You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Migrates the bug-report skill into a repo-agnostic plugin. Structured six-field report with severity rubric; persistence via CLAUDE_PLUGIN_DATA + optional output_dir userConfig; cross-skill/tracker refs degrade to prose (gh issue create --body-file, or an MCP tracker). Security: file-based issue body only. 6 evals. Clean-tier wave Phase 2.
Note
Low Risk
Documentation- and skill-definition-only changes with no runtime hooks or application code; filing guidance emphasizes safer gh usage rather than executing user-supplied strings.
Overview
Adds a new bug-report workflow skill plugin to the marketplace and root catalog. It turns informal defect descriptions into a structured five-field report (title, repro, expected vs actual, severity with justification, fix location) and stays read-only by default—no code edits, PRs, or automatic issue filing.
The skill workflow covers skip routing (feature requests, investigations), optional survey/Q&A flags (--quick, --full, --no-survey), Markdown stdout vs --file persistence with optional output_dir userConfig (fallback to CLAUDE_PLUGIN_DATA with a project slug), and explicit hand-off guidance for gh issue create --body-file / tracker MCP without interpolating reporter text into shell commands. Supporting docs include context/template.md (including “No bug confirmed”), plus six eval scenarios and a pagination fixture.
Reviewed by Cursor Bugbot for commit 3e6736b. Bugbot is set up for automated code reviews on this repo. Configure here.
Migrate medley's bug-report skill into a repo-agnostic plugin. Emits a
structured five-field bug report (title, repro, expected vs actual,
severity, fix location) from an informal description; read-only by
default.
Strip all medley coupling: replace .work/<slug> slice persistence with
${CLAUDE_PLUGIN_DATA} (overridable via an output_dir userConfig), rewrite
/issues and /prd handoffs as graceful degradation to a work-item tracker
(gh CLI or MCP), and drop .claude/rules citations. Port the six evals and
the pagination fixture.
Add the marketplace.json entry (category: workflow) and catalog README row.
The identifier-typo eval used `deseralize`, which the repo's required
typos CI check (config: _typos.toml) flags. Swap it to `paginaton` — an
obviously-misspelled token that typos does not flag (dictionary miss),
verified empirically. Symptom prose adjusted to fit the pagination domain;
the eval's assertion semantics (skill must not auto-correct a misspelled
identifier) are unchanged.
…caution
Drop the `--body` inline-string fallback from the filing hand-off so
`--body-file <report>` is the sole body shape, and add a caution that
untrusted-derived strings (the title included) are passed as literal argv
values, never embedded into a shell command string where backticks or
$( ) in the reporter's text could expand.
Check CLAUDE.md guidelines and MIGRATION-PLAYBOOK.md
Analyze for correctness, security, and alignment
Post review findings
Overall Assessment
Well-structured plugin migration. Capability is clearly scoped, security posture is clean, and the eval suite covers the important edge cases. A few issues worth addressing before merge, plus some nits.
Findings
Medium — context/template.md path not resolvable in plugin form
SKILL.md lines 88–89 and the Cross-references section at the bottom both point to context/template.md as a relative path:
Follow the 5-field template — see [`context/template.md`](context/template.md) for the full structure…
The template.md header says "Loaded on demand by the bug-report skill" — so it's not auto-loaded context, it's expected to be read explicitly. But installed plugins live under ~/.claude/plugins/cache/<plugin-id>/…, and the SKILL.md never tells Claude to resolve the absolute path via ${CLAUDE_PLUGIN_ROOT} before reading it. A bare context/template.md read will fail unless Claude happens to infer the cache path.
Suggested fix: add an explicit instruction in Step 4 (and the Cross-references note) to read the file via the plugin root, e.g.:
Read ${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md for the full template structure.
Or, if the five-field structure is already fully described inline in SKILL.md (which it largely is), annotate the template as a supplementary reference so a missed read is non-fatal. Either way, the current wording implies the template is required but provides no path for Claude to find it in cache.
"fall back to ${CLAUDE_PROJECT_DIR}/.bug-reports/ and state clearly where the file landed."
Option 2 (one step above) correctly says "run echo "${CLAUDE_PLUGIN_DATA:-}" in a Bash call" to resolve the variable. Option 3 is not explicit about the same. Per MIGRATION-PLAYBOOK.md, ${CLAUDE_PROJECT_DIR} is "substituted in hook/MCP/monitor commands" — its substitution behaviour in a skill prompt context is less clear. Without a matching echo "${CLAUDE_PROJECT_DIR}" Bash call instruction, Claude may use the literal string as a path in some sessions.
Minor — PR description field count disagrees with skill
The PR body says "Structured six-field report" but every file in the PR — plugin.json line 5, SKILL.md line 24, README.md — consistently uses "five-field" (title, steps to reproduce, expected vs actual, severity + justification, fix location). The PR body is the outlier; the implementation is self-consistent.
"Pass any untrusted-derived string — the title included — as a literal argv value… never embedded into a shell command string where backticks or $( ) in the reporter's text could expand."
It's not clear from the eval schema what base path this is relative to (skill root? evals directory?). The file exists and the eval prompt also instructs Claude to read it explicitly, so this works in practice — but a comment or a note in the README on what base the files paths use would help future eval authors.
Security Review (plugin-acceptance checklist)
Surface
Status
Code execution (hooks/scripts)
✅ None — skill-only plugin, no shell hooks
Remote MCP servers
✅ None
userConfig sensitive fields
✅ output_dir is a directory path, non-sensitive, correctly unmarked
Cache isolation / no reach-outs
✅ Uses ${CLAUDE_PLUGIN_DATA} and ${CLAUDE_PLUGIN_ROOT}; no ../ references
Data egress
✅ None — gh issue create is a suggestion the user runs manually
Provenance
✅ Author matches marketplace owner; no third-party dependencies
Strengths
Clear scope: bug intake only, read-only contract enforced in three places (SKILL.md, README, plugin description)
Good skip-condition coverage: feature requests, ongoing fixes, generic chores all route away before a report is produced
Six evals covering the important behavioral contract: happy path, feature-request routing, unbacked repro, no-bug-confirmed, critical-severity read-only enforcement, typo-identifier caution
--body-file (not --body) for gh issue create — correct security approach for untrusted report content
userConfig.output_dir correctly documented and typed as directory; sane default via CLAUDE_PLUGIN_DATA
Marketplace entry uses "source": "./plugins/bug-report" (the ./-prefixed form required by validate --strict)
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Cursor Bugbot did not complete (check skipped; usage limit reached), so automated review signal is missing. Human review is needed before merge; no reviewers were assigned because the only repo contributor is the PR author.
