Stuff: Skill for Claude Code

.agents/skills/todo-triage/SKILL.md

todo-triage is a skill for Claude Code, Codex from kyleve/Stuff. It costs 68 tokens per session (1,911 once invoked), scanned A, original, Apache-2.0.

A repository backlog-management procedure for moving inbox notes into area-specific TODO files and maintaining an audit report.

In plain words
What is it for?
Use it to triage INBOX.md, verify and expand TODO entries, archive completed work, review recent changes, and refresh MODULE_AUDIT.md.
Why use it?
It keeps unfinished work organized, checked against the current code, and separated from completed items.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: installed under .agents/ (shared by several agents); mentions AGENTS.md.

This is kyleve/Stuff's own configuration. It tells Claude Code and Codex how to work on Stuff itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything Stuff configures →

View source ↗ kyleve/Stuff
Reuse

Borrowing it

Nothing to install: this file belongs to kyleve/Stuff. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/kyleve/Stuff/main/.agents/skills/todo-triage/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/kyleve/Stuff

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for todo-triage

README.md
[![agentmods](https://agentmods.dev/badge/skills/kyleve/stuff/todo-triage/github.svg)](https://agentmods.dev/skills/kyleve/stuff/todo-triage)
Your own site
<a href="https://agentmods.dev/skills/kyleve/stuff/todo-triage"><img src="https://agentmods.dev/badge/skills/kyleve/stuff/todo-triage/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for todo-triage

Your own site · 80×15
<a href="https://agentmods.dev/skills/kyleve/stuff/todo-triage"><img src="https://agentmods.dev/badge/skills/kyleve/stuff/todo-triage.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 68 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,911 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00068 $0.01911
Opus 5.5 $0.00027 $0.00764
Sonnet 5.5 $0.00014 $0.00382
Haiku 4.5 $0.00007 $0.00191

Measured 22d ago against content hash 5954f5e6d926, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

todo-triage scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 22d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/todo-triage/SKILL.md · 142 lines

How it starts

The opening of the file, as written. The whole thing — 142 lines — stays where its author put it; the contents beside it link to each section on GitHub.

The backlog lives in TODOs.md files, one per area. This skill is the procedure for putting things into them and keeping them honest.

Read the root TODOs.md first. It owns the item format and the placement rule. This skill assumes both. It is the contract. This file is only the process.

Never invent structure. If a job here seems to need a new field, section, or file, change the root TODOs.md and say so. Do not improvise it into one area's file.

The weekly pass

The weekly automation runs the whole job in one go. The order matters. The backlog is the source of truth, and the report is written from it, so the report comes last.

  1. Drain INBOX.md — see below.
  2. Re-verify the open backlog, area file by area file. Close what shipped, correct line numbers that have moved, drop claims that are no longer true. This is the bulk of the work.
  3. Review the week's new surface — the commits and merged PRs landed since the last audit's header date — and file what you find, tagged (audit <date>).
  4. Rewrite MODULE_AUDIT.md from what the backlog now says — see below.
  5. Update the docs the week invalidated: a module's README.md / AGENTS.md when its architecture, public API, or a documented behavior changed. The root AGENTS.md when a global rule, a target, or the build/test flow did. Run ./sync-agents afterwards if any AGENTS.md changed.
  6. Push the branch and open a PR ready-for-review. Follow the github-workflow skill. Describe the end state: what moved in the backlog, what the audit now says, and what you verified rather than assumed.

An ad-hoc run — someone asking you to triage the inbox or file a finding — is just the relevant section below, not the whole pass.

Draining the inbox

INBOX.md holds raw human notes: terse, uncited, unverified, sometimes already fixed. Take each entry under # Open in turn.

  1. Understand what's being claimed. An entry like "Raw data browser (similar to SD browser)" is a feature ask. "why do we delete all the DB entries on logout?" is a question that can or cannot hide a bug. Resolve which before going further.
  2. Verify it against current source. Find the code. Make sure that the behavior is really what the note says, and that it hasn't already been fixed or already been filed. This is the step that earns the promotion. An entry that reaches a TODOs.md unverified is worse than one still sitting in the inbox, because it now reads as established.
  3. Expand it. Write the body the root format asks for: the File.swift:123 sites, why it matters (user-visible consequence, not just tidiness), and a concrete suggested fix. Preserve the human's intent. If the note asks a question you now know the answer to, answer it in the body rather than restating the question.
  4. Route it by the placement rule: the lowest TODOs.md spanning every area it touches. Create that area's file if it doesn't exist yet (copy the header shape from a sibling; link to the root format, don't restate it).
  5. Bucket and tag it. PX/P0/P1/P2, plus quick-win or needs-design. Tag the origin (human <date the note was written>). Keep the human's date, not today's. The point is to show where the item came from. A new item takes the bucket its severity implies (high → P0, medium → P1, low → P2). An item already in the file keeps the bucket it has. Priority is a decision someone made. A severity opinion from a later pass doesn't get to silently overrule it. Argue for the move in the body instead.
  6. Remove it from INBOX.md. The origin tag is the trail. Don't leave a copy behind.

Read the full file on GitHub · 142 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 22d ago Changed · +8 lines 5954f5e6d926
  2. 2mo ago First seen · 134 lines · 68 tokens per session scan A 41225864e39b

Subscribe to this mod's changes

todo-triage is a skill published in the GitHub repository kyleve/Stuff (4 stars, last pushed today), licensed Apache-2.0. It adds 68 tokens to every session and 1,911 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.