hoop: Skill for Claude Code

.claude/skills/build-ticket/SKILL.md

build-ticket is a skill for Claude Code from hoophq/hoop. It costs 58 tokens per session (2,685 once invoked), scanned A, original, MIT.

A workflow for taking a Linear ticket from its description to a draft pull request. Linear is a project-tracking tool, and the workflow investigates the code, implements the change, runs tests, and gets an independent quality check.

In plain words
What is it for?
Use it with bug, feature, or exploratory-work tickets identified by IDs such as EVL-86. It creates a design note, changes the code, runs tests and quality assurance, and prepares a draft pull request with evidence.
Why use it?
It removes the repeated coordination needed to understand a ticket, plan the change, verify it, and prepare it for review. It also stops when required ticket information is missing instead of guessing.

Skill for Claude Code

Written for Claude Code: installed under .claude/. Also seen: reads .claude/ paths; mentions CLAUDE.md; mentions subagents.

This is hoophq/hoop's own configuration. It tells Claude Code how to work on hoop itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything hoop configures →

Reuse

Borrowing it

Nothing to install: this file belongs to hoophq/hoop. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/hoophq/hoop/main/.claude/skills/build-ticket/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/hoophq/hoop

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for build-ticket

README.md
[![agentmods](https://agentmods.dev/badge/skills/hoophq/hoop/build-ticket/github.svg)](https://agentmods.dev/skills/hoophq/hoop/build-ticket)
Your own site
<a href="https://agentmods.dev/skills/hoophq/hoop/build-ticket"><img src="https://agentmods.dev/badge/skills/hoophq/hoop/build-ticket/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for build-ticket

Your own site · 80×15
<a href="https://agentmods.dev/skills/hoophq/hoop/build-ticket"><img src="https://agentmods.dev/badge/skills/hoophq/hoop/build-ticket.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 58 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,685 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00058 $0.02685
Opus 5.5 $0.00023 $0.01074
Sonnet 5.5 $0.00012 $0.00537
Haiku 4.5 $0.00006 $0.00268

Measured 3d ago against content hash 64107b050003, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

build-ticket scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -s -D - -o /dev/null -H 'content-type: application/json' \
.claude/skills/build-ticket/SKILL.md · 211 lines

How it starts

The opening of the file, as written. The whole thing — 211 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Build a ticket

Input: a Linear ticket ID. Output: a draft PR that passed independent QA, with evidence.

Write every Linear and GitHub field in English, whatever the conversation language.

Autonomous mode

When HOOP_AGENT is set, the support-agent skill started this run from a schedule and no person reads the session. Then:

  • A step that says show the human a result: attach it to the ticket and continue.

  • A step that says stop, wait for or ask the human: ask as support-agent step 5 says, and end the run. A later run resumes from the ticket.

  • A support ticket is shaped as a comment, never in its description. The ai-disclosure hook refuses description edits.

  • The stack: the usual make targets, in this order in a cloud session:

    1. Start Docker: pgrep dockerd || (dockerd >/tmp/dockerd.log 2>&1 &).

    2. Make the .env: cp .env.sample .env, sed -i '/^AUTH_METHOD=/d' .env, echo AUTH_METHOD=local >> .env (the first value of a key wins).

    3. make run-dev-postgres, then make run-dev in the background; wait for /api/healthz. The environment sets HOOP_RS_BUILD=0 and HOOPDEV_CA_CERT.

    4. Register the admin and upload the Enterprise license, or the sidecar routes answer 403. The token goes to a file: shell variables do not survive between commands, and rec.mjs reads the same file.

      curl -s -D - -o /dev/null -H 'content-type: application/json' \
        -d '{"email":"[email protected]","password":"Dev-Passw0rd","name":"Admin"}' \
        http://127.0.0.1:8009/api/localauth/register |
        sed -nE 's/^[Tt]oken: (.*)\r?$/\1/p' | tr -d '\r' > /tmp/hoop-dev-token
      curl -sf -X PUT http://127.0.0.1:8009/api/orgs/license -H 'content-type: application/json' \
        -H "authorization: Bearer $(cat /tmp/hoop-dev-token)" -d "$HOOPDEV_LICENSE"
      

    After make build-dev-webapp, git checkout the two package-lock.json unless the ticket changes them. Without Docker, scripts/dev/run-sandbox.sh (--ui for the UI) runs gateway and agent on PGlite, with no database for a connection to test against. It uploads the license itself.

