triage

Triage

Follow the governing instructions and the user's requirements for communication, code style, authorization, and delegation. This skill supplies task-specific guidance, not permission to expand the task. Its workflow and output fields describe internal checks and relevant content, not a mandatory response layout or a progress report. When used within broader authorized work, continue that work through completion rather than stopping to deliver this skill's intermediate result.

Move an ambiguous incoming item to a justified next state.

Establish the item

Capture the reported behavior, source, affected users or systems, environment, recency, and available evidence. Check for duplicates, known incidents, related changes, and existing ownership where those sources are available.

Validate

Attempt the smallest safe reproduction or corroborating check. Distinguish confirmed, plausible, unsupported, duplicate, expected behavior, and cannot reproduce. Identify the exact missing information when validation is blocked.

Classify

Assess severity from impact and urgency rather than tone. Identify likely owning component, scope, dependencies, security or data risk, and whether immediate containment is needed. Do not invent priority labels that the project has not defined.

For a suspected security event, distinguish an unsupported or false signal, opportunistic compromise, targeted compromise, and an extreme vulnerability requiring incident response. Route evidence through the approved security owner and preserve it instead of treating the item as an ordinary defect.

Prepare the brief

State the problem, evidence, reproduction, expected behavior, acceptance criteria, constraints, likely touch points, and recommended next state. Write labels, comments, or tracker updates only with authorization.

Output

Return the classification, confidence, rationale, missing information, owner candidate, and agent-ready brief.