Skip to content
Back to skills

Read Phabricator Task

BSecurity

Use when a `Phabricator` link like `https://phabricator.<sub>.<domain>/T<id>` appears, or when reading, searching, or analyzing Phabricator tasks via the official Phabricator MCP server. Not for creating or editing tasks, use the `manage-phabricator-task` skill for that.

  • 6 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added September 27, 2026
ai-agentsgobashapi

Works with

  • claude desktop
  • cursor
  • api
  • mcp

Security analysis

B88/100
  • criticalSends environment variables or credentials to an external URL

Pro shows the line behind each finding and how to fix it

Scanned September 27, 2026

npx -y skills add xrhstosmour/macsify --skill read-phabricator-task --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Read Phabricator Task?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Read Phabricator Task
[![Security: B — Skills Directory](https://www.skillsdirectory.com/api/skills/xrhstosmour-read-phabricator-task/badge)](https://www.skillsdirectory.com/skills/xrhstosmour-read-phabricator-task)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: read-phabricator-task
description: Use when a `Phabricator` link like `https://phabricator.<sub>.<domain>/T<id>` appears, or when reading, searching, or analyzing Phabricator tasks via the official Phabricator MCP server. Not for creating or editing tasks, use the `manage-phabricator-task` skill for that.
---

# Read Phabricator Task

## When to use

- User shares a Phabricator task link like: `https://phabricator.<sub>.<domain>/T<id>`.
- Reading, searching, or analyzing Phabricator tasks via the official Phabricator MCP server.
- User says "Phabricator" or "phab", and isn't asking to create or edit a task, see `manage-phabricator-task` for that.

When you encounter a `https://phabricator.<sub>.<domain>/T<id>` link, use the official Phabricator MCP server to fetch task details and related data.

## Required behavior

- Always use the Phabricator MCP tools first.
- Do not scrape or fetch Phabricator task pages directly in a browser.
- SSO-protected pages usually return a Google sign-in HTML page, not task content.
- If MCP calls fail, troubleshoot the MCP connection/auth first, then retry.

## Authentication

Use the official Phabricator MCP server only. Phabricator holds files, shared passwords, and secrets far beyond task content, so a manually managed credential is real exposure.

- Discover the available tools with `ToolSearch` (query `"phabricator"` or `"maniphest"`), exact tool names depend on how the server was registered locally, do not hardcode a guess.
- One-time setup, if the tools aren't found, resolve the server URL in this order, it's org-specific and must never be hardcoded or guessed:
  1. `$PHABRICATOR_MCP_URL`, if already set in the session.
  2. Derive it from `~/.arcrc`, standard `arc`/Phabricator tooling config, works for any org that has `arc` set up:
     ```bash
     PHAB_HOST=$(jq -r '.hosts | to_entries[] | select(.key | test("phabricator")) | .key' ~/.arcrc 2>/dev/null | head -1)
     [ -n "$PHAB_HOST" ] && echo "${PHAB_HOST%/api/}/ai/mcp"
     ```
     `/ai/mcp` is the path convention this org's MCP is hosted at, try it first, but don't assume every org uses the identical path, if the resulting URL fails to connect, that's a sign to fall through to step 3 rather than retry blindly.
  3. Ask the user for their organization's official Phabricator MCP URL.
  Tell the user to run `claude mcp add --transport http phabricator <url> -s user` (Claude Desktop users can instead check the connectors marketplace for their org's Phabricator connector). This is a manual step the user runs themselves, not something to script.
- No token is required. The first call opens a browser tab for login/authorize. Tokens are ephemeral and periodically expire, a re-authorize prompt mid-session is expected behavior, not a failure.
- Never fall back to a stored Conduit token, a raw `curl` call to `$PHAB/api/...`, or a different Phabricator MCP server. If the official MCP misbehaves, loop in the platform team instead.

## Base URL

Derive the Phabricator base URL from the link you see:

`https://phabricator.example.com/T67890` → `PHAB="https://phabricator.example.com"`

## Fetch a task by ID, T\<id\>

Extract the numeric ID from the link, like `T242861` to `242861`, and pass it to the MCP task-search tool (with `projects`/`subscribers` attachments included if the tool supports it). This is the robust path that avoids SSO HTML pages, always prefer it over a raw fetch of the task URL.

