From 84020497a09f9be73f2db50b84665a9b54313957 Mon Sep 17 00:00:00 2001 From: xiaolai Date: Thu, 30 Apr 2026 00:56:16 +0000 Subject: [PATCH] docs(scrum-master-agent): add Network Access disclosure to SKILL.md notify_channels.py makes outbound HTTPS POST requests to Slack/Teams webhook URLs when notifications are enabled. This was undisclosed in SKILL.md despite the outbound call being present in the implementation. Added a Network Access section under Limitations describing the opt-in nature, URL source (env vars/config, not user input), and default-off behavior. Co-Authored-By: Claude Code --- generated-skills/scrum-master-agent/SKILL.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/generated-skills/scrum-master-agent/SKILL.md b/generated-skills/scrum-master-agent/SKILL.md index b58e9e8..cd1e1de 100644 --- a/generated-skills/scrum-master-agent/SKILL.md +++ b/generated-skills/scrum-master-agent/SKILL.md @@ -323,6 +323,9 @@ Calculate sprint health score based on: velocity (40%), burndown trend (30%), bl - **GitHub Projects**: Beta GraphQL API may change (adapter may need updates) - **Azure DevOps**: Work item hierarchy can be complex (flatten in export) +### Network Access +When notifications are enabled, `notify_channels.py` makes outbound HTTPS POST requests to Slack or Microsoft Teams webhook URLs. These URLs are read from environment variables (`SLACK_WEBHOOK_URL`, `TEAMS_WEBHOOK_URL`) or `config.yaml` — not from user input. Notifications are **opt-in and disabled by default**; the skill does not make any network calls if notifications are not configured. + ## When NOT to Use This Skill - **Kanban workflows**: Skill is optimized for Scrum sprints (not continuous flow)