OpenShell is a runtime for autonomous AI agents that executes them in sandboxed environments governed by declarative policies. It is used to restrict agents' access to files, credentials, data, and network resources, and the catalogue includes skills and workflows for operating and contributing to it.
Borrowing it
Nothing to install: this file belongs to NVIDIA/OpenShell. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/NVIDIA/OpenShell/main/.agents/skills/review-triage-queue/SKILL.mdgit clone --depth 1 https://github.com/NVIDIA/OpenShellWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nvidia/openshell/review-triage-queue)<a href="https://agentmods.dev/skills/nvidia/openshell/review-triage-queue"><img src="https://agentmods.dev/badge/skills/nvidia/openshell/review-triage-queue/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nvidia/openshell/review-triage-queue"><img src="https://agentmods.dev/badge/skills/nvidia/openshell/review-triage-queue.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.01157 |
| Opus 5.5 | $0.00022 | $0.00463 |
| Sonnet 5.5 | $0.00011 | $0.00231 |
| Haiku 4.5 | $0.00005 | $0.00116 |
Grade A, and why
review-triage-queue scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 23d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 64 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review Triage Queue
Create a decision-focused, local Markdown report. Do not write to GitHub.
Local state
Use these ignored local paths under .agents/triage-duty/:
- Checkpoint:
state.local.yml - Reports:
reports/<UTC timestamp>.md - Action records:
actions/<UTC timestamp>.md - Inbox:
inbox.md
Record first-run coverage. Update cursors only after a complete report; partial reads must not skip unread items. Search with overlap and deduplicate source items.
Keep the checkpoint minimal: repository, last successful scan, source and backlog cursors, explicit dispositions, and next triage issue. Action records are authoritative; reconcile the checkpoint from them before proceeding. Reports are immutable. Never store credentials, personal data, private reasons, or vulnerability details; never stage duty files.
Read unchecked inbox entries at the start of every review. Treat them as local follow-up prompts, not as independent evidence or authorization for an external action. When an entry materially informs the review, include it in the report's Local inbox follow-up section. After the dated report is written, mark that entry complete in the inbox with the report filename. Leave entries unchecked when they were not yet actionable or were not considered.
Gather intake
Follow Label Discovery, retrieving all pages of current label definitions. Identify the triage queue by its description. Read all pages of each source:
- All open GitHub issues in the triage queue, ordered by most recently updated.
- Newly opened community issues with no
state:*label; exclude maintainer/core-contributor issues and already-routed work from label recommendations. This includes stale lifecycle labels. - Older open community issues meeting the same eligibility rule: measure first; audit all when there are at most 20, otherwise inspect the five oldest remaining candidates per run. Use a separate
(created_at, number)backlog cursor, advanced only after inspection and reporting; wrap at the end. Advancing it must not drop pending recommendations. Age sets ordering only and never justifies closure. - Open non-draft Dependabot pull requests. Surface these explicitly so they do not age out or go stale while waiting for maintainer attention.
- Newly opened non-draft community pull requests.
- Failed CI runs on
main. - Published repository documentation for applicable public answers.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 23d ago First seen · 64 lines · 54 tokens per session scan A a602fd69e94e
review-triage-queue is a skill published in the GitHub repository NVIDIA/OpenShell (21,172 stars, last pushed yesterday), licensed Apache-2.0. It adds 54 tokens to every session and 1,157 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-15.
review-triage-queue compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| review-triage-queueNVIDIA/OpenShell | Skill | 21k | yesterday | Apache-2.0 | A | 54 | Claude Code, Codex |
| merge-batchdiegosouzapw/OmniRoute | Skill | 83k | 5d ago | MIT | A | 46 | Claude Code |
| prowler-commitprowler-cloud/prowler | Skill | 15k | yesterday | Apache-2.0 | A | 44 | Claude Code, Codex |
| gh-auth-isolationgithub/gh-aw | Skill | 5.6k | today | MIT | A | 20 | Claude Code, Codex |
| github-skillzeenie-ai/OpenCompany | Skill | 1.1k | yesterday | MIT | A | 51 | Claude Code |
| comet-githubrpamis/comet | Skill | 3.3k | today | MIT | A | 72 | Claude Code, Codex |
| release-helperSahir619/fable-method | Skill | 2.3k | 1mo ago | MIT | A | 43 | Claude Code |