Sent by Cursor Approval Agent: Pull Request Router and Approver
Resolve marketplace.json and README conflicts by keeping main plugins plus bug-report. Replace Bash echo workaround with ${CLAUDE_PLUGIN_DATA} substitution for report output paths.
Co-authored-by: Cursor <cursoragent@cursor.com>
Check CLAUDE.md guidelines and verify previous findings
Verify whether previous review findings were addressed in new commits
Analyze for correctness, security, and alignment
Post review findings
Summary
Well-structured plugin with a clean read-only contract, good eval coverage, and a correct security posture. The merge commit (5cfa774) addressed the Codex P2 finding about CLAUDE_PLUGIN_DATA substitution. Two previous findings remain open — one medium and one nit — plus a minor clarification on the fallback path.
The merge commit replaced the Bash echo "${CLAUDE_PLUGIN_DATA:-}" workaround with a direct ${CLAUDE_PLUGIN_DATA} skill-content substitution in Step 4, option 2. This is the correct fix; ${CLAUDE_PLUGIN_DATA} is a documented plugin variable that substitutes at skill-load time without a Bash roundtrip. Codex P2 is closed.
Remaining Findings
Medium — context/template.md path unresolvable in plugin cache
see [`context/template.md`](context/template.md) for the full structure
When the plugin is installed, the skill runs from ~/.claude/plugins/cache/<plugin-id>/skills/bug-report/SKILL.md. A bare relative path like context/template.md resolves from the current working directory (the consumer's project root), not from the plugin cache. The file won't be found.
The fix is to prefix the absolute path via the plugin root variable:
Read `${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` for the full template structure.
Or, since the five-field structure is fully described inline in SKILL.md, annotate the reference as supplementary so a missed read is non-fatal.
This flag was raised in the previous review and was not addressed in the merge commit.
3. If neither resolves, fall back to `${CLAUDE_PROJECT_DIR}/.bug-reports/` …
The merge commit correctly promotes ${CLAUDE_PLUGIN_DATA} to a direct skill substitution. But ${CLAUDE_PROJECT_DIR} is documented as substituted in hook and MCP commands, not necessarily in skill prompt content. If it is not substituted at skill-load time, Claude would see the literal string ${CLAUDE_PROJECT_DIR} and may or may not infer the right path from the session context.
Option 3 is a last-resort fallback, so the blast radius is low, but it's worth confirming whether ${CLAUDE_PROJECT_DIR} is a supported skill-content substitution (via the plugins reference) and adding a Bash resolution step if it is not:
3. Otherwise, run `echo "$CLAUDE_PROJECT_DIR"` in a Bash call to get the project root
and write to `<result>/.bug-reports/`; state clearly where the file landed.
The title is embedded inline in the shell string. If a real bug title contained backticks or $(…), this example would expand them. SKILL.md line 103 correctly warns about this, but the template's worked example does the opposite of what the instruction says.
The canonical safe form is a pre-assigned variable:
Single-quoting the assignment neutralises all metacharacters; the $TITLE expansion in the gh call is then safe. The generic footer already uses "<short title>" as a placeholder (line 42–43), so only the worked example needs updating.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Cursor Bugbot did not complete (check skipped; usage limit reached), so automated review signal is missing. Human review is needed before merge; no reviewers were assigned because the only repo contributor is the PR author.
Sent by Cursor Approval Agent: Pull Request Router and Approver
Include powershell-format in marketplace.json and README. Stop recommending
shell-expanded --title in gh issue create examples; prompt interactively or
pass title as a separate argv value.
Co-authored-by: Cursor <cursoragent@cursor.com>
The latest merge commit addressed the shell-injection nit from previous reviews:
template.md full template footer: replaced gh issue create --title "<short title>" --body-file <this report> with gh issue create --body-file <this report> (let gh prompt for the title)
template.md worked example footer: same fix — the inline title embedding is gone
SKILL.md Step 5: substantially improved; now recommends interactive mode first, and for non-interactive use explicitly says to pass --title and --body-file as separate argv values via the Bash/shell tool's argument array, not a copy-pastable quoted command string
The shell injection concern is fully resolved. Good fix.
Remaining Findings
Medium — context/template.md path still unresolvable from plugin cache
see [`context/template.md`](context/template.md) for the full structure with a worked example.
When installed, the plugin runs from ~/.claude/plugins/cache/<plugin-id>/skills/bug-report/. A bare relative path like context/template.md resolves from the consumer's working directory (their project root), not from the plugin cache — the file won't be found. This has been flagged in both prior reviews and remains unaddressed.
Two valid fixes:
Option A — use ${CLAUDE_PLUGIN_ROOT} so the path always resolves correctly:
Read `${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` for the full template.
Option B — annotate the reference as supplementary (the five-field structure is already fully described inline in SKILL.md, so a missed read is non-fatal):
The full template with worked example is in `context/template.md` (supplementary reference, not required).
Option A is stronger; Option B is acceptable given the inline completeness of SKILL.md.
3. If neither resolves, fall back to `${CLAUDE_PROJECT_DIR}/.bug-reports/` and state clearly where the file landed.
${CLAUDE_PLUGIN_DATA} (used in option 2) is documented as a skill-content substitution. ${CLAUDE_PROJECT_DIR} is documented for hook and MCP commands; its substitution behaviour in skill prompt content is not confirmed in the plugins reference. If it is not substituted at skill-load time, Claude would see the literal string ${CLAUDE_PROJECT_DIR} and may or may not resolve the correct path.
This is a last-resort fallback so blast radius is low, but consistent resolution can be ensured with a simple Bash step:
3. Otherwise, run `echo "$CLAUDE_PROJECT_DIR"` in a Bash call to get the project root,
write to `<result>/.bug-reports/`, and state clearly where the file landed.
Nit — Eval fixture path resolution mirrors the open template.md issue
evals.json eval 4: the prompt instructs Claude to "Read evals/fixtures/pagination-correct-offset.md relative to the skill directory". The files field also lists "evals/fixtures/pagination-correct-offset.md" without an explicit base. Because the eval prompt provides guidance ("relative to the skill directory") and the files array is consumed by the eval runner, this works in practice — but the base-path convention for files entries is undocumented. A note in the plugin README or a code comment on what base path the eval runner uses would help future eval authors.
