Agent skills

Open-source skills for coding agents

Seven skills that let coding agents build and migrate Atlassian apps without hallucinating.

Browse the skillsGet AI for your team
§01
Forged Skills · 7 entries
From the workshop

Seven skills that taught Claude Code how to ship Atlassian apps.

Battle-tested instruction sets, extracted from production apps, that stop AI agents from hallucinating Forge manifests, breaking ADF trees, or 400-ing on JQL.

Skills
7
Source apps
2
License
MIT
install-skills.sh
$ git clone https://github.com/leanzero-srl/leanzero-forge-skills$ cd leanzero-forge-skills$ ./scripts/install-skills.sh
leanzero-forge-skillsMIT · open
  1. 01

    Jira Forge

    atlassian-jira-forge-skill

    Forge inside Jira Cloud — workflow modules, async queues, KVS, and the scope/manifest mistakes nobody tells you about.

    Use when

    Declaring jira:workflowValidator / Condition / PostFunction, scheduledTriggers, webtriggers, custom field types, issue panels, dashboard gadgets, or any @forge/* resolver. Includes bitbucket:mergeCheck.

    Skip for

    Calling Jira from an external Node/Python service over HTTPS → jira-api-skill. Confluence-only work → atlassian-confluence-forge-skill.

    Unlocks

    • Async-event handlers with timeoutSeconds: 900 to escape the 25-second function ceiling
    • KVS sharding patterns for hot keys (>1 MB/s writes) lifted from PPM Pro
    • Capability-token webtriggers — public HTTPS endpoints with bearer auth done right
    • Drops the long-stale myth that workflow validators are Connect-only — they're real Forge modules

    Covers

    workflowValidatorworkflowConditionworkflowPostFunctionscheduledTriggertrigger→consumerwebtriggercustomFieldissuePaneldashboardGadgetbitbucket:mergeCheck
    16templates·30docs·4scripts
    Read SKILL.md
    Lifted fromPPM Pro·CogniRunner
  2. 02

    Confluence Forge

    atlassian-confluence-forge-skill

    Forge inside Confluence — pageBanners, ADF surgery, CQL-indexed content properties, and the auth patterns that aren't AP.context.getToken().

    Use when

    Building Confluence Forge modules (pageBanner, contentAction, contextMenu, contentBylineItem, macro, customContent, contentProperty) or hitting /wiki/api/v2 from a resolver/trigger.

    Skip for

    External HTTPS client (Node/Python/CI) → confluence-api-skill. Jira-only Forge → atlassian-jira-forge-skill.

    Unlocks

    • ADF tree surgery patterns from Sentinel Vault — idempotent edits that don't break pages
    • Three-level Confluence authorization (requestConfluence in bridge, asApp/asUser in resolvers) wired correctly
    • filter.ignoreSelf + atlassianId check so your own writes don't re-trigger your own handlers
    • GET → bump version.number → PUT — kills the silent 409 Conflict cycle on page/property writes

    Covers

    pageBannercontentActioncontextMenucontentBylineItemmacrocustomContentcontentPropertyspacePageglobalSettingsscheduledTrigger
    14templates·30docs·4scripts
    Read SKILL.md
    Lifted fromSentinel Vault·License Leash
  3. 03

    Organizations Admin

    atlassian-organizations-api-skill

    The cross-product admin surface at api.atlassian.com/admin — orgs, users, groups, directories, audit events, security policies, DLP, API tokens.

    Use when

    Inviting / suspending users, managing groups + directories, querying the audit-event stream, setting IP-allowlist / SAML / MFA policies, configuring DLP classification levels, revoking user API tokens.

    Skip for

    Per-product content (Jira issues, Confluence pages) — those have their own skills. Forge app development → use the Forge skills.

    Unlocks

    • All four sub-APIs covered: Organization, DLP, API Access, Admin Control — with the auth boundaries between them
    • The Bearer-only-on-DLP/API-Access/Admin-Control gotcha that silently breaks OAuth integrations
    • Cursor-paginated audit-event polling for the strictest rate-limited Atlassian surface
    • Forge recipe: api.fetch + kvs.getSecret instead of api.asApp (which can't reach this host)

    Covers

    /orgs/users/groups/directories/domains/events/policies/workspaces/classification-levels/api-access/admin-control
    5templates·14docs·4scripts
    Read SKILL.md
    Lifted fromLicense Leash
  4. 04

    Jira REST API

    jira-api-skill

    External Node / Python / CI services calling Jira Cloud over HTTPS — JQL with cursor pagination, ADF, OAuth 3LO via the cloudid gateway.

    Use when

    Calling /rest/api/3/* from outside Atlassian — bots, integrations, sync jobs, scripts. API token Basic auth, OAuth 2.0 3LO, or the api.atlassian.com/ex/jira/{cloudid} gateway.