  • A sidecar: make test-sidecar-e2e runs here. By hand, hoop start sidecar --config <file> in front of the dev Postgres (127.0.0.1:5449); unlicensed it takes one guardrail and one mask rule, and HOOP_LICENSE="$HOOPDEV_LICENSE" lifts that. Managed by the gateway: POST /api/sidecars returns its token, then HOOP_CONTROL_PLANE_URL=http://127.0.0.1:8009 hoop start sidecar --token <token>. When a test fails here, read the same test in the PR's CI job before you chase it: a cloud sandbox can differ from the CI runner.

  • Commits go in the owner's name (the environment sets GIT_AUTHOR_* and GIT_COMMITTER_*) and end with the Co-Authored-By: Claude and Claude-Session: lines: the CLA passes, and each commit still says an AI wrote it.

  • The sandbox is discarded after the run: push the branch after each commit. The evidence is how a person knows the work is right: a PR without its comparison images in "Testing" is not done. Run the evidence skill (Skill tool): a flow, in the UI or in a terminal, is a video with its steps explained on screen. QA's captures are raw material: compose them (evidence step 4), then publish them with .claude/skills/evidence/publish.sh (evidence step 6). That is the upload route of a cloud session; a capture left in the sandbox is lost with it.

  • gh can be missing: use the GitHub MCP tools.

  • The PR description starts with Opened by the support agent (AI) from <ID>. It opens as a draft, so nobody reviews it before QA. When QA passed, its evidence is in "Testing" and CI is green, mark it ready for review (update_pull_request, draft: false): Qodo reviews it while this session listens. A person merges it.

  • Once the draft PR exists, subscribe_pr_activity on it. Its CI results and review comments (Qodo once it is ready, reviewers) wake this session after the run ends. On each wake: fix a red check this PR caused and push; verify each review finding, then fix and push it or reply why not; reply on each thread you addressed and resolve it. Each reply starts with Support agent (AI):. Never merge it. Unsubscribe when it is merged or closed.

Read the full file on GitHub · 211 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago Changed · +68 lines 64107b050003
  2. 10d ago Changed · +4 lines 763fbc266f25
  3. 12d ago Changed · +11 lines 5208b6878e03
  4. 13d ago First seen · 128 lines · 58 tokens per session scan A 69c7c644c3bc

Subscribe to this mod's changes

build-ticket is a skill published in the GitHub repository hoophq/hoop (837 stars, last pushed today), licensed MIT. It adds 58 tokens to every session and 2,685 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-14.

Related

Other skills, from other repositories

review-prs

Review a GitHub pull request in the googleapis/mcp-toolbox repo against the team's reviewer checklist: PR title/description conventions, linked issue, logic errors and unhandled edge cases, breaking changes, test coverage, docs updates, security (input handling), and new dependencies. Use whenever a maintainer asks…

googleapis/mcp-toolbox · 162 tokens

stale-sweep

Sweep the googleapis/mcp-toolbox repo for issues and PRs with no real activity in N days (default 60), sort each by whose silence it is (the author's, ours, or nobody's), and draft the nudge or close comment. Use whenever a maintainer asks for a stale sweep, backlog cleanup, or an SLO check, e.g. "stale sweep", "find…

googleapis/mcp-toolbox · 159 tokens

linear-tickets

Create or update high-quality Linear tickets while preserving the originating report, diagnostic links, attachments, and reporter/requester attribution. Read this whenever someone asks to create, recreate, or update a Linear issue.

langchain-ai/open-swe · 44 tokens

github

GitHub operations via gh CLI: issues, PRs, CI runs, code review, API queries. Use when: (1) checking PR status or CI, (2) creating/commenting on issues, (3) listing/filtering PRs or issues, (4) viewing run logs. NOT for: complex web UI interactions requiring manual browser flows (use browser tooling when available)…

opensquilla/opensquilla · 101 tokens

imaging-data-commons

Query and download public cancer imaging data from NCI Imaging Data Commons using idc-index. Use for accessing large-scale radiology (CT, MR, PET) and pathology datasets for AI training or research. No authentication required. Query by metadata, visualize in browser, check licenses.

synthetic-sciences/openscience · 62 tokens

geo-database

Access NCBI GEO for gene expression/genomics data. Search/download microarray and RNA-seq datasets (GSE, GSM, GPL), retrieve SOFT/Matrix files, for transcriptomics and expression analysis.

synthetic-sciences/openscience · 47 tokens