Security Review
Surface
Status
Code execution (hooks/scripts)
✅ None — skill-only plugin
Remote MCP servers
✅ None
userConfig sensitive fields
✅ output_dir is a non-sensitive directory path
Cache isolation
✅ Uses ${CLAUDE_PLUGIN_DATA} and ${CLAUDE_PLUGIN_ROOT}; no ../ reach-outs
Data egress
✅ None — gh issue create is a manual hand-off
Shell injection in hand-off examples
✅ Fixed in this commit — both template footers now use interactive mode
Provenance
✅ No third-party dependencies
Strengths
Shell injection concern fully resolved: template footers now prompt gh for the title interactively; SKILL.md Step 5 correctly documents the argv-literal pattern for non-interactive use
Read-only contract enforced in three distinct places (SKILL.md, README, plugin description)
Six evals with strong edge-case coverage: happy path, feature-request routing, unbacked repro, no-bug-confirmed, critical-severity read-only, identifier-typo caution
--body-file (not --body) for gh hand-off — correct approach for untrusted report content
${CLAUDE_PLUGIN_DATA} substitution correct and direct in option 2 of Step 4
Marketplace entry uses "source": "./plugins/bug-report" (the ./-prefixed form required by validate --strict)
Two findings remain before merge: the Medium path-resolution issue on lines 89/139 of SKILL.md (template.md unreachable from cache), and the Minor ${CLAUDE_PROJECT_DIR} substitution concern on line 95.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Cursor Bugbot did not complete (check skipped; usage limit reached), so the automated review signal is missing. Human review is needed before merge; no reviewers were assigned because the only human repo contributor is the PR author.
Sent by Cursor Approval Agent: Pull Request Router and Approver
The latest commit (7073733) merges origin/main (the actionlint plugin) into this branch. No bug-report plugin files were modified — this is a pure merge commit catching up with main. The two open findings from the previous review therefore carry over unchanged.
Resolved Since Prior Reviews
✅ ${CLAUDE_PROJECT_DIR} in skill-content is confirmed valid
The previous "Minor" finding questioned whether ${CLAUDE_PROJECT_DIR} is substituted in skill prompt content (vs. only in hook/MCP commands). Fresh fetch of plugins-reference confirms:
"All are substituted inline anywhere they appear in skill content, agent content, hook commands, monitor commands, and MCP or LSP server configs."
${CLAUDE_PLUGIN_ROOT}, ${CLAUDE_PLUGIN_DATA}, and ${CLAUDE_PROJECT_DIR} all substitute at skill-load time. This finding is closed. The fallback at SKILL.md line 95 is correct as written.
✅ Shell injection in template.md hand-off example (fixed in edca6ae)
Both template footers now use gh issue create --body-file <this report> (interactive title prompt) and SKILL.md Step 5 explicitly documents the argv-literal pattern for non-interactive use. Fully resolved.
Remaining Finding
Medium — context/template.md path unresolvable from plugin cache (3rd consecutive review cycle)
see [`context/template.md`](context/template.md) for the full structure with a worked example.
When the plugin is installed from cache (~/.claude/plugins/cache/<plugin-id>/skills/bug-report/), any attempt to read context/template.md resolves from the consumer's working directory (their project root), not the plugin cache. The file won't be found.
This is not purely a cosmetic issue. SKILL.md line 135 delegates the "No bug confirmed" summary format exclusively to context/template.md:
emit the short "No bug confirmed" summary instead (see `context/template.md`).
The three-line "No bug confirmed" form is defined only in template.md lines 142–154 — it is not inlined in SKILL.md. Claude can likely infer a reasonable format from the description, but the explicit format is only in the unresolvable file.
Two valid fixes:
Option A (preferred) — use ${CLAUDE_PLUGIN_ROOT} so the path always resolves correctly. Change all three references in SKILL.md to:
Read `${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` for the full template structure and worked example.
Option B — inline the "No bug confirmed" three-line form directly in SKILL.md (it's compact enough) and annotate the context/template.md references as supplementary:
see `context/template.md` (supplementary reference — not required; the five fields and "No bug confirmed" form are fully described above)
✅ Uses ${CLAUDE_PLUGIN_DATA} and ${CLAUDE_PLUGIN_ROOT}; no ../ reach-outs
Data egress
✅ None — gh issue create is a manual hand-off
Shell injection
✅ Fixed in edca6ae — template footers use interactive title prompt
${CLAUDE_PROJECT_DIR} usage
✅ Confirmed valid skill-content substitution per fresh docs
Provenance
✅ No third-party dependencies
Strengths
Read-only contract enforced in three distinct places (SKILL.md, README, plugin description)
Six evals with solid edge-case coverage: happy path, feature-request routing, unbacked repro, no-bug-confirmed, critical-severity read-only, identifier-typo caution
--body-file (not --body) for the gh hand-off — correct approach for untrusted report content
${CLAUDE_PLUGIN_DATA} and ${CLAUDE_PROJECT_DIR} substitutions both confirmed correct per fresh docs
Marketplace entry uses "source": "./plugins/bug-report" (the ./-prefixed form required by validate --strict)
Shell injection concern fully resolved in prior commits
One finding remains before merge: the Medium path-resolution issue on SKILL.md lines 89, 135, and 139 — context/template.md is unreachable from the plugin cache, and the "No bug confirmed" format is delegated exclusively to that file. This is the third consecutive review cycle the finding has been flagged.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Cursor Bugbot did not complete (check skipped; usage limit reached), so the automated review signal is missing. Human review is needed before merge; no reviewers were assigned because the only human repo contributor is the PR author.
Sent by Cursor Approval Agent: Pull Request Router and Approver
The template example now stops with the required no-bug summary when
verified math matches expectations, instead of pivoting to a false
low-severity bug report.
Co-Authored-By: Claude <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Codex P2 — Worked example now ends at "No bug confirmed" ✅
The worked example in context/template.md previously pivoted to emitting a full low-severity bug report after math that matched expectations, contradicting the "No bug confirmed" contract. The commit correctly ends the example at outcome 1 — emitting the three-line no-bug summary — so the worked example now reinforces rather than undermines the behaviour described in the Gotchas section and in SKILL.md. Codex P2 is closed.
