Azure DevOps Reports

Read Azure DevOps projects, teams, team members, saved queries, and work items securely; run WIQL-based reporting; and export spreadsheet-ready reports with...

Security Scan

The skill is internally consistent with its stated purpose: it only needs Node/Python, uses an Azure DevOps PAT and org to perform read-only reporting, and the code and instructions align with that functionality.

Purpose & Capability

Name/description, required binaries (node, python3, pip3), and required env vars (AZURE_DEVOPS_ORG, AZURE_DEVOPS_PAT) match the provided scripts and read-only reporting functionality.

Instruction Scope

SKILL.md instructs loading a skill-local .env and running the included scripts. The runtime steps and exact CLI commands map to the code; the code only calls dev.azure.com endpoints (WIQL, workitemsbatch, projects, teams, iterations) and writes local JSON/CSV/XLSX outputs.

Install Mechanism

No install spec is provided; the code is instruction-first and uses only standard Node core modules and a single Python package (xlsxwriter in requirements.txt). The only install step recommended is `pip3 install -r requirements.txt` which is proportional.

Credentials

Only AZURE_DEVOPS_ORG and AZURE_DEVOPS_PAT are required (PAT is primary). No unrelated credentials or external service keys are requested. Config is read from a skill-local .env as documented.

Persistence & Privilege

Skill does not request always:true, does not modify other skills or global settings, and limits output to files under the skill directory (config enforces outputDir resolution inside the skill directory).

Assessment

This skill appears coherent and read-only, but take these precautions before installing: 1) Provide a least-privilege PAT (recommended scopes: vso.project and vso.work) and avoid giving broader write/admin scopes. 2) Keep the .env file local and do not commit it to source control; the skill reads credentials from that file. 3) The skill makes network requests to dev.azure.com and writes report files under the skill directory—verify output files and their location. 4) Error responses may include response bodies (the code prints response content on HTTP errors), so avoid using a PAT that exposes unusually broad access; rotate the PAT if it is reused elsewhere. 5) Install only the declared Python dependency (xlsxwriter) and confirm node/python are trusted on the host. If you need higher assurance, review the small JS and Python files included (they contain the full behavior) or run the scripts in a constrained environment before granting access to sensitive org accounts.

Use this skill for secure, read-focused Azure DevOps reporting.

Configuration

Load credentials from a local .env file stored in this skill directory.

Required variables:

• AZURE_DEVOPS_ORG
• AZURE_DEVOPS_PAT

Optional defaults:

• AZURE_DEVOPS_DEFAULT_PROJECT
• AZURE_DEVOPS_DEFAULT_TEAM
• AZURE_DEVOPS_DEFAULT_QUERY_ID
• AZURE_DEVOPS_OUTPUT_DIR

If required values are missing, ask the user to create or update .env in this skill directory.

Runtime requirements

This skill requires:

• Node.js
• Python 3
• pip3
• Python package: xlsxwriter

Install Python dependency once:

pip3 install -r requirements.txt

Safety guarantees

• Read-only Azure DevOps access only
• No create, update, or delete operations for Azure DevOps work items
• No secret logging
• No Authorization header logging
• No arbitrary shell execution from user input
• Output restricted to local report files under the skill directory
• AZURE_DEVOPS_OUTPUT_DIR must resolve inside the skill directory
• Prefer least-privilege PAT scopes: vso.project and vso.work

Workflow

1. Load config from the skill-local .env file.
2. Resolve project, team, and query id from explicit arguments or configured defaults.
3. Decide whether the request is project-scoped, team-scoped, team-member scoped, saved-query, sprint-scoped, or custom-WIQL.
4. Fetch work item ids via WIQL when filtering is needed.
5. Fetch detailed work item fields.
6. Normalize records for reporting.
7. Default to the configured saved query when no explicit command or query id is provided.
8. Export to JSON or CSV data bundles.
9. Build summary tables for state, assignee, and work item type.
10. Build Excel charts from exported JSON when the user asks for workbook generation.
11. Use project listing, team listing, team-member listing, sprint listing, and saved-query reporting when the user asks in plain language.

Scripts

• scripts/projects.js — list projects
• scripts/teams.js — list teams in a project and team members
• scripts/iterations.js — list team iterations / current sprint
• scripts/queries.js — list saved queries and inspect a query definition
• scripts/workitems.js — run work item queries and normalize results
• scripts/export-report.js — export JSON/CSV data bundles
• scripts/build_excel_report.py — generate Excel workbooks with charts from exported JSON

Exact script usage

Run all commands from the skill directory:

cd /path/to/azure-devops-reports

1) List projects

node scripts/projects.js list

2) List teams in a project

node scripts/teams.js list "Project Name"

3) List members in a team

node scripts/teams.js members "Project Name" "Team Name"

4) List current sprint

node scripts/iterations.js current "Project Name" "Team Name"

5) List all iterations / sprints

node scripts/iterations.js list "Project Name" "Team Name"

6) List saved queries in a project

node scripts/queries.js list --project "Project Name"

7) Get a saved query definition by id

node scripts/queries.js get --project "Project Name" --id "QUERY_GUID"

8) Fetch work items using saved query id

Explicit:

node scripts/workitems.js query-id --project "Project Name" --id "QUERY_GUID"

With defaults from .env:

node scripts/workitems.js query-id

9) List work items closed in the last 7 days

Using the default project from .env:

node scripts/workitems.js closed-last-week

With an explicit project:

node scripts/workitems.js closed-last-week --project "Project Name"

10) Export report data as JSON

Default saved-query export using .env defaults:

node scripts/export-report.js

Explicit saved-query export:

node scripts/export-report.js query-id \
  --project "Project Name" \
  --id "QUERY_GUID" \
  --format json \
  --out query-data.json

Explicit sprint summary export:

node scripts/export-report.js sprint-summary \
  --project "Project Name" \
  --team "Team Name" \
  --format json \
  --out sprint-summary.json

11) Build Excel workbook from exported JSON

python3 scripts/build_excel_report.py \
  --input output/query-data.json \
  --output output/query-report.xlsx

Ask ClawBot in plain English

These requests should map to the skill without manual script execution:

• show my Azure DevOps projects
• how many teams do we have?
• list all team members in <Your Team Name> team
• can you list the sprints?
• generate the Azure DevOps report
• regenerate the excel
• list all work items closed in last week
• summarize closed items from last week
• show current progress of sprint 07
• which team member has most open items?

References

Read these only if needed:

• references/field-mapping.md for normalized field choices
• references/report-types.md for report presets and chart ideas
• references/api-notes.md for endpoint notes and PAT scope guidance