → blocked): rewriting the history of a branch that exists on the remote (rebase + force push; one confirmation may name a list of PRs), deleting a remote branch or tag, removing a worktree with unpushed commits or whose git status --porcelain lists anything other than build output, killing any process the allowed list below does not cover, deleting a test sandbox index that shows no CorruptedException (e.g. to free disk). Allowed without asking: restoring test paths to the red commit on the agent's own branch, rebasing a branch that was never pushed, deleting a local branch or tag whose changes are verified on public/main or pushed, removing a worktree whose branch is pushed and whose git status --porcelain is empty or lists only build output (build/, .kotlin/), with git worktree remove --force only after that check, killing a Gradle/test process whose cwd is one of your checkouts after checking its cwd and start time when it is orphaned, hung, or running on a head a review blocker has superseded (whoever started it), deleting the system-test/index of a module test sandbox inside one of your checkouts after its log-test/idea.log shows CorruptedException and every Gradle/test process of that checkout has stopped (never an IDE's own index).
  • Free disk below ~15 GiB with parallel lanes (~10 GiB with one) corrupts sandbox indexes: stop before Gradle → remove worktrees of published PRs; still below → blocked.
  • No third-party or private project names or paths in PRs, issues, commits, or the briefs that produce them.
  • Uncertain facts become explicit fields (UNKNOWN, UNDECIDED, wireShapeAssumed, inactiveCount), never hidden or guessed; hide only what the framework never serves: in the code you commission and in your reports.

Read the full file on GitHub · 155 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday Changed · +1 lines 4b57ee30892b
  2. 2d ago Changed · +21 lines · +31 tokens per session 3a74350e9d53
  3. 3d ago First seen · 133 lines · 145 tokens per session scan A b9f40ed21a0c

Subscribe to this mod's changes

spring-plugin-issue-delivery is a skill published in the GitHub repository explyt/spring-plugin (164 stars, last pushed today), licensed Apache-2.0. It adds 176 tokens to every session and 7,091 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-13.

Related

Other skills, from other repositories

assemble-lib-rules

Connect the shared untrusted-data source group to new reusable OpenTaint sink groups. Use to wire new sink tags into security joins.

seqra/opentaint · 31 tokens

github-repository-management

A guide for managing software repositories and collaboration through GitHub. GitHub is a service for hosting code, issues, pull requests, reviews, and project discussions.

TencentBlueKing/bk-ci · 68 tokens

connect

Choose which wiki this session uses, the team project's pages on the Nimbalyst server or the project's local wiki of files, and connect a repository to its team project. Use at the start of a task before any wiki tool, when a wiki tool returns reponotbound, ambiguousproject, pinmismatch, projectnotaccessible…

nimbalyst/nimbalyst · 101 tokens

deliver-spec

Use when explicitly asked to deliver an approved GitHub or local spec through a reviewed pull request, or when a Project controller delegates one claimed implementation ticket.

chrisbanes/skills · 33 tokens

backlog

Read, work, and maintain a Git repo's deferred-work items in docs/backlog/, one file per item. Use when the user says "backlog", "check backlog", "what's on my backlog", "work the backlog", "address the backlog", "add to backlog", "clean up backlog", or when a review or task produced items that are real but not being…

umputun/cc-thingz · 96 tokens

analyze-external-methods

Analyze an OpenTaint scan's dropped external methods and decide which of them are propagators and optionally sinks. Use when a dropped-external-methods.yaml needs classification for dropped method type.

seqra/opentaint · 44 tokens