Remaining Finding
Medium — context/template.md path still unresolvable from plugin cache (4th consecutive review cycle)
see [`context/template.md`](context/template.md) for the full structure with a worked example.
…
emit the short "No bug confirmed" summary instead (see `context/template.md`).
…
[`context/template.md`](context/template.md) — full Markdown template, worked example, …
When the plugin is installed, these paths resolve from the consumer's working directory (their project root), not from ~/.claude/plugins/cache/<plugin-id>/skills/bug-report/. The file won't be found.
The load-bearing reference is line 135: the exact three-line "No bug confirmed" format is defined only in context/template.md lines 112–122 and is not inlined in SKILL.md. Claude can likely infer a reasonable form, but the authoritative format is unreachable.
Two valid fixes:
Option A (preferred) — use ${CLAUDE_PLUGIN_ROOT} so the path resolves correctly from cache. On lines 89 and 139, change to:
Read `${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` for the full template structure and worked example.
And on line 135:
emit the short "No bug confirmed" summary instead — read `${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` for its exact form.
Option B — inline the compact "No bug confirmed" three-line form directly in SKILL.md (it's 5 lines) and annotate the other references as supplementary:
Emit this three-line summary:
*No bug confirmed.***Description claimed**: <whattheusersaid>
**Verified state**: <what the source/test/run actually shows>
**Recommendation**: <close / capture as feature request / open elsewhere>
Then mark the context/template.md references on lines 89 and 139 as supplementary (not required), since SKILL.md would then be self-contained.
Option A is safer because it also covers the full five-field template format (also only in template.md); Option B requires inlining both the "No bug confirmed" form and the full five-field structure to be truly self-contained.
✅ Uses ${CLAUDE_PLUGIN_DATA} and ${CLAUDE_PLUGIN_ROOT}; no ../ reach-outs
Data egress
✅ None — gh issue create is a manual hand-off
Shell injection
✅ Fixed in edca6ae — template footers use interactive title prompt
${CLAUDE_PROJECT_DIR} usage
✅ Confirmed valid skill-content substitution per plugins-reference docs
Worked example teaches false reports
✅ Fixed in this commit — example now ends at "No bug confirmed"
Provenance
✅ No third-party dependencies
Strengths
Read-only contract enforced in three distinct places (SKILL.md, README, plugin description)
Six evals with solid edge-case coverage: happy path, feature-request routing, unbacked repro, no-bug-confirmed, critical-severity read-only, identifier-typo caution
--body-file (not --body) for the gh hand-off — correct approach for untrusted report content
${CLAUDE_PLUGIN_DATA} and ${CLAUDE_PROJECT_DIR} substitutions both confirmed correct per fresh docs
Marketplace entry uses "source": "./plugins/bug-report" (the ./-prefixed form required by validate --strict)
Worked example now correctly demonstrates "No bug confirmed" termination when math checks out
One finding remains before merge: the Medium path-resolution issue on SKILL.md lines 89, 135, and 139 — context/template.md is unreachable from the plugin cache, and the authoritative "No bug confirmed" format and five-field template are defined only in that file.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Cursor Bugbot did not complete (check skipped; usage limit reached), so the automated review signal is missing. Human review is needed before merge; no reviewers were assigned because the only human repo contributor is the PR author.
Sent by Cursor Approval Agent: Pull Request Router and Approver
Codex P2 — --body-file hand-off gated on --file mode ✅
The previous stdout template footer unconditionally told users to gh issue create --body-file <this report> even when no file had been written. The latest commit splits this correctly:
Stdout footer (lines 41–43 of template.md) now reads: "To file it as a work item, copy this report into your tracker, rerun with --file and then gh issue create --body-file <report path>" — no premature --body-file hand-off when in stdout mode.
--file mode footer (new, lines 66–70) appends a file-specific footer with gh issue create --body-file <this report path> only when a file was actually written.
The Codex P2 finding is closed. The fix is correctly scoped.
Remaining Finding
Medium — context/template.md path still unresolvable from plugin cache (5th consecutive review cycle)
see [`context/template.md`](context/template.md) for the full structure with a worked example.
…
emit the short "No bug confirmed" summary instead (see `context/template.md`).
…
[`context/template.md`](context/template.md) — full Markdown template, worked example, …
"Claude Code provides three variables for referencing paths. All are substituted inline anywhere they appear in skill content, agent content, hook commands, monitor commands, and MCP or LSP server configs."
So ${CLAUDE_PLUGIN_ROOT} is a valid skill-content substitution — and the fix is straightforward. The bare relative path context/template.md resolves from the consumer's working directory, not from ~/.claude/plugins/cache/<plugin-id>/skills/bug-report/. The file won't be found.
The load-bearing reference is line 135: the exact 3-line "No bug confirmed" format lives only in context/template.md lines 121–131 and is not inlined in SKILL.md. Claude can likely infer a reasonable form, but the authoritative format is unreachable from the cache.
Two valid fixes:
Option A (preferred) — use ${CLAUDE_PLUGIN_ROOT} on all three references:
# Line 89
Follow the 5-field template — read `${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` for the full structure with a worked example.
# Line 135
emit the short "No bug confirmed" summary instead — read `${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` for its exact form.
# Line 139`${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` — full Markdown template, worked example, `--file` frontmatter, and the "No bug confirmed" form
Option B — inline the compact "No bug confirmed" form directly in SKILL.md (it's 5 lines) and annotate the other two references as supplementary:
Emit this 3-line summary:
*No bug confirmed.***Description claimed**: <whattheusersaid>
**Verified state**: <what the source/test/run actually shows>
**Recommendation**: <close / capture as feature request / open elsewhere>
Then mark lines 89 and 139 as supplementary. Note: Option B only covers the "No bug confirmed" gap — the full 5-field template is also only in template.md, so Option B still leaves that unreachable unless you inline it too. Option A covers both.
