Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add renky1025/agent-skills --skill jira-server-pat-cligit clone --depth 1 https://github.com/renky1025/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/renky1025/agent-skills/jira-server-pat-cli)<a href="https://agentmods.dev/skills/renky1025/agent-skills/jira-server-pat-cli"><img src="https://agentmods.dev/badge/skills/renky1025/agent-skills/jira-server-pat-cli/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/renky1025/agent-skills/jira-server-pat-cli"><img src="https://agentmods.dev/badge/skills/renky1025/agent-skills/jira-server-pat-cli.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 3 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 259 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00274 | $0.02811 |
| Opus 5.5 | $0.00110 | $0.01124 |
| Sonnet 5.5 | $0.00055 | $0.00562 |
| Haiku 4.5 | $0.00027 | $0.00281 |
Grade A, and why
jira-server-pat-cli scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 150 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Jira Server / Data Center CLI
Purpose
为任意 Jira Server / Data Center 实例提供可迁移、可审计、无环境隐私的命令行管理方案。优先使用 Jira 官方 REST API 与运行时元数据发现，绝不把单个组织的配置写进本 Skill。产出是可复现的命令 序列与结构化 JSON 结果，而不是绑定某个实例的一次性脚本。
When to Use
- 用户要求通过脚本或 CLI 管理 Jira Server / Data Center。
- 实例使用 PAT、2FA、SSO、Cookie、Basic Auth、内部 CA 或自签证书。
- 任务涉及项目、issue、JQL、transition、评论、工时、附件、链接、watcher、权限或字段元数据。
- 触发词：Jira Server CLI、Jira Data Center 脚本、Jira PAT、jira_cli、Jira 自托管 REST。
When NOT to Use
- Jira Cloud — API token、
accountId、REST v3 与 Atlassian Document Format 语义不同，本 Skill 的 payload 与鉴权假设不成立。 - 用户只要 Jira Web 页面操作、不需要 REST 或 CLI。
- 目标接口属于第三方 Jira 插件，且尚未核对插件文档与版本。
Workflow
- 确认产品与版本。先确认目标是 Server / DC 而非 Cloud，再调用
python3 scripts/jira_cli.py server-info。记录但不持久化：Jira 版本与 build number、Base URL 是否含 context path（如/jira）、是否安装 Jira Software / Service Management、REST 版本与目标 endpoint 是否存在。不要用/login.jsp作为 Server/DC 的唯一识别依据。 - 选择鉴权。按
## Decision Rules的优先级选定鉴权方式；用户一旦提供 PAT 立即持久化，后续 直接读取配置，不再重复索取。 - 配置 TLS。默认走系统信任链，其次指定组织 CA PEM，
--insecure仅限临时诊断。 - 先探测，再写入。至少执行
whoami、server-info、projects、permissions --project PROJ四个只读命令，确认身份、实例与权限后再考虑写入。 - 发现运行时元数据。构造 create / update / transition payload 前，先按
references/field-metadata.md发现 issue type、字段、transition 的 ID 与可用字段集合。禁止使用 跨实例固定回退 ID。 - 处理分页与输出。所有列表与 JQL 搜索都要处理
startAt、maxResults、total，不能假设一次 返回全部结果。默认输出 JSON，便于jq、脚本与 Agent 做确定性解析；不要把面向人的表格文本当作 程序输入。 - 写操作先 dry-run 或读后写。创建、更新、transition 都支持
--dry-run，例如create PROJ Bug "Example" --dry-run、update PROJ-123 --summary "Updated" --dry-run、transition PROJ-123 "In Progress" --dry-run。真实写入前逐项确认：当前用户身份、项目与 issue 是否正确、权限是否满足、字段是否在 create metadata 或 edit metadata 中、transition 是否在当前 issue 的可用列表中、destructive 操作是否得到用户明确确认。 - 交付前自检。执行
## Verification的命令，并复述实际访问的实例类型与只读/写入范围。
Decision Rules
- 目标判定为 Cloud -> 停止并说明本 Skill 不适用，不要尝试用 Server/DC 假设绕过。
- 鉴权优先级：OAuth 2.0 > PAT Bearer > Basic Auth > 浏览器 Cookie（Cookie 仅为临时排障兜底）。
PAT 通过
Authorization: Bearer <token>发送，不附加用户名；新实例先用whoami验证。 whoami返回401/403-> 按references/auth-and-tls.md的五步顺序排查，不要直接断言被 SSO 接管。- 需要 TLS 定制、context path、反向代理或 2FA/SSO 细节 -> 读
references/auth-and-tls.md。 - 需要字段 / issue type / transition 的 ID 发现、名称本地化与歧义处理 -> 读
references/field-metadata.md。 - 需要判断 API 根路径、create metadata 版本行为、用户字段或描述格式差异 -> 读
references/version-differences.md。 - 收到非 2xx 状态码、需要判断是否重试 -> 读
references/troubleshooting.md。 - 目标能力没有专用子命令（agile、Service Management、插件端点、管理类接口）-> 用
request发起受控 REST 调用，并在执行前核对目标版本文档。 - 需要具体命令、参数与配置字段 -> 读
references/command-reference.md。
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -142 lines · +140 tokens per session 78a5c0d8a70c
- 1mo ago Changed · +31 lines 1048577365d1
- 1mo ago First seen · 261 lines · 134 tokens per session scan A 104c9cb05175
jira-server-pat-cli is a skill published in the GitHub repository renky1025/agent-skills (11 stars, last pushed 15d ago), licensed MIT. It adds 274 tokens to every session and 2,811 once invoked, about $0.0011 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
babysit
Use when a user asks to babysit, monitor, keep checking, keep an eye on, or report when a pull request, CI run, ticket, deployment, or other changing target reaches an outcome.
mindos-views
Manage shared local people and project tasks, generate reusable tables or boards, and compose/customize multi-source MindOS work pages with isolated custom HTML. Use when the user asks to maintain contacts, follow-ups or tasks, build a personal dashboard, or adjust a page with AI.
slack-agent
Use when building Slack agents/bots with eve (Vercel's filesystem-first agent framework), @vercel/connect, or eve/channels/slack. Covers defineAgent/defineTool patterns, Vercel Connect credential brokering, Slack channel setup, testing requirements, and quality standards.
find-skills
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
webman
Expert skill for the webman framework (a long-lived, in-memory PHP framework based on workerman). Covers routing, controllers, middleware, database/Redis, custom processes, timers, coroutines (v2), plugin development, and guarding against memory leaks and cross-request state pollution under the resident process model.…
governance-and-sustainability
Keep a project and its maintainers alive over years. Use when deciding how decisions get made, writing GOVERNANCE.md or a code of conduct enforcement process, adding or removing maintainers, handling burnout or stepping away, setting up funding (GitHub Sponsors, Open Collective, a foundation), handling a fork or a…