Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kurone-kito/idd-skill --skill issue-authoringgit clone --depth 1 https://github.com/kurone-kito/idd-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kurone-kito/idd-skill/issue-authoring)<a href="https://agentmods.dev/skills/kurone-kito/idd-skill/issue-authoring"><img src="https://agentmods.dev/badge/skills/kurone-kito/idd-skill/issue-authoring.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 62 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 147 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00071 | $0.03833 |
| Opus 5 | $0.00036 | $0.01917 |
| Sonnet 5 | $0.00014 | $0.00767 |
| Haiku 4.5 | $0.00007 | $0.00383 |
Grade A, and why
issue-authoring scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 293 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Issue Authoring
Use this skill to prepare issue-ready work before execution starts. Keep the skill concise and treat the repository docs as the canonical source for the full contract and schema. The canonical source bundle lives in this repository; install copies in the agent-specific skill directory your runtime reads.
Stable Phases
Use two stable phases:
- Intake and Clarification — inspect relevant context, identify
ambiguity, run a secondary critique or explicit self-critique, and
ask only the questions that block safe issue drafting. Keep
clarification bounded; use the repository-local
issueAuthoring.maxClarificationRoundsvalue when available, otherwise default to 3 rounds. Under-clarification stop rule: if, after bounded clarification, you still cannot name the concrete surface to edit or an objective verification for a candidate task, route it toneeds-decisionor ask — do not publish a confidently-vaguereadyissue. Reliability over speed. - Decompose and Draft — restate the request in implementation terms, split it into atomic tasks, classify readiness, reuse existing issues when safe, and draft the smallest issue shape that preserves dependencies and reviewability.
Preserve low-readiness work in stable buckets: ready, deferred, needs-decision, blocked-by-human, and out-of-scope.
Workflow
- Read the bundled contract in references/contract.md.
- Reuse or extend an existing issue before creating a new one — but never edit the body of an actively-claimed or open-PR issue (its claimed agent will not pick the change up); cover it with a follow-up issue instead. See the contract's claim-state precondition.
- Choose the smallest safe output shape:
- orphan issue for one ready autonomous task only when the target
repository discovers orphans (
issue-scope: roadmap-first, the default, via the orphan fallback, ororphan-first) and any configuredorphan-first-policyapproval step can be completed after drafting - roadmap plus sub-issues for multi-task or multi-session work
- stable non-ready buckets for deferred, needs-decision, blocked-by-human, or out-of-scope work
- orphan issue for one ready autonomous task only when the target
repository discovers orphans (
- Prefix-first: resolve the target repository's marker prefix
before emitting any authoring marker —
roadmap-id,blocked-by,autopilot-suitability, oreffort. Use the prefix documented by the target repository's onboarding or IDD docs, and ask the user instead of guessing when the prefix is not discoverable. Never default to this source repository'sidd-skillprefix in an installed bundle. - Keep dependencies machine-readable and minimal:
- roadmap identity via
<!-- <marker-prefix>-roadmap-id: ... --> - active child issues via roadmap task-list links
- issue-to-issue dependencies via
Blocked by #NNN - sequential roadmap dependencies via
<!-- <marker-prefix>-blocked-by: ... -->only when a separate roadmap must close first - keep independent sibling work in roadmap task lists unless a true correctness, availability, or ordering constraint requires a dependency edge
- roadmap identity via
- Before publishing a ready orphan, roadmap, or child body, run the
audit-authored-issuelinter against it as the mechanical pre-publish gate — see Mechanical pre-publish gate in the bundled contract, including the manual fallback forinstructions-onlyinstalls with no helper runtime. Resolve every reported failure before treating the issue as ready. Before newly publishing a body into theneeds-decisionorblocked-by-humanbucket instead, also run the linter, passing--expect-bucket <needs-decision|blocked-by-human>(choose the one matching value) — the same gate section's--expect-bucketflag requires the matchingauthoring-bucketmarker for that publish, closing the gap where a non-ready body would otherwise never be audited at all. - Publish each
readydrafted body directly under the authoring hold once it passes the mechanical gate (step 6) and the critique pass (the Intake and Clarification phase above) — no separate publish approval is needed. Only skip publishing when the current request explicitly asked for a preview instead. Manage the authoring label for each created or updated issue:- resolve
