Menu
Create a security ticket in JIRA for a CVE from a GitHub Dependabot alert URL.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Use when creating, opening, or submitting a pull request in a Dimagi mobile/CommCare repo โ identified by JIRA-prefixed branches (e.g. CCCT-1929-...), a `RELEASES.md` with `### Release Notes` and `### QA Notes` sections, and the dimagi PR template (Safety story / Product Description / Technical Summary / QA Plan). Also triggers on "ship this" or when implementation is complete and ready to push. For repos without these conventions, use the generic `create-pr` skill instead.
Fix CI failures and address review feedback on the current branch's PR. Use when CI is failing, review comments need addressing, or you need to push fixes for an open PR. Supports --dry-run to preview without changes.
Run a full dependency audit for a project โ covers Python (pip-tools) and front-end (npm/yarn) if present. Produces report, applies safe bumps, emits Jira-ready ticket list for risky/EoL items. Use when running quarterly maintenance or on demand.
End of day wrap-up โ captures what got done, what didn't, and plans for tomorrow. Weekly close-out on configurable review day (default Friday).
Conversational skill for reviewing, updating, and refining your professional goals.
Morning check-in โ surfaces goals, summarizes where you left off, captures today's plan, and gives goal-alignment feedback. Weekly review mode on configurable review day (default Friday).
| name | jira-cve |
| description | Create a security ticket in JIRA for a CVE from a GitHub Dependabot alert URL. |
| argument-hint | <github_dependabot_alert_url> |
Given a GitHub Dependabot security alert URL, fetch the alert details and create a security ticket in the SAAS project using the standard CommCare HQ format.
$ARGUMENTS โ A GitHub Dependabot security alert URL. Examples:
/jira-cve https://github.com/dimagi/commcare-hq/security/dependabot/740/jira-cve https://github.com/dimagi/commcare-android/security/dependabot/12Parse the URL to extract <owner>/<repo> and <alert_number>, then run:
gh api repos/<owner>/<repo>/dependabot/alerts/<alert_number>
From the response, extract:
| Field | JSON path |
|---|---|
| Package name | dependency.package.name |
| Ecosystem | dependency.package.ecosystem |
| Severity | security_advisory.severity |
| CVE ID | security_advisory.cve_id (may be null) |
| Patched version | security_vulnerability.first_patched_version.identifier |
| Summary/description | security_advisory.summary |
| Alert URL | html_url (use this as the GitHub link; falls back to the original $ARGUMENTS URL if absent) |
Ecosystem mapping:
| GitHub ecosystem | Ticket label |
|---|---|
pip | py |
npm | js |
maven | java |
| anything else | use the raw value |
Repo label: use only the repository name portion of the URL (e.g.
commcare-hq, commcare-android), not the full owner/repo.
SAAS (always)dbff467f-3c3f-4ced-a2ba-a29e1941edd6Data Privacy / Security (always)customfield_10160customfield_10010The summary must follow this exact format:
[Security: <repo> <py|js> <level>] Upgrade <package> to <patched_version> or later
Examples:
[Security: commcare-hq py high] Upgrade pillow to 10.3.0 or later[Security: commcare-hq js critical] Upgrade lodash to 4.17.21 or later| Severity | Jira Priority | Jira ID |
|---|---|---|
| critical | P1 | 1 |
| high | P2 | 2 |
| medium | P3 | 3 |
| low | P5 | 5 |
Always set priority via additional_fields: "priority": {"id": "<id>"}.
Assign to self โ use atlassianUserInfo to get the current authenticated
user's account ID.
Structure the description as:
**Package:** <package>
**Patched version:** <patched_version> or later
**Ecosystem:** <py|js>
<If CVE ID present: **CVE:** <CVE-ID> โ https://www.cve.org/CVERecord?id=<CVE-ID>>
**GitHub alert:** <original URL from $ARGUMENTS>
<security_advisory.summary from the alert>
**Fix:** Upgrade `<package>` to `<patched_version>` or later in the relevant
dependency file (requirements/*.txt or package.json as appropriate).
Always Task.
Default to Hours (10384) โ dependency upgrades are typically small.
Security work is Platform work. Search for the active Platform sprint:
project = SAAS AND sprint in openSprints() to find active sprints.Set sprint via additional_fields: "customfield_10010": <sprint_id_number>.
Parse the URL from $ARGUMENTS to extract owner/repo and alert number.
Run gh api repos/<owner>/<repo>/dependabot/alerts/<alert_number> to fetch alert data.
Extract package, ecosystem, severity, patched version, CVE ID, and summary.
Construct the formatted summary and description (see formats above).
Delegate to /jira-ticket with a single string containing all the ticket details. Structure it clearly so jira-ticket can parse each field:
/jira-ticket <formatted_summary>. <priority_label>. Component: Data Privacy / Security. Platform sprint. Hours. No epic. Description: <full_description_text>
Where:
<formatted_summary> is the title from the Title Format section<priority_label> is the Jira priority label (e.g., "P2") from the severity mappingDescription: is followed by the full description from the Description section aboveThe /jira-ticket skill handles assignee lookup, sprint resolution, status transition to Prioritized, and ticket creation.
The GitHub alert URL must appear in the description (html_url from the API response, or the original $ARGUMENTS URL as fallback) so the ticket links back to the Dependabot alert.