Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cdbattags/ai --skill github-repo-triagegit clone --depth 1 https://github.com/cdbattags/aiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cdbattags/ai/github-repo-triage)<a href="https://agentmods.dev/skills/cdbattags/ai/github-repo-triage"><img src="https://agentmods.dev/badge/skills/cdbattags/ai/github-repo-triage/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cdbattags/ai/github-repo-triage"><img src="https://agentmods.dev/badge/skills/cdbattags/ai/github-repo-triage.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.01640 |
| Opus 5.5 | $0.00026 | $0.00656 |
| Sonnet 5.5 | $0.00013 | $0.00328 |
| Haiku 4.5 | $0.00007 | $0.00164 |
Grade A, and why
github-repo-triage scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 234 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GitHub Repo Triage
Phase 1: Reconnaissance
Gather full state before proposing anything.
# Open issues and PRs
gh issue list --state open --limit 50
gh pr list --state open --limit 50
# Forks (spot community work not submitted as PRs)
gh api repos/{owner}/{repo}/forks --jq '.[].full_name' --paginate
# Recent releases
gh release list --limit 5
# Branches
git branch -a
Present findings as a ranked table with tiers:
| Tier | Criteria |
|---|---|
| 1 - Critical | Security issues, data loss, broken CI |
| 2 - High | Bugs affecting users, ready-to-merge PRs |
| 3 - Medium | Feature PRs needing rework, enhancements |
| 4 - Low | Nice-to-have, docs, cosmetic |
| 5 - Close | Won't-fix, stale, already resolved |
Phase 2: PR Assessment
For each open PR, evaluate before touching code:
- Read the diff:
gh pr diff <N> - Check quality: syntax errors, missing error handling, debug logging, unrelated changes mixed in
- Check base: is it against current HEAD or a stale branch?
- Check tests: does it include tests? Do they follow existing patterns?
- Check author info:
gh api repos/{owner}/{repo}/pulls/<N>/commits --jq '.[].commit.author'
Decision Matrix
| Quality | Tests | Action |
|---|---|---|
| Good, clean | Yes | Cherry-pick as-is with attribution |
| Good logic, minor issues | Yes/No | Cherry-pick, fix issues, add tests |
| Good idea, bad implementation | No | Rewrite from scratch, credit author |
| Broken or wrong approach | N/A | Close with explanation |
Phase 3: Cherry-Pick Workflow
When manually integrating a PR (not using GitHub merge):
# 1. Make the code changes (edit files directly, don't git cherry-pick)
# 2. Add tests if missing
# 3. Run the test suite
# 4. Stage only the relevant files
git add <files>
# 5. Commit with attribution and auto-close
git commit -m "$(cat <<'EOF'
feat: description of what was added
Longer explanation if needed.
Co-authored-by: Full Name <[email protected]>
Closes #N
EOF
)"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 234 lines · 66 tokens per session scan A 6ffaa967a99f
github-repo-triage is a skill published in the GitHub repository cdbattags/ai (5 stars, last pushed 7mo ago), licensed MIT. It adds 66 tokens to every session and 1,640 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
pre-publish-review
Nuclear-grade 12-agent pre-publish release gate. Runs /get-unpublished-changes to detect all changes since last npm release, spawns up to 10 ultrabrain agents for deep per-change analysis, invokes /review-work (orchestrator manual QA plus one gate reviewer) for holistic review, and 1 oracle for overall release…
upload
Pre-upload gate for track handoff. Verifies review status, HLD approvals, deploy checklist, and validator chain before git upload or PR submission.
git-authoring
Authors and executes git work end to end — Conventional Commits messages, pull-request content, release notes, and pull-request review, plus the repository operations an engineer runs daily: branching, rebasing, squashing, cherry-picking, reverting, merge-conflict resolution, stashes, tags, remotes, and recovery…
cognitive-version-snapshot
A controlled process for saving a major new version of a system document as a dated snapshot.
sonic-review-architecture
Sonic Cursor Skill: Review Android changes against Clean Architecture, MVI, module boundaries, and project rules. Use when reviewing PRs, refactors, or asking if code follows architecture standards. Prefer sonic-review-complete for a full multi-check pass.
sonicg-review-architecture
OrbitalSonic Gemini Skill: Review Android changes against Clean Architecture, MVI, module boundaries, and project rules. Use when reviewing PRs, refactors, or asking if code follows architecture standards. Prefer sonicg-review-complete for a full multi-check pass.