Read-only contract enforced in three distinct places (SKILL.md, README, plugin description)
Six evals with solid edge-case coverage: happy path, feature-request routing, unbacked repro, no-bug-confirmed, critical-severity read-only, identifier-typo caution
--body-file (not --body) for the gh hand-off — correct approach for untrusted report content, now also correctly gated on --file mode
${CLAUDE_PLUGIN_DATA} and ${CLAUDE_PROJECT_DIR} substitutions confirmed correct per fresh docs
Marketplace entry uses "source": "./plugins/bug-report" (the ./-prefixed form required by validate --strict)
One finding remains before merge: the Medium path-resolution issue on SKILL.md lines 89, 135, and 139 — context/template.md is unreachable from the plugin cache, and the authoritative "No bug confirmed" format and 5-field template are defined only in that file. This has been flagged in every review cycle. ${CLAUDE_PLUGIN_ROOT} is confirmed valid in skill content per current docs — Option A is a straightforward three-line change.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Cursor Bugbot did not complete (check skipped; usage limit reached), so the automated review signal is missing. Human review is needed before merge; no reviewers were assigned because the only human repo contributor is the PR author.
Sent by Cursor Approval Agent: Pull Request Router and Approver
Minor — Plugin-namespaced command in generated report footers ✅
Both footers in context/template.md now correctly cite /bug-report:bug-report instead of the bare /bug-report — the stdout footer at line 41 and the --file footer at line 67. The Minor finding from the prior review cycle is closed.
Remaining Findings
Medium — context/template.md path unresolvable from plugin cache (7th consecutive review cycle)
see [`context/template.md`](context/template.md) for the full structure with a worked example.
…
emit the short "No bug confirmed" summary instead (see `context/template.md`).
…
[`context/template.md`](context/template.md) — full Markdown template, worked example, …
"Claude Code provides three variables for referencing paths. All are substituted inline anywhere they appear in skill content, agent content, hook commands, monitor commands, and MCP or LSP server configs."
So ${CLAUDE_PLUGIN_ROOT} is a valid and substituted path in skill content. The bare relative path context/template.md offers no such guarantee — when Claude needs to read the file its Read tool requires an absolute path, and the resolution anchor for a prose reference in SKILL.md is not specified. The ${CLAUDE_PLUGIN_ROOT} form removes all ambiguity and is the pattern the plugin system is designed for.
The load-bearing reference is line 135: the exact "No bug confirmed" 3-line form is defined only in context/template.md lines 121–131 and is not inlined in SKILL.md.
Option A (preferred) — use ${CLAUDE_PLUGIN_ROOT} on all three references:
# Line 89
Follow the 5-field template — read `${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` for the full structure with a worked example.
# Line 135
emit the short "No bug confirmed" summary instead — read `${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` for its exact form.
# Line 139`${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` — full Markdown template, worked example, `--file` frontmatter, and the "No bug confirmed" form
Option B — inline the "No bug confirmed" form and the 5-field template directly in SKILL.md and annotate the context/template.md references as supplementary. More work, but makes SKILL.md fully self-contained.
If the description names a single unambiguous symbol AND the user passed `--quick` or `--no-survey`, skip the survey.
The flag table at line 84 documents --no-survey as "Trust the description; only ask when a field would otherwise be invented" — unconditional trust, no symbol requirement. But the survey-skip condition gates it on "single unambiguous symbol", meaning a broad report with no named symbol would still go through Step 2 even when the user explicitly passed --no-survey.
--quick is correctly gated on symbol unambiguity per the flag table (line 82: "Skip the survey if the symbol is unambiguous"). The condition should split the two flags:
If the user passed `--no-survey`, skip the survey.
If the description names a single unambiguous symbol AND the user passed `--quick`, also skip the survey.
This was raised by Codex in the review of the prior commit and is not addressed in dca4370.
Read-only contract enforced in three distinct places (SKILL.md, README, plugin description)
Six evals with solid edge-case coverage: happy path, feature-request routing, unbacked repro, no-bug-confirmed, critical-severity read-only, identifier-typo caution
--body-file for the gh hand-off — correct approach for untrusted report content, correctly gated on --file mode
${CLAUDE_PLUGIN_DATA} and ${CLAUDE_PROJECT_DIR} substitutions confirmed correct per fresh docs
Marketplace entry uses "source": "./plugins/bug-report" (the ./-prefixed form required by validate --strict)
Two findings remain before merge: the Medium path-resolution issue on SKILL.md lines 89/135/139 (context/template.md unreachable without ${CLAUDE_PLUGIN_ROOT} — flagged in every review cycle), and the Minor --no-survey condition inconsistency on line 61.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Cursor Bugbot did not complete (check skipped), so the automated review signal is missing. Human review is needed before merge; no reviewers were assigned because the only human repo contributor is the PR author.
Sent by Cursor Approval Agent: Pull Request Router and Approver
The flag promises to trust the description; gating it on a single
unambiguous symbol re-ran the survey it suppresses. --quick keeps the
unambiguous-symbol gate.
"Skip the survey when --no-survey was passed (unconditionally — the flag means "trust the description"), or when --quick was passed AND the description names a single unambiguous symbol."
This correctly separates the two flags: --no-survey bypasses the survey regardless of whether a symbol is named; --quick remains gated on unambiguous symbol identification. Matches the flag table at line 84. Finding is closed.
Remaining Finding
Medium — context/template.md path still unresolvable from plugin cache (8th consecutive review cycle)
see [`context/template.md`](context/template.md) for the full structure with a worked example.
…
emit the short "No bug confirmed" summary instead (see `context/template.md`).
…
[`context/template.md`](context/template.md) — full Markdown template, worked example, …
When the plugin is installed, it lives under ~/.claude/plugins/cache/<plugin-id>/skills/bug-report/. A bare relative path context/template.md resolves from the consumer's working directory (their project root), not the plugin cache — the file won't be found.
${CLAUDE_PLUGIN_ROOT} is confirmed valid in skill content per the plugins-reference docs (fetched in a prior cycle). The exact three-line fix:
-Default: emit Markdown to stdout (read-only). Follow the 5-field template — see [`context/template.md`](context/template.md) for the full structure with a worked example.+Default: emit Markdown to stdout (read-only). Follow the 5-field template — read `${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` for the full structure with a worked example.
-- **When there is no bug, do not emit a report.** If the survey and Q&A reveal the behaviour is correct, emit the short "No bug confirmed" summary instead (see `context/template.md`).+- **When there is no bug, do not emit a report.** If the survey and Q&A reveal the behaviour is correct, emit the short "No bug confirmed" summary instead — read `${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` for its exact form.