    Skip for

    Code running inside Atlassian as a Forge function → atlassian-jira-forge-skill (it gets the auth handed to it).

    Unlocks

    • POST /rest/api/3/search/jql with nextPageToken — startAt-based pagination is gone, save the cursor
    • OAuth 2.0 3LO end-to-end: authorize → token exchange → /accessible-resources cloudid → gateway calls
    • ADF construction for descriptions, comments, worklogs — it's a JSON tree, not Markdown, not HTML
    • Drops the 'sign your own JWT' Connect myth — Cloud REST will not validate locally-signed JWTs

    Covers

    /issue/issue/transitions/issue/comment/project/search/jql/myself/user/search/issue/notify
    4templates·10docs·7scripts
    Read SKILL.md
  5. 05

    Confluence REST API

    confluence-api-skill

    External services calling Confluence Cloud — v2 pages with ADF, the GET → bump → PUT version dance, v1 fallback for CQL.

    Use when

    Calling /wiki/api/v2/* (and /wiki/rest/api/* for legacy CQL search) from Node, Python, a doc-as-code pipeline, or a content-sync job.

    Skip for

    Forge function inside Confluence → atlassian-confluence-forge-skill. Atlassian Org admin (users/groups across products) → atlassian-organizations-api-skill.

    Unlocks

    • v2 cursor pagination for /spaces and /pages — the actually-working ?cursor= shape, with the limit caps
    • GET → bump version.number → PUT — kills the silent 409 Conflict cycle on every page update
    • body.atlas_doc_format.value is stringified JSON — JSON.parse before traversal, every time
    • Per-content properties with CQL search — app data without a sidecar database

    Covers

    /pages/spaces/blogposts/footer-comments/properties/versions/attachment (v1)/search?cql (v1)
    5templates·10docs·6scripts
    Read SKILL.md
  6. 06

    Atlassian Migration Scripts

    atlassian-migration-scripts-skill

    Idempotent, resumable Atlassian migration scripts — Plan→Sync→Audit triad with rate-limit-aware clients, identity resolution, and CSV audit reports.

    Use when

    Cleaning up after JCMA, Cloud→Cloud tenant consolidation, bulk-mutating thousands of Jira issues or Confluence pages, mending Forge app data after migration, or any two-phase Atlassian sync that needs audit verification.

    Skip for

    One-off curl or a single REST call → use gh api. Migrations JCMA fully handles → let JCMA run first. Building a Forge app → use atlassian-jira-forge-skill or atlassian-confluence-forge-skill.

    Unlocks

    • Plan→Sync→Audit triad — two-phase, two-gate (--dry-run / --confirm) safety stops you from mutating the wrong tenant
    • Resumable, idempotent jobs — re-running after partial failure picks up where it stopped, no double-writes
    • Post-JCMA cleanup: rewrite broken filter JQL, remap custom field IDs, mend Forge KVS from outside the app
    • Seeded-sample audits with CSV spot-checks — human-reviewable proof the change actually landed

    Covers

    plan-scriptsync-scriptaudit-scriptpreflightidentity-resolverjql-rewriterbackup-managerinstance-fingerprintworker-poolcsv-writer
    29templates·21docs·5scripts
    Read SKILL.md
  7. 07

    Forge Security Review

    forge-security-review

    Technical profile, SAST and SCA for a Forge app — and the advisory-data traps that make a clean-looking scan a lie your reviewer will catch.

    Use when

    Someone asks for a technical profile, SAST/SCA report, dependency or vulnerability scan, SBOM, or security-approval evidence for a Forge app. Also before shipping any dependency or security fix.

    Skip for

    Building the app in the first place → the Forge skills. A plain Node service with no manifest and no Forge sandbox to reason about — the profile half doesn't apply.

    Unlocks

    • The OSV-vs-npm-audit split — when a vendor abandons npm, OSV scanners flag the patched version forever and the reviewer's scan contradicts yours
    • Canary-validated scanning — a Semgrep run whose ruleset never loaded returns the identical zero to clean code
    • The risk classes no scanner has a rule for: prompt injection into privileged tool-calls, decompression bombs, phantom deps
    • Drops the 'it's inherited from the SDK, so it's Atlassian's to patch' reflex — 10 of 15 came back fixAvailable: true

    Covers

    manifest-profileegress-surfacesemgrep-sastnpm-audit-scacanary-validationosv-vs-npmfixAvailable-splitphantom-depsmutable-tagsprompt-injectionforge install list
    1templates·5docs·1scripts
    Read SKILL.md
§02
Source · 2 shipping apps

Lifted from real shipping apps.

Each app surfaced patterns that survived production — the survivors became the skills above.

CogniRunnerCapability-token web triggers, multi-provider AI key storage, fail-open workflow validators, async-queue offload for >25s work.Sentinel VaultCapsule-style resolver registration, KVS prefix indexing, ADF tree surgery, three-level Confluence authorization, native @mention notifications.