Install
$ agentstack add skill-pekral-cursor-rules-autoresolve-oldest-github-issue ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Constraints
- Apply
@rules/git/general.mdc - Apply
@rules/reports/general.mdc - Operate on the current Git repository's GitHub remote only — refuse if the remote is not GitHub
- Process exactly one issue per invocation; never loop into a second issue
- Never bypass quality gates of the delegated skills (
resolve-issue,code-review-github,process-code-review,merge-github-pr) - Code review is a hard merge gate (
@rules/git/general.mdcMerging): never reach step 6 (merge) until steps 4–5 have run a code review on the PR's final diff and driven it to 0 Critical + 0 Moderate. A merge without a converged code review is forbidden — do not skip or reorder steps 4–5 to merge sooner. - Never force-merge: stop on merge conflict, failing CI, missing approvals, or unresolved Critical/Moderate CR findings
- Never alter the original issue body, labels, or assignees outside what the delegated skills already do. Exception:
resolve-issueapplies theResolve_by_AI:in-progressclaim label at the start of work and releases it on a pre-PR Blocked/abort — this is a sanctioned write owned by the delegated skill, not a constraint violation. - Do not expose sensitive/internal details in user-facing messages
Use when
- The user wants the oldest open GitHub issue auto-resolved end-to-end (resolve → review → process feedback → merge)
- A scheduled or batch workflow needs a single deterministic entry point that chains the four skills
Inputs
LABEL(optional) — GitHub label used to filter eligible issues. Default:Resolve_by_AI. Pass an empty string (LABEL="") to disable label filtering and pick the globally oldest open issue.
Execution
1. Preflight
- Confirm
gh auth statusreports an authenticated session; if not, stop and ask the user to authenticate. - Resolve the current Git remote origin and verify it points to GitHub. Stop with a clear message otherwise.
- Switch to the
mainbranch and pull the latest changes.
2. Select the oldest issue
- Resolve the current repository slug:
REPO=$(gh repo view --json nameWithOwner -q .nameWithOwner). - Query the single oldest open issue via
gh search issues, which — unlikegh issue list— supports explicit ascending order and therefore returns the globally oldest match regardless of total open-issue count:
`` CLAIM_LABEL="${CLAIM_LABEL:-Resolve_by_AI:in-progress}" QUERY="is:open is:issue repo:${REPO}${LABEL:+ label:\"$LABEL\"} -label:\"${CLAIM_LABEL}\"" gh search issues "$QUERY" --sort created --order asc --limit 1 \ --json number,url,title,createdAt,labels,assignees ` The -label: negation excludes any issue already carrying the ResolvebyAI:in-progress claim label, so two parallel autoresolve runs always select different issues. CLAIMLABEL defaults to Resolveby_AI:in-progress and can be overridden to match a repository that uses a custom claim label. Do **not** substitute gh issue list --sort created --limit : that command returns the newest N issues with no --order` switch, so any client-side ascending sort picks the oldest of the newest, never the true oldest.
- If the result is empty, stop with the message
No eligible open GitHub issues found (label=). - Record the selected issue's
numberandurl. This URL is the single argument passed to every downstream skill in the chain.
3. Resolve the issue
- Invoke
@skills/resolve-issue/SKILL.mdwith the selected issue URL. - That skill handles branching, implementation, tests, pre-push gates, the local code-review / security-review loop, PR creation, and reports per its own contract.
- When
resolve-issuefinishes, capture the resulting PR URL from its output. If no PR URL is produced, stop and report the failure — do not continue the chain.
4. Run code review on the PR
- Run inline. Invoke
@skills/code-review-github/SKILL.mddirectly in this skill's context, passing the PR URL (not the issue URL) plus the instruction "run@skills/code-review-github/SKILL.mdagainst this PR and return the published PR comment URL, the linked-issue comment URL(s), and the Critical / Moderate / Minor counts". Do not dispatch the CR as a subagent — run it sequentially in the current context. - The CR skill's deterministic loader accepts a PR URL or number and posts findings as a fresh PR comment plus a non-technical mirror on the linked issue.
5. Process review feedback
- Run inline. Invoke
@skills/process-code-review/SKILL.mddirectly in this skill's context, passing the PR URL plus the instruction "drive the review loop on this PR to convergence (Critical + Moderate == 0) and return the iteration count, residual finding counts, and the final status comment URL". Do not dispatch as a subagent — run it sequentially in the current context. - This is the convergence loop: it resolves comments, applies Suggested Fix snippets, re-runs the review in quiet mode, and exits when
criticalCount + moderateCount == 0(or after itsmaxIterationssafety net). On convergence it also promotes the PR out of Draft (gh pr ready) per@rules/git/general.mdcDraft pull requests, so the merge step in step 6 sees a non-draft, ready PR. - If the run reports residual Critical or Moderate findings, stop. Report the residual findings and the PR URL; do not attempt the merge.
6. Merge the PR
- Invoke
@skills/merge-github-pr/SKILL.mdwith the PR URL. - The merge skill performs its own pre-checks (
isDraft,mergeable,mergeStateStatus,statusCheckRollup[],reviewDecision) and will skip the merge with a reason on any failure. Surface that reason verbatim in the final report.
7. Stop on blockers
At any step, stop the chain and produce the final report when:
resolve-issuedoes not produce a PRcode-review-githubreports the PR has merge conflicts (review cancelled per its own contract)process-code-reviewcannot drive Critical + Moderate findings to zero within its iteration capmerge-github-prreportsisDraft == true(the PR is still a Draft — its review has not converged),mergeable != MERGEABLE,mergeStateStatusinDIRTY/BEHIND, any non-passing entry instatusCheckRollup[], orreviewDecision != APPROVED
Never retry or "fix" the blocker outside the contract of the delegated skill that surfaced it.
Output
A short report containing:
- Selected issue:
#+ URL +createdAt - PR created by
resolve-issue: URL (or the failure reason if none) code-review-githuboutcome: counts of Critical / Moderate / Minor (orskipped —)process-code-reviewoutcome: iterations run, residual Critical / Moderate count (orskipped —)merge-github-proutcome:merged/skipped —- For every skipped step, the verbatim reason returned by the delegated skill
Done when
- Exactly one issue was selected and either fully merged or the chain stopped at a documented blocker
- Every delegated skill that ran finished according to its own
Done whencontract - The final report lists the four step outcomes and the PR URL (when one was created)
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: pekral
- Source: pekral/cursor-rules
- License: MIT
- Homepage: https://pekral.cz
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.