-- [`context/template.md`](context/template.md) — full Markdown template, worked example, `--file` frontmatter, and the "No bug confirmed" form+- `${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` — full Markdown template, worked example, `--file` frontmatter, and the "No bug confirmed" form
✅ Fixed (20438a9) — stdout footer no longer implies a file
${CLAUDE_PROJECT_DIR} in skill content
✅ Confirmed valid per plugins-reference docs
Plugin-namespaced command in footers
✅ Fixed (dca4370) — both footers use /bug-report:bug-report
--no-survey unconditional bypass
✅ Fixed (1625767) — split from --quick; no symbol requirement
Security Review
Surface
Status
Code execution (hooks/scripts)
✅ None — skill-only plugin
Remote MCP servers
✅ None
userConfig sensitive fields
✅ output_dir is a non-sensitive directory path
Cache isolation
✅ Uses ${CLAUDE_PLUGIN_DATA} and ${CLAUDE_PLUGIN_ROOT}; no ../ reach-outs
Data egress
✅ None — gh issue create is a manual hand-off
Shell injection
✅ Resolved — template footers use interactive title prompt
${CLAUDE_PROJECT_DIR} usage
✅ Confirmed valid skill-content substitution per fresh docs
Provenance
✅ No third-party dependencies
One finding remains before merge: the Medium path-resolution issue on SKILL.md lines 89, 135, and 139. The exact diff is above — it's a three-line change. ${CLAUDE_PLUGIN_ROOT} is confirmed valid in skill content and is the correct fix.
| Branch
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Cursor Bugbot did not complete (check skipped), so the automated review signal is missing. Human review is needed before merge; no reviewers were assigned because the only human repo contributor is the PR author.
Sent by Cursor Approval Agent: Pull Request Router and Approver
Check latest merge commit for bug-report file changes
Verify status of the remaining medium finding (template.md path resolution)
Post review findings
What Changed
Commit 79cf769 merges origin/main (chore: adopt root-native standards, #49) into this branch. No bug-report plugin files were modified — pure merge commit. The one remaining finding carries over.
Remaining Finding
Medium — context/template.md path unresolvable from plugin cache (9th consecutive review cycle)
see [`context/template.md`](context/template.md) for the full structure with a worked example.
…
emit the short "No bug confirmed" summary instead (see `context/template.md`).
…
[`context/template.md`](context/template.md) — full Markdown template, worked example, …
When installed, the plugin lives under ~/.claude/plugins/cache/<plugin-id>/skills/bug-report/. A bare relative path resolves from the consumer's project root, not the cache — context/template.md won't be found. The load-bearing reference is line 135: the exact "No bug confirmed" 3-line form lives only in context/template.md and is not inlined in SKILL.md.
${CLAUDE_PLUGIN_ROOT} is confirmed valid in skill content per the plugins-reference docs. The exact three-line diff:
-Default: emit Markdown to stdout (read-only). Follow the 5-field template — see [`context/template.md`](context/template.md) for the full structure with a worked example.+Default: emit Markdown to stdout (read-only). Follow the 5-field template — read `${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` for the full structure with a worked example.
-- **When there is no bug, do not emit a report.** If the survey and Q&A reveal the behaviour is correct, emit the short "No bug confirmed" summary instead (see `context/template.md`).+- **When there is no bug, do not emit a report.** If the survey and Q&A reveal the behaviour is correct, emit the short "No bug confirmed" summary instead — read `${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` for its exact form.
-- [`context/template.md`](context/template.md) — full Markdown template, worked example, `--file` frontmatter, and the "No bug confirmed" form+- `${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` — full Markdown template, worked example, `--file` frontmatter, and the "No bug confirmed" form
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: low. Cursor Bugbot did not complete (check skipped), so the automated review signal is missing. Human review is needed before merge; no reviewers were assigned because the only human repo contributor is the PR author.
Sent by Cursor Approval Agent: Pull Request Router and Approver
…iling path
The CC Bash tool has no argument array; the argv advice was
unfollowable. Non-interactive filing now writes the reporter title to a
file and passes it via a quoted command substitution, whose result is
never re-parsed by the shell.
argv-array guidance replaced with a concrete shell-safe path ✅
SKILL.md line 103 and README.md lines 63–66 now both document the non-interactive title-handling approach as: write the reporter's title to a temp file, then pass --title "$(cat <title-file>)". This is correct — the outer $( ) runs cat to read the file's raw bytes; those bytes are passed as the argument value inside double-quotes, so any $() or backtick sequences in the reporter's title are treated as literals and not re-evaluated by the shell. The previous argv-array approach was unfollowable in Claude Code's Bash tool. This fix is sound.
README.md updated to match. Finding from the prior cycle's Codex P2 is closed.
Remaining Findings
Medium — context/template.md path still unresolvable from plugin cache (10th consecutive review cycle)
see [`context/template.md`](context/template.md) for the full structure with a worked example.
…
emit the short "No bug confirmed" summary instead (see `context/template.md`).
…
[`context/template.md`](context/template.md) — full Markdown template, worked example, …
When the plugin is installed, it lives under ~/.claude/plugins/cache/<plugin-id>/skills/bug-report/. A bare relative path resolves from the consumer's working directory (their project root), not the cache — context/template.md won't be found. The load-bearing reference is line 135: the exact "No bug confirmed" 3-line format is defined only in context/template.md lines 121–131 and is not inlined in SKILL.md.
${CLAUDE_PLUGIN_ROOT} is confirmed valid in skill content per the plugins-reference docs (verified in a prior review cycle). The exact three-line diff:
-Default: emit Markdown to stdout (read-only). Follow the 5-field template — see [`context/template.md`](context/template.md) for the full structure with a worked example.+Default: emit Markdown to stdout (read-only). Follow the 5-field template — read `${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` for the full structure with a worked example.
-- **When there is no bug, do not emit a report.** If the survey and Q&A reveal the behaviour is correct, emit the short "No bug confirmed" summary instead (see `context/template.md`).+- **When there is no bug, do not emit a report.** If the survey and Q&A reveal the behaviour is correct, emit the short "No bug confirmed" summary instead — read `${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` for its exact form.
-- [`context/template.md`](context/template.md) — full Markdown template, worked example, `--file` frontmatter, and the "No bug confirmed" form+- `${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` — full Markdown template, worked example, `--file` frontmatter, and the "No bug confirmed" form
Minor — Step 5 --body-file advice not gated on --file mode
SKILL.md line 103 recommends gh issue create --body-file <report> under the "File it as a work item" bullet — but this bullet is not conditioned on --file mode having been used. In default stdout mode there is no report file, so --body-file <report> would fail at the path resolution step.
