Borrowing it
Nothing to install: this file belongs to aliyun/alibabacloud-devops-mcp-server. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/aliyun/alibabacloud-devops-mcp-server/master/.claude/skills/mcp_triage/SKILL.mdgit clone --depth 1 https://github.com/aliyun/alibabacloud-devops-mcp-serverWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aliyun/alibabacloud-devops-mcp-server/mcp_triage)<a href="https://agentmods.dev/skills/aliyun/alibabacloud-devops-mcp-server/mcp_triage"><img src="https://agentmods.dev/badge/skills/aliyun/alibabacloud-devops-mcp-server/mcp_triage/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aliyun/alibabacloud-devops-mcp-server/mcp_triage"><img src="https://agentmods.dev/badge/skills/aliyun/alibabacloud-devops-mcp-server/mcp_triage.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00064 | $0.01197 |
| Opus 5 | $0.00032 | $0.00598 |
| Sonnet 5 | $0.00013 | $0.00239 |
| Haiku 4.5 | $0.00006 | $0.00120 |
Grade A, and why
mcp_triage scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 127 lines — stays where its author put it; the contents beside it link to each section on GitHub.
处理 Issues 和 Pull Requests
批量处理当前仓库的所有 open issues 和 pull requests。
前置条件
- 已安装
ghCLI 并已登录（gh auth status） - 当前目录是目标仓库的 git 工作区
处理流程
Step 1: 获取概览
获取所有 open issues 和 PRs：
gh issue list --state open --json number,title,author,labels,createdAt,body --limit 50
gh pr list --state open --json number,title,author,labels,createdAt,isDraft,headRefName,baseRefName --limit 50
输出汇总表格，让用户了解当前工作量。
Step 2: 排序
按以下优先级处理：
Issues：
- 带
bug标签的 issue - 带
security标签的 issue - 其他 issue（按创建时间从旧到新）
Pull Requests：
- dependabot PR — patch/minor 升级（最简单，快速处理）
- dependabot PR — major 升级
- 社区贡献的 PR（按创建时间从旧到新）
Step 3: 逐一处理 Issue
对每个 issue 依次执行以下步骤：
3a. 展示信息
gh issue view <number> --json title,body,author,labels,comments
展示 issue 标题、作者、创建时间、内容摘要。
3b. 分析根因
- 在代码库中搜索 issue 中提到的关键字（函数名、参数名、错误信息）
- 追踪相关代码路径
- 如果 issue 涉及 API 行为，用
.env中的 token 实际调用验证
3c. 给出结论并询问用户
给出以下三类结论之一，必须等用户确认后才执行操作：
| 结论 | 操作 | 需要确认 |
|---|---|---|
| 可修复 | 提出修复方案，修复代码 | 是 — 确认方案后修复 |
| 需要更多信息 | 草拟回复 comment 请求补充信息 | 是 — 确认内容后发送 |
| Won't fix / 非 bug | 草拟回复并建议关闭 | 是 — 确认后关闭 |
修复 issue 后，不要自动发版。代码修改完成后告知用户，由用户决定是否发版。
Step 4: 逐一处理 Pull Request
对每个 PR 依次执行以下步骤：
4a. 展示信息
gh pr view <number> --json title,body,author,labels,files,additions,deletions,commits
gh pr diff <number>
展示 PR 标题、作者、变更文件数、增删行数。
4b. 代码评审
阅读 diff 内容，按以下维度评审：
- TypeScript 类型安全：类型是否正确，是否有
any滥用 - Zod schema 正确性：新增字段的类型、optional/required 是否与 API 一致
- API 兼容性：tool name 或 inputSchema 是否有 breaking change
- 安全性：有无凭证泄露、注入风险
- 依赖升级（dependabot PR）：查看 changelog 确认无 breaking change
4c. 给出结论并询问用户
| 结论 | 操作 | 需要确认 |
|---|---|---|
| 建议合并 | gh pr review --approve + gh pr merge --squash |
是 |
| 需要修改 | 草拟 review comment 指出问题 | 是 — 确认内容后发送 |
| 建议关闭 | 说明理由，草拟关闭 comment | 是 — 确认后关闭 |
对于 dependabot 的 patch/minor PR，可以批量展示评审结果，询问用户是否一次性全部合并。
Step 5: 汇总报告
所有 issue 和 PR 处理完毕后，输出汇总：
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 127 lines · 64 tokens per session scan A 9c8c7755c54c
mcp_triage is a skill published in the GitHub repository aliyun/alibabacloud-devops-mcp-server (168 stars, last pushed 6d ago), licensed Apache-2.0. It adds 64 tokens to every session and 1,197 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
review-implement-phase
Implements triaged review actions, commits focused fixes, and posts Done plus resolves threads. Use when the user wants only the implementation phase of the review-framework workflow.
engram-branch-pr
PR creation workflow for Engram following the issue-first enforcement system. Trigger: When creating a pull request, opening a PR, or preparing changes for review.
verify-behavior
Verify or reproduce visible product behavior by driving the real UI with pi-computer-use's checked tools, requiring verified expect postconditions and durable state evidence for meaningful UI flows. Use when triage needs visual reproduction, implementation needs behavioral proof, review needs interactive confirmation…
github-contributor
End-to-end playbook for shipping high-quality pull requests to open-source projects you don't maintain — discovery, CONTRIBUTING compliance, PR-size check, minimal-diff implementation, PR description with AI-assisted disclosure, conflict resolution, and post-submission maintainer interaction. Use whenever creating…
revdiff
Review diffs, files, and documents with inline annotations in a TUI overlay, or answer questions about revdiff usage, configuration, themes, and keybindings. Opens revdiff in agterm/tmux/zellij/herdr/kitty/wezterm/cmux/ghostty/iterm2/emacs-vterm, captures annotations, and addresses them. Works in git, hg, and jj repos…
write-pr
Reference standards for writing pull request titles and descriptions in the tldraw repository, plus the pre-flight comment sweep over the diff. Use as supporting guidance when another skill or workflow needs PR content standards, not as the user-facing create/update PR workflow.