issueAuthoring.authoringLabelName, defaulting tostatus:authoring - create the label with
gh label createbefore first use when the target repository does not already have it - treat label creation or application failure as a publishing blocker
- apply the label before updating an existing issue
- acquire per-target ownership before editing an existing issue or roadmap; the shared label is a claim-suppression lock, not an owner token. Follow the append-only owner-marker and re-read protocol in references/workflow-boundary.md and stop without editing when ownership or the target snapshot conflicts
- for a new Stage 1 set, generate one opaque set ID and reuse it in every owner marker for that set; when resuming an interrupted set, recover and verify its persisted set ID from the exact trusted owner markers and reuse it instead of generating a replacement; never infer set membership from the label alone
- when a set includes a parent roadmap, publish a valid roadmap shell under
the authoring hold before any child; acquire and verify that roadmap as
the set anchor, leaving its
## Trackslist empty only until child issue numbers exist. Without a parent roadmap, use the designated lead target as the anchor - acquire and verify the set anchor before publishing or acquiring any child; do not acquire children independently, and stop all edits if any target cannot join that anchor's verified set
- before each child acquisition or resume, append and verify a same-owner anchor heartbeat, re-fetch the anchor's paginated log, then append the child marker and immediately re-fetch both anchor and child. Stop with the label in place if anchor ownership changed between those reads
- persist the anchor's canonical repository/issue identity in every owner marker for the set; the anchor marker points to itself, and a resume must stop if the interrupted set's anchor cannot be proven
- immediately before every Stage 1 body or relationship edit, re-fetch both the edited target and the set anchor; require each target's expected owner token independently, plus the same set, anchor, and owning session, and require an unchanged expected target snapshot before editing
- immediately before that edit, renew both generations with a trusted same-owner-per-target heartbeat marker (one marker when target and anchor coincide), re-fetch and verify both, and stop if renewal or ownership verification fails
- create new issues only through a capability-checked publication command that applies the authoring label atomically and carries an exact hidden publication token for target, anchor, set, and session; if that operation is unavailable, stop before creating the issue — never intentionally create an unlabeled issue
- the hidden publication token is this exact HTML-first body line:
- resolve
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · +9 lines a962bcb03864
- 8d ago First seen · 284 lines · 71 tokens per session scan A 5165b5a7c169
issue-authoring is a skill published in the GitHub repository kurone-kito/idd-skill (11 stars, last pushed today), licensed MIT. It adds 71 tokens to every session and 3,833 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
grill-me
Grill the user about a requirement, decision, or idea before implementation, then produce an actionable planning report without writing code. Use when the user wants to clarify requirements, stress-test an idea, compare approaches, or plan before coding.
triage
Apply a formal state machine to issues — assign category (bug/enhancement/question/spike) and state (needs-triage → needs-info → ready-for-agent → ready-for-human → wontfix). Issues marked ready-for-agent become inputs to supergraph:plan. Use when processing a backlog, reviewing new issues, or preparing work for…
prd-to-issues
A planning skill that turns an existing product requirements document, or PRD, into small GitHub Issues that developers can implement and verify. It groups work into complete user-facing slices instead of separate front-end, back-end, testing, and documentation tasks.
project-context-steward
A project-documentation skill that scans a new project or several related code repositories and records their shared context in a PROJECT_CONTEXT.md file. It captures the product, users, workflows, architecture, repository boundaries, terminology, entry points, and known pitfalls.
kelly-support
Personal App-in-Skill customer-support desk (help desk) that triages incoming support tickets from email, WhatsApp, web chat, contact forms, and WeChat, drafts KB-grounded replies, and proposes actions, then holds every send behind a human approval queue with a pre-send quality gate (support-qa) that outputs…
kelly-standup
A team standup board that turns daily updates into shared records of what each person did, plans to do, and is blocked on. A standup is a regular team check-in, often held asynchronously in chat or a shared document.