This was raised as a Codex P2 in the review of commit 79cf769 and was not addressed in 0e96054 (which fixed the argv-array concern instead). The three-bullet structure of Step 5 provides implicit routing (stdout mode → third bullet: "copy/paste the stdout"), so the blast radius is low — a capable model reading the three options would pick the right one. But adding a --file mode guard makes the first bullet unambiguous:
-- **File it as a work item** — if you are in a GitHub repository and the `gh` CLI is available: run `gh issue create --body-file <report>` and let `gh` prompt for the title interactively. If filing non-interactively, …+- **File it as a work item** (`--file` mode) — if a report file was written and you are in a GitHub repository with the `gh` CLI available: run `gh issue create --body-file <report>` and let `gh` prompt for the title interactively. If filing non-interactively, …
✅ Fixed (0e96054) — $(cat <title-file>) approach is correct
context/template.md path resolution
❌ Still open — 10th cycle
Step 5 --body-file not gated on --file mode
❌ Open (new, raised by Codex P2 in 79cf769 review)
Security Review
Surface
Status
Code execution (hooks/scripts)
✅ None — skill-only plugin
Remote MCP servers
✅ None
userConfig sensitive fields
✅ output_dir is a non-sensitive directory path
Cache isolation
✅ Uses ${CLAUDE_PLUGIN_DATA} and ${CLAUDE_PLUGIN_ROOT}; no ../ reach-outs
Data egress
✅ None — gh issue create is a manual hand-off
Shell injection in title handling
✅ Fixed — $(cat <title-file>) correctly treats reporter text as literal bytes
${CLAUDE_PROJECT_DIR} in skill content
✅ Confirmed valid skill-content substitution per plugins-reference docs
Provenance
✅ No third-party dependencies
Two findings remain before merge: the Medium path-resolution issue on SKILL.md lines 89/135/139 (every review cycle, three-line diff provided above), and the Minor Step 5 --body-file gating concern first raised in the most recent Codex review cycle.
| Branch
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: low. Cursor Bugbot did not complete (check skipped), so the automated review signal is missing. Human review is needed before merge; no reviewers were assigned because the only human repo contributor is the PR author.
Sent by Cursor Approval Agent: Pull Request Router and Approver
…ting
Default stdout mode has no file on disk; save the report first (re-run
in --file mode or write a temp file) before recommending gh issue
create --body-file.
"--body-file needs a report file on disk: in --file mode use the emitted report path; in default stdout mode first save the report (offer to re-run the write step or Write it to a temp file)."
Both paths are covered: --file mode uses the emitted path; stdout mode offers to save first. The Codex P2 finding from the prior cycle is closed.
Remaining Finding
Medium — context/template.md path still unresolvable from plugin cache (11th consecutive review cycle)
see [`context/template.md`](context/template.md) for the full structure with a worked example.
…
emit the short "No bug confirmed" summary instead (see `context/template.md`).
…
[`context/template.md`](context/template.md) — full Markdown template, worked example, …
"Claude Code provides three variables for referencing paths. All are substituted inline anywhere they appear in skill content, agent content, hook commands, monitor commands, and MCP or LSP server configs."
So ${CLAUDE_PLUGIN_ROOT} substitutes in skill content — it is the correct and supported fix. A bare relative path context/template.md has no such guarantee: it resolves from the consumer's working directory, not from ~/.claude/plugins/cache/<plugin-id>/skills/bug-report/. The file won't be found.
The load-bearing reference is line 135: the "No bug confirmed" 3-line form is defined only in context/template.md lines 121–131 and is not inlined in SKILL.md.
The exact three-line diff:
-Default: emit Markdown to stdout (read-only). Follow the 5-field template — see [`context/template.md`](context/template.md) for the full structure with a worked example.+Default: emit Markdown to stdout (read-only). Follow the 5-field template — read `${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` for the full structure with a worked example.
-- **When there is no bug, do not emit a report.** If the survey and Q&A reveal the behaviour is correct, emit the short "No bug confirmed" summary instead (see `context/template.md`).+- **When there is no bug, do not emit a report.** If the survey and Q&A reveal the behaviour is correct, emit the short "No bug confirmed" summary instead — read `${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` for its exact form.
-- [`context/template.md`](context/template.md) — full Markdown template, worked example, `--file` frontmatter, and the "No bug confirmed" form+- `${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` — full Markdown template, worked example, `--file` frontmatter, and the "No bug confirmed" form
✅ Uses ${CLAUDE_PLUGIN_DATA} and ${CLAUDE_PLUGIN_ROOT}; no ../ reach-outs
Data egress
✅ None — gh issue create is a manual hand-off
Shell injection in title handling
✅ $(cat <title-file>) correctly treats reporter text as literal bytes
${CLAUDE_PROJECT_DIR} usage
✅ Confirmed valid skill-content substitution per fresh docs
--body-file gating
✅ Correctly scoped to file mode; stdout mode given a save-first path
Provenance
✅ No third-party dependencies
Strengths
Read-only contract enforced in three distinct places (SKILL.md, README, plugin description)
Six evals with solid edge-case coverage: happy path, feature-request routing, unbacked repro, no-bug-confirmed, critical-severity read-only, identifier-typo caution
--body-file for gh hand-off is now correctly gated — stdout mode offers to save first
${CLAUDE_PLUGIN_DATA} and ${CLAUDE_PROJECT_DIR} substitutions confirmed correct per fresh docs
Marketplace entry uses "source": "./plugins/bug-report" (the ./-prefixed form required by validate --strict)
One finding remains before merge: the Medium path-resolution issue on SKILL.md lines 89, 135, and 139. The exact three-line diff is above — ${CLAUDE_PLUGIN_ROOT} is confirmed valid in skill content per this session's fresh doc fetch.
| Branch
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: low. Cursor Bugbot did not complete (check skipped), so the automated review signal is missing. Human review is needed before merge; no reviewers were assigned because the only human repo contributor is the PR author.
