What is review-triage-phase?

A focused step in a pull-request review process that turns fetched review comments into a written action plan. It records whether each finding should be fixed, deferred, excluded, or marked as already resolved.

Use it after fetching a GitHub pull request's review state to create, validate, and render review actions.

It gives review comments a consistent status and keeps the decisions in both structured and readable files. This helps prevent findings from being forgotten or handled inconsistently.

review-triage-phase — Skill for Claude Code by prisma

About the project

Prisma ORM is a Node.js and TypeScript database toolkit that lets applications work with databases through a programming interface instead of writing every query directly in SQL. Developers use it with databases including PostgreSQL, MySQL, MariaDB, SQL Server, SQLite, MongoDB, and CockroachDB. The catalogue add-ons provide agent rules, skills, hooks, agents, and other workflows for using Prisma.

prisma/orm · 47,612 stars · on GitHub · prisma.io

Install

Getting it into your agent

It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.

Clone the repo

git clone --depth 1 https://github.com/prisma/orm

agentmods

npx agentmods add skills/prisma/orm/review-triage-phase

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/prisma/orm/review-triage-phase/github.svg)](https://agentmods.dev/skills/prisma/orm/review-triage-phase)

Your own site

<a href="https://agentmods.dev/skills/prisma/orm/review-triage-phase"><img src="https://agentmods.dev/badge/skills/prisma/orm/review-triage-phase/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/prisma/orm/review-triage-phase"><img src="https://agentmods.dev/badge/skills/prisma/orm/review-triage-phase.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 36 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 885 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

Snyk warn 7 Sept 2026
NVIDIA SkillSpector pass 7 Sept 2026

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00036	$0.00885
Opus 5	$0.00018	$0.00443
Sonnet 5	$0.00007	$0.00177
Haiku 4.5	$0.00004	$0.00089

Measured 5d ago against content hash 922b6d27c695, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

review-triage-phase scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

The scan reads SKILL.md. This mod also ships 5 executable files (scripts/bootstrap-review-actions.mjs, scripts/render-review-actions.mjs, scripts/render-review-actions.test.mjs, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

Copies of this mod

1 near-identical copy found in the catalogue:

review-triage-phase — 91% identical, 4 lines differ

skills-contrib/review-triage-phase/SKILL.md · 104 lines

How it starts

The opening of the file, as written. The whole thing — 104 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Review Triage Phase

Run only the triage phase of the review-framework loop:

read current review state artifacts, bootstrap canonical review-actions.json, update triage fields, validate, then render review-actions.md.

Run commands from this skill directory. All script paths below are relative to it.

Inputs

Required:
- PR URL
Optional:
- output directory

If output directory is omitted, derive:

wip/reviews/<owner>_<repo>_pr-<number>/

Preconditions

Expected inputs in output dir:

<output-dir>/review-state.json
<output-dir>/review-targets.json (optional)
<output-dir>/review-state.md (optional)
<output-dir>/summary.txt (optional)

If review-state.json is missing, instruct user to run:

/review-fetch-phase <PR_URL> [output-dir]

Note:

review-actions.json scaffolding is generated from review-state.targets, taking the thread and review-body targets. Issue-comment targets are captured in review-state.json but get no scaffolded action.
Compound review bodies: A single pull_request_review target may contain multiple distinct findings (e.g., CodeRabbit bundles "outside diff range" comments, actionable comments, and nitpicks into one review body). The triager must decompose these into individual action items during triage — never blanket-dismiss a review body without reading its content.

Behavior

Compute deterministic paths:
- <output-dir>/review-state.json
- <output-dir>/review-actions.json
- <output-dir>/review-actions.md
Enforce artifact safety before generation (the artifacts must stay untracked). In a git checkout the guard asks git directly; in a Jujutsu workspace with no git directory it accepts a directory under the workspace root's ignored wip/ tree:

node ../review-fetch-phase/scripts/guard-review-artifacts-ignored.mjs --dir <output-dir>

Bootstrap canonical action scaffold from review state:

node ./scripts/bootstrap-review-actions.mjs --in <output-dir>/review-state.json --out <output-dir>/review-actions.json

Read the full file on GitHub · 104 lines

Files

What ships with it

7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

5d ago First seen · 104 lines · 36 tokens per session scan A 922b6d27c695

Subscribe to this mod's changes

review-triage-phase is a skill published in the GitHub repository prisma/orm (47,612 stars, last pushed yesterday), licensed Apache-2.0. It adds 36 tokens to every session and 885 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Code review Commits Databases Git and workflow TypeScript javascript nodejs orm prisma

dev-self-merge

Merge self-check for a green PR. Reads the PR's required-check status from the checks API (the committed ci-status feed is RETIRED), outputs MERGE (mark task completed, stand down — server-side auto-enqueue enqueues.

loopdive/js2 · 54 tokens

prisma-orm

Use when modeling data or writing type-safe queries with Prisma ORM in TypeScript — schema.prisma, prisma.config.ts, the generated Prisma Client, and Prisma Migrate, including the v6 to v7 upgrade. NOT schema-as-TS with a SQL builder (that is drizzle-orm), NOT ORM-agnostic zero-downtime migration (that is…

ericrisco/rsc-harness · 101 tokens

pr-conflict-refresh

Find every open PR that is CONFLICTING/DIRTY against current main after a merge wave, ping its assigned dev to merge main into their branch and push, and track the re-test status.

loopdive/js2 · 45 tokens

session-wrapup

End-of-session checkpoint — append diary, update active sprint doc with interim results/retro, write tech-lead handoff, commit and push. Use before /compact or at end-of-day. Distinct from sprint-wrap-up which closes a sprint.