github-issue-triage

A procedure for investigating GitHub issues, which are reports or requests attached to a software project, by checking their claims against the code and project plans.

In plain words
What is it for?
Use it to review an issue, verify relevant behavior, assess whether it fits the project's direction, and prepare a structured comment with findings and test steps.
Why use it?
It separates current, confirmed problems from outdated reports or misunderstandings before maintainers decide what to do.

Cursor rule for Cursor

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/andr-ca/agentharness/github-issue-triage
Clone the repo
git clone --depth 1 https://github.com/andr-ca/agentharness

Made for: Cursor.

Per session 40 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,638 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00040 $0.01638
Opus 5 $0.00020 $0.00819
Sonnet 5 $0.00008 $0.00328
Haiku 4.5 $0.00004 $0.00164

Measured yesterday against content hash faf156f548aa, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

github-issue-triage scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/rules/github-issue-triage.mdc · 119 lines

How it starts

The opening of the file, as written. The whole thing — 119 lines — stays where its author put it; the contents beside it link to each section on GitHub.

GitHub Issue Triage

Assess a GitHub issue by verifying its claims against actual code, checking fit against product vision, and leaving a structured comment with findings, corrections, and a test plan. This skill assesses and comments — it does not implement fixes. Fixes follow a separate deliberate step per this repo's Recommendation Assessment mandate in CLAUDE.md.

The Prompt (canonical form)

Triage issue #N. Start by fetching the full issue details (title, body, comments, labels, linked PRs). Then verify every factual claim in the issue against the actual running code — grep the relevant source, read the actual files/lines, and where feasible run the relevant code path (in a scratch/sandboxed way) to confirm it's real, not stale, not a misunderstanding. Check the ask against roadmap/vision docs (ROADMAP.md, ARCHITECTURE.md, DECISIONS.md, MANIFEST.md) and note whether it's a scoped fix vs. a bigger direction-setting ask needing human scoping. Draft and post a gh issue comment with: confirmed findings with evidence, corrections to stale/wrong claims, a recommendation per CLAUDE.md's Recommendation Assessment mandate, and concrete test/verification steps for the fix. Report what you found and what you posted.

Procedure

1. Fetch the issue

Run gh issue view <n> --json title,body,comments,labels,linkedPullRequests. Extract:

  • Title and body (claims to verify)
  • All comments (context, earlier findings, clarifications)
  • Labels (priority, type, status signals)
  • Linked PRs (related work, partial fixes, predecessor context)
2. Verify every factual claim against running code

This is the hardest step and the highest leverage. Do not trust the issue's prose — verify against the source.

For each claim:

  • File changes: Does the file exist? test -e <path>. Read it and check the actual line/section.
  • Behavior claims: Grep for the relevant code path. If feasible, run it in a scratch/sandboxed context (e.g., a test, a manual script in a temp directory, a clone of this repo or the repo's dependency) to observe actual behavior.
  • "Already fixed" archaeology: Run git log --all -p --grep=<keyword> or git log --all -S<string> to check whether a claimed-broken thing was already fixed by a later commit on a different branch or after the issue was filed.
  • Misunderstandings: If the claim rests on a false premise (wrong file path, misread config, older API surface), note that explicitly.

Read the full file on GitHub · 119 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 119 lines · 40 tokens per session scan A faf156f548aa

Subscribe to this mod's changes

github-issue-triage is a cursor rule published in the GitHub repository andr-ca/agentharness (1 stars, last pushed yesterday), licensed MIT. It adds 40 tokens to every session and 1,638 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.