triage
An agent skill by mattpocock, from mattpocock/skills. Tags: issue-tracking, project-management, triage, validation, workflow.
What it does
Move issues and external PRs through a state machine of triage roles, categorise, verify, grill if needed, and write agent-ready briefs.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add mattpocock/skills --skill triageOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/mattpocock/skills
cp -r skills/skills/engineering/triage ~/.claude/skills/triageSafety box score
Grade C, moderate risk: 21 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill triages GitHub issues and external PRs by reading their full context, querying the tracker, and then posting labels/comments or closing items. The main risk is not code execution but broad tracker-side authority: it can publicly change issue state, send comments on the user's behalf, and create persistent `.out-of-scope/` records for rejected enhancements.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 0 (none) | No shell commands, script execution, or code evaluation are included; the skill is plain Markdown/YAML guidance only. |
| Network access | 2 (moderate) | It explicitly queries and posts to the issue tracker: "Query the issue tracker," "read the full issue or PR," and "post a comment" all imply remote API traffic and data leaving the machine. |
| Filesystem reach | 1 (low) | It reads repository files like `AGENT-BRIEF.md` and `.out-of-scope/*.md`, and may write new `.out-of-scope/<concept>.md` files, but the scope is limited to the repo workspace. |
| Secrets & credentials | 0 (none) | There is no instruction to read credential stores, keychains, `.env` files, browser sessions, or paste secrets. |
| Privilege & persistence | 0 (none) | No sudo, service installation, shell startup edits, global installs, or OS/git settings changes are described. |
| Instruction hijack surface | 0 (none) | I found no prompt-injection style instructions to ignore higher-level rules or fetch remote instructions; the required AI disclaimer is transparent rather than deceptive. |
| Irreversible actions | 3 (high) | The skill can change tracker state and publish comments on the user's behalf: "apply the role directly," "post an agent brief comment," and "close the issue" are high-blast-radius actions. |
| Transparency | 0 (none) | The reviewed files are readable Markdown/YAML with no binaries, generated blobs, or runtime-downloaded code. |
Before installing
- Read `SKILL.md` and `OUT-OF-SCOPE.md` to confirm you want the skill to comment and close tracker items on your behalf.
- Test it first in a throwaway repo or sandbox issue tracker with a low-privilege token.
- Verify the account/credential scope used by the agent can only access the intended repository and tracker surface.
Rated 2026-10-16 by an automated review of 4 files from the skill's repository.
Source
- Repository
- mattpocock/skills (all skills from this repository)
- Path
- skills/engineering/triage/SKILL.md
- Branch
- main
- Updated
- 2026-10-05
Related skills
- triage-issue-reports — Triage Slack issue reports with one thread-only verdict, evidence review, cause-aware routing, tracker dedupe, and fail-closed ticket creation.
- to-tickets — Break a plan, spec, or the current conversation into a set of tracer-bullet tickets, each declaring its blocking edges.
- marketplace-health-check — Run a full 6-dimension health check of this Claude Code skills marketplace repo — code/script safety, documentation/SSOT consistency, security/PII leaks.
- cli-for-agents — Designs or reviews CLIs so coding agents can run them reliably: non-interactive flags, layered --help with examples, stdin/pipelines, fast actionable errors.
- create-verification-skill — Generate a project-local verification skill that drives your app the way a user does — any language, framework, or platform.
- maintain-verification-skill — Periodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session driving every feature.