Response fields of interest:

- `result.data[0].fields.name`, title
- `result.data[0].fields.description.raw`, description body
- `result.data[0].fields.ownerPHID`, assignee PHID, null means unassigned
- `result.data[0].fields.authorPHID`, author PHID
- `result.data[0].fields.status.{value,name,color}`, status
- `result.data[0].fields.priority.name`, priority
- `result.data[0].fields.dateCreated` / `dateModified`, epoch timestamps
- `result.data[0].fields.dateClosed`, epoch timestamp, null if open
- `result.data[0].fields.closerPHID`, who resolved it
- `result.data[0].attachments.projects.projectPHIDs`, associated project PHIDs

## Compact task summary

Call the MCP task-search tool by ID and summarize: title, status, priority, created/modified dates, and the first ~3000 characters of the description.

## Task transactions, history and comments

Call the MCP task-transactions/history tool by ID.

Transaction types: `status`, `reassign`, `description`, `title`, `priority`, `core:edge`, `core:create`, `core:subscribers`, `core:space`.

## Resolve PHIDs to names

Call the MCP PHID-resolution tool with one or more PHIDs to get back full name and type for each.

## Search users

Call the MCP user-search tool, by exact username or by fuzzy display-name query. On this org's server it returns "not authorized" for every query shape, only self-lookup (who am I) works directly. To resolve someone else's username to a PHID, search tasks assigned to that username instead and read the owner PHID off a result, see `manage-phabricator-task`'s "Resolve a username to a PHID".

## Search projects

Call the MCP project-search tool by name query.

## Search tasks

Call the MCP task-search tool with the relevant constraint: free-text query, author PHID, or status (`open`, `inprogress`, `resolved`, etc.).

For "tasks I created/updated this week" style queries, resolve self via "Who am I?" below, then filter by `author_phids=[<self-phid>]` plus `created_after`/`modified_after` (Unix timestamps, e.g. `date -v-7d +%s` on macOS or `date -d '7 days ago' +%s` on Linux, for "this week").

## Who am I?

Call the MCP "who am I" tool to get the current authenticated user's PHID and username.

## Workboard columns

Read-only counterparts to `manage-phabricator-task`'s "Workboard columns" section, ask the user which board/project and, if needed, which column, rather than assuming either:

- `pha_workboard_search_columns`: list a board's columns, pass `project_phids=[<board project PHID>]`.
- `pha_workboard_search_tasks_by_column`: list the tasks currently sitting in a given column, pass `column_phid=<column PHID>`.

## Due date / reference fields

This skill is independently invocable, don't assume `manage-phabricator-task`'s "Field discovery" already ran earlier in this session. If it did, reuse that result. If not, do the same live check yourself before relying on either field's absence: `ToolSearch` (query like `"phabricator task update"`) for a due-date-shaped parameter, and confirm the `reference` parameter still exists. A real field, once confirmed present, appears either as a top-level `fields.*` entry or under a custom-fields object on the `pha_task_get`/`pha_task_search_advanced` response, inspect the actual response shape rather than assuming a key path. When no real field was found, fall back to parsing the `**Due:**` line and the `## References` section out of the description body, same fallback contract as the write side.

## Task URL format

- Task links: `https://phabricator.<sub>.<domain>/T<id>`
- User links: `https://phabricator.<sub>.<domain>/p/<username>/`
- Project links: `https://phabricator.<sub>.<domain>/tag/<slug>/`
- The underlying API takes numeric IDs, such as `242861`, not `T242861`.

## Pagination

For large result sets, pass the MCP search tool's cursor/page parameter (if it exposes one) to fetch subsequent pages, rather than assuming a single call returns everything.

## Notes

- Timestamps are Unix epoch, seconds. Convert to ISO 8601 with `date -u -r <epoch> "+%Y-%m-%dT%H:%M:%SZ"`.
- PHIDs are opaque internal identifiers, use the MCP PHID-resolution tool to resolve them.
- If the MCP tools aren't available, tell the user to add the server rather than falling back to a token, see Authentication above.
- If you see Google sign-in HTML, something is trying to fetch the page directly instead of going through the MCP tools, switch to the MCP tools.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.