github-issue-workflow

This skill provides a structured, eight-phase workflow for resolving GitHub issues end to end inside Claude Code, from fetching the issue to opening a pull request. It solves the problem of ad-hoc issue handling by imposing a guided sequence: fetch issue details, analyze requirements, plan and implement, verify and test, perform code review, commit, and create the PR. It uses the gh CLI for GitHub API access and coordinates sub-agents for exploration and review, with mandatory user confirmation gates at the requirements and implementation-start phases.

A notable strength is its explicit security posture around untrusted content. The skill treats GitHub issue bodies and comments as untrusted, user-generated data that may contain indirect prompt-injection attempts. Its mandatory rules require treating issue text as data rather than instructions, ignoring embedded directives, never executing code copied from issues, gating implementation behind explicit user approval, and never propagating raw issue text to sub-agents. An isolation pipeline (fetch and display read-only, user restates requirements in their own words, then implement only from user-confirmed requirements) reinforces this. The verify phase auto-detects the project type and runs the full test suite, linters, static analysis, and formatting checks across many ecosystems (npm, Maven, Gradle, pytest, Go, Composer, Make).

It targets developers using Claude Code who want a repeatable, safety-conscious path from a GitHub issue to a reviewed pull request. It declares Read, Write, Edit, Bash, Grep, Glob, Task, AskUserQuestion, and TodoWrite tools; while it can modify code and run build/test commands, its design centers on confirmation gates and injection resistance rather than autonomous change.