skills.rest
antstanley
antstanleyCOMMUNITY
Explore all skills by this author →
GitHub

track-findings

Track validated security scan findings as Linear, Jira, or GitHub issues and advisories.

Updated May 4, 2026
Search Tags:#issue tracking#linear#vulnerability management#jira#duplicate detection#security findings#github advisory
One-click install
npx skills add https://github.com/antstanley/skills --skill track-findings-antstanley
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: track-findings
Source: https://github.com/antstanley/skills/tree/main/plugins/security/skills/track-findings
Command: npx skills add https://github.com/antstanley/skills --skill track-findings-antstanley

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? After a security scan produces validated findings, teams still need to file them into issue trackers without duplicating existing tickets, leaking sensitive details into public destinations, or losing the binding between a finding and its tracked issue. This Skill turns a sealed Security scan bundle into approval-gated Linear, Jira, or GitHub issues, or a draft GitHub security advisory, with verified readback. ## Core Features & Use Cases - Sealed-source validation: Runs validate_tracking_source.py against the scan bundle before any provider call, and reads findings only from scan-manifest.json and findings.json. - Multi-provider tracking: Creates, reuses, or updates issues in Linear (MCP), Jira Cloud (Atlassian MCP), or GitHub (gh CLI or GitHub app), plus single-finding draft GitHub security advisories. - Duplicate detection and approval gates: Searches by finding id and fingerprint, previews exact payloads, requires explicit approval, rechecks state after approval, and verifies every write via readback. - Use Case: After a sealed repository scan reports 12 validated findings, select 5 of them, preview the exact Jira issues with commit-pinned source links, approve once, and have each issue created serially with verified readback. ## Quick Start Track finding F-0042 from the sealed scan directory ./scan-output as a GitHub issue in the verified source repository.

Frequently Asked Questions about track-findings

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I track security scan findings in Jira or Linear?▼

Point the Skill at a sealed scan directory and select one finding or an explicit batch of up to 25. It validates the bundle, checks for duplicates by finding id and fingerprint, previews the exact issue payload, and writes only after your approval with verified readback.

How do I create a draft GitHub security advisory from a scan finding?▼

Select a single finding from a sealed scan whose target is a git_revision with a verified public canonical source repository. The Skill builds the advisory payload, runs a private duplicate check, and creates one draft via gh api after explicit approval; it never publishes or updates advisories.

Can I file a bug in Jira without a sealed scan directory?▼

No. This Skill requires a sealed scan bundle that passes validate_tracking_source.py before any provider work. Ad-hoc bug filing without a scan should be done directly with the provider's ordinary tools.

What happens when a finding already has an existing issue?▼

The Skill searches by exact finding id and fingerprint, then reviews plausible semantic matches. It chooses create, reuse, update, or blocked per finding, and reuse or update still requires a fresh preview, approval, and readback verification.

Why does tracking stop before creating any issues?▼

Runs stop when source validation fails, the destination or visibility is ambiguous, duplicate results are uncertain, or required access is missing. For GitHub advisories, an unverified git_revision source also blocks the run entirely.

Related Skills

Explore More Software Engineering Skills→
IEatCodeDailyIEatCodeDaily

vulnerability-validation

Validate commit-security-scan findings for exploitability and output validated-findings.json.

Community
Advanced
dallascrilleydallascrilley

linear-github-sync

Synchronize Linear issues with GitHub branches, commits, and pull requests.

Community
Intermediate
ElbertePlinioElbertePlinio

vulnerability-validation

Validate code scan findings and generate structured JSON with exploitability details.

Community
Intermediate
openaiopenai
5.3k

track-findings

Track validated security scan findings as Linear, Jira, or GitHub issues and draft advisories.

Official
Advanced