Borrowing it
Nothing to install: this file belongs to adamayoung/TMDb. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/adamayoung/TMDb/main/.claude/skills/triage-issues/SKILL.mdgit clone --depth 1 https://github.com/adamayoung/TMDbWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/adamayoung/tmdb/triage-issues)<a href="https://agentmods.dev/skills/adamayoung/tmdb/triage-issues"><img src="https://agentmods.dev/badge/skills/adamayoung/tmdb/triage-issues/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/adamayoung/tmdb/triage-issues"><img src="https://agentmods.dev/badge/skills/adamayoung/tmdb/triage-issues.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 9 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.04978 |
| Opus 5 | $0.00000 | $0.02489 |
| Sonnet 5 | $0.00000 | $0.00996 |
| Haiku 4.5 | $0.00000 | $0.00498 |
Grade A, and why
triage-issues scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 393 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Triage Issues
Grooms the Backlog column of the TMDb GitHub Project into a queue someone
can work from without asking a question first.
The board is at github.com/users/adamayoung/projects/<n>; issues live in
adamayoung/TMDb. This skill owns the Ready test, the four exits, the
wontfix rules and the skip rule; the priority and size rubrics live in
.claude/workflows/triage-issues.js (RUBRIC), the copy handed to every
agent — nothing else in the repo restates any of them.
Issue creation is owned by .github/ISSUE_FILING.md;
this skill consumes what that produces.
Contract
Input: nothing. It discovers its own work. Output: field updates on the board, at most one comment per changed issue, a Project status update carrying the ordered run-list, and a summary to the caller. Never: opens a PR, edits source, or changes an issue that is not in Backlog.
Phase 1 — Resolve the board, and the tree
Project operations go through the GitHub MCP (mcp__github__projects_*), not
gh project. Per ADR-0009 the MCP is the default and gh covers only the
enumerated exceptions, which Projects is not — and concretely, gh project
requires a read:project token scope this repo's usual token does not carry, so
the gh route fails at the first call.
Resolve by title, never a hard-coded number — the number changes if the board is recreated, and a stale number makes every later write a silent no-op:
mcp__github__projects_list / list_projects owner: adamayoung, owner_type: user
→ select the project whose title is exactly "TMDb"
Zero matches or more than one → stop and say so. Do not guess.
"Headless" here means unattended within a session — it decides for itself. It cannot run on a GitHub Actions runner: the Project MCP is user-scoped and is not mounted there (ADR-0009 records this as the reason
claude.ymlandintegration-failure.ymlstay ongit/gh), andgh projectneeds a scope this repo's token lacks. Wiring this to a cron would fail at the call above.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 393 lines · 0 tokens per session scan A 57ca8f25438f
triage-issues is a skill published in the GitHub repository adamayoung/TMDb (176 stars, last pushed 9d ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 4,978 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
mcore-split-pr
Split a PR into multiple PRs to reduce the number of required CODEOWNERS reviewer groups.
shiplog
Recap of everything shipped since the last run - cross-repo PRs, security fixes, star deltas, and X traction, synthesized into a digest article and a ready-to-post shiplog in your voice.
llxprt-issue-workflow
Use this skill when asked to address, fix, or work on a GitHub issue in the llxprt-code repository. Covers the complete issue lifecycle - branch setup, gh CLI usage, test-first planning, subagent delegation and review loops, the full verification cycle (including the stepfun-37 smoke test), open code review (ocr), PR…
cyrus-setup-repository
Add one or more Git repositories to Cyrus configuration so it can process issues from those repos.
github-sync
Bidirectional synchronization of epics and tasks with GitHub issues, labels, and relationships.
github-notification-triage
Triage GitHub notifications and issue/PR queues.