ticket-pipeline
Automates ticket workflows with a per-ticket pipeline, integrating CI, PR processes, and Slack notifications for seamless project management.
Install this skill
Security score
The ticket-pipeline skill was audited on Mar 8, 2026 and we found 19 security issues across 2 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Webhook reference - potential data exfiltration
| 132 | This is the primary trigger surface for CLI automation, Slack bots, and webhook handlers. |
Webhook reference - potential data exfiltration
| 214 | | **Slack bot** | Webhook handler constructs the `claude -p` call and spawns it as a subprocess | |
Webhook reference - potential data exfiltration
| 215 | | **Webhook** | HTTP handler receives ticket ID, sets env vars, invokes `claude -p` | |
Access to hidden dotfiles in home directory
| 167 | (`~/.claude/pipelines/ledger.json`) and state file (`~/.claude/pipelines/{ticket_id}/state.yaml`). |
Access to hidden dotfiles in home directory
| 171 | - **Linear**: `LINEAR_API_KEY` (or the credential set in `~/.claude/claude_desktop_config.json`) |
Access to hidden dotfiles in home directory
| 177 | Checkpoints are written to `~/.claude/pipelines/{ticket_id}/state.yaml` after every phase |
Access to hidden dotfiles in home directory
| 294 | 1. Check `~/.claude/tcb/{ticket_id}/bundle.json` |
Access to hidden dotfiles in home directory
| 376 | **Cross-repo detection heuristic**: Implementation touches files in repos not matching the ticket's labeled repo (from `~/.claude/epic-team/repo_manifest.yaml`). |
Access to hidden dotfiles in home directory
| 392 | 2. Read result from `~/.claude/skill-results/{context_id}/hostile-reviewer.json` |
Access to hidden dotfiles in home directory
| 410 | 3. Read result from `~/.claude/skill-results/{context_id}/mergeability-gate.json` |
Access to hidden dotfiles in home directory
| 476 | **Gate result log**: appended to `~/.claude/skill-results/{context_id}/cdqa-gate-log.json` |
Access to hidden dotfiles in home directory
| 568 | **Requires**: `~/.claude/epic-team/repo_manifest.yaml` (OMN-2519) |
Access to hidden dotfiles in home directory
| 604 | Read the ModelSkillResult from ~/.claude/skill-results/{context_id}/decompose-epic.json |
Access to hidden dotfiles in home directory
| 611 | Pipeline state is stored at `~/.claude/pipelines/{ticket_id}/state.yaml` as the primary state machine. Linear ticket gets a compact summary mirror (run_id, current phase, blocked reason, artifacts). |
Access to hidden dotfiles in home directory
| 615 | Prevents duplicate pipeline runs. Stored at `~/.claude/pipelines/ledger.json`: |
Access to hidden dotfiles in home directory
| 622 | "log": "~/.claude/pipeline-logs/OMN-2356.log" |
Access to hidden dotfiles in home directory
| 838 | # ~/.claude/skill-results/{context_id}/cdqa-gate-log.json |
Access to hidden dotfiles in home directory
| 901 | - `~/.claude/epic-team/repo_manifest.yaml` (cross-repo detection, OMN-2519) |
Access to hidden dotfiles in home directory
| 902 | - `~/.claude/pipelines/ledger.json` (ticket-run ledger) |
Install this skill with one command
/learn @omninode-ai/ticket-pipeline