Sent by Cursor Approval Agent: Pull Request Router and Approver
CLAUDE_PLUGIN_DATA is per-plugin, not per-project; a shared
bug-reports/ dir let Step 2's duplicate scan match another repo's
report on the same symbol. Default path now nests under the
kebab-cased project-root basename.
"Otherwise, write to ${CLAUDE_PLUGIN_DATA}/bug-reports/<project-slug>/, where <project-slug> is the kebab-cased basename of the project root (${CLAUDE_PROJECT_DIR}, or the git toplevel when unset). The plugin data directory is per-plugin, not per-project — without the slug, Step 2's duplicate scan would match another repository's report on the same symbol."
The fix is correct and self-documenting. The inline rationale ("without the slug, Step 2's duplicate scan would match another repository's report on the same symbol") makes the requirement clear to future editors. The slug derivation is unambiguous (kebab-cased basename of ${CLAUDE_PROJECT_DIR}), and the fallback to git toplevel handles the case where ${CLAUDE_PROJECT_DIR} is unset. Codex P2 is closed.
Remaining Finding
Medium — context/template.md path still unresolvable from plugin cache (12th consecutive review cycle)
see [`context/template.md`](context/template.md) for the full structure with a worked example.
…
emit the short "No bug confirmed" summary instead (see `context/template.md`).
…
[`context/template.md`](context/template.md) — full Markdown template, worked example, …
When installed, the plugin lives under ~/.claude/plugins/cache/<plugin-id>/skills/bug-report/. A bare relative path context/template.md resolves from the consumer's working directory (their project root), not the plugin cache — the file won't be found.
The load-bearing reference is line 135: the exact "No bug confirmed" 3-line form is defined only in context/template.md lines 121–131 and is not inlined in SKILL.md. ${CLAUDE_PLUGIN_ROOT} is confirmed valid in skill content per plugins-reference docs. The exact three-line diff:
-Default: emit Markdown to stdout (read-only). Follow the 5-field template — see [`context/template.md`](context/template.md) for the full structure with a worked example.+Default: emit Markdown to stdout (read-only). Follow the 5-field template — read `${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` for the full structure with a worked example.
-- **When there is no bug, do not emit a report.** If the survey and Q&A reveal the behaviour is correct, emit the short "No bug confirmed" summary instead (see `context/template.md`).+- **When there is no bug, do not emit a report.** If the survey and Q&A reveal the behaviour is correct, emit the short "No bug confirmed" summary instead — read `${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` for its exact form.
-- [`context/template.md`](context/template.md) — full Markdown template, worked example, `--file` frontmatter, and the "No bug confirmed" form+- `${CLAUDE_PLUGIN_ROOT}/skills/bug-report/context/template.md` — full Markdown template, worked example, `--file` frontmatter, and the "No bug confirmed" form
✅ Fixed — default path now partitioned by kebab-cased project slug
Provenance
✅ No third-party dependencies
Strengths
Read-only contract enforced in three distinct places (SKILL.md, README, plugin description)
Six evals with solid edge-case coverage: happy path, feature-request routing, unbacked repro, no-bug-confirmed, critical-severity read-only, identifier-typo caution
--body-file for the gh hand-off — correctly gated on file mode; stdout mode offers a save-first path
Project slug partitioning fix is self-documenting — the inline rationale makes the invariant clear to future editors
Marketplace entry uses "source": "./plugins/bug-report" (the ./-prefixed form required by validate --strict)
One finding remains before merge: the Medium path-resolution issue on SKILL.md lines 89, 135, and 139. The exact three-line diff is above — it is a copy-paste change and has been provided in every review cycle.
| Branch
The reason will be displayed to describe this comment to others. Learn more.
Risk: low. Cursor Bugbot did not complete (check skipped; usage limit reached), so the automated review signal is missing. Human review is needed before merge; no reviewers were assigned because the only human repo contributor is the PR author.
Sent by Cursor Approval Agent: Pull Request Router and Approver
`--file` mode: write the report to a file with frontmatter `type: bug-report`. Resolve the output directory in this precedence, and always tell the user the final path:
1. If the consumer configured `output_dir`, write to `${user_config.output_dir}`.
2. Otherwise, write to `${CLAUDE_PLUGIN_DATA}/bug-reports/<project-slug>/`, where `<project-slug>` is the kebab-cased basename of the project root (`${CLAUDE_PROJECT_DIR}`, or the git toplevel when unset). The plugin data directory is per-plugin, not per-project — without the slug, Step 2's duplicate scan would match another repository's report on the same symbol.
The reason will be displayed to describe this comment to others. Learn more.
Use collision-resistant project slugs
Fresh evidence after the storage-partition fix: the current default still derives <project-slug> only from the project-root basename, so two unrelated checkouts with the same leaf directory (for example ~/work/api and ~/forks/api) are written under the same ${CLAUDE_PLUGIN_DATA}/bug-reports/api/ directory. Because Step 2 scans that directory for prior reports to avoid duplicates, a report from one repo can suppress or confuse a later report in the other; include a stable path/remote hash in the slug or record and filter by project metadata before duplicate suppression.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
Migrates the bug-report skill into a repo-agnostic plugin. Structured six-field report with severity rubric; persistence via CLAUDE_PLUGIN_DATA + optional output_dir userConfig; cross-skill/tracker refs degrade to prose (gh issue create --body-file, or an MCP tracker). Security: file-based issue body only. 6 evals. Clean-tier wave Phase 2.
Note
Low Risk
Documentation- and skill-definition-only changes with no runtime hooks or application code; filing guidance emphasizes safer
ghusage rather than executing user-supplied strings.Overview
Adds a new
bug-reportworkflow skill plugin to the marketplace and root catalog. It turns informal defect descriptions into a structured five-field report (title, repro, expected vs actual, severity with justification, fix location) and stays read-only by default—no code edits, PRs, or automatic issue filing.The skill workflow covers skip routing (feature requests, investigations), optional survey/Q&A flags (
--quick,--full,--no-survey), Markdown stdout vs--filepersistence with optionaloutput_diruserConfig (fallback toCLAUDE_PLUGIN_DATAwith a project slug), and explicit hand-off guidance forgh issue create --body-file/ tracker MCP without interpolating reporter text into shell commands. Supporting docs includecontext/template.md(including “No bug confirmed”), plus six eval scenarios and a pagination fixture.Reviewed by Cursor Bugbot for commit 3e6736b. Bugbot is set up for automated code reviews on this repo. Configure here.