Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/prisma/prisma-nextnpx agentmods add skills/prisma/prisma-next/review-triage-phaseWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/prisma/prisma-next/review-triage-phase)<a href="https://agentmods.dev/skills/prisma/prisma-next/review-triage-phase"><img src="https://agentmods.dev/badge/skills/prisma/prisma-next/review-triage-phase.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.00835 |
| Opus 5 | $0.00018 | $0.00417 |
| Sonnet 5 | $0.00007 | $0.00167 |
| Haiku 4.5 | $0.00004 | $0.00084 |
Grade A, and why
review-triage-phase scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
91% identical to review-triage-phase — 4 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 104 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review Triage Phase
Run only the triage phase of the review-framework loop:
read current review state artifacts, bootstrap canonical review-actions.json, update triage fields, validate, then render review-actions.md.
Run commands from this skill directory. All script paths below are relative to it.
Inputs
- Required:
- PR URL
- Optional:
- output directory
If output directory is omitted, derive:
wip/reviews/<owner>_<repo>_pr-<number>/
Preconditions
Expected inputs in output dir:
<output-dir>/review-state.json<output-dir>/review-targets.json(optional)<output-dir>/review-state.md(optional)<output-dir>/summary.txt(optional)
If review-state.json is missing, instruct user to run:
/review-fetch-phase <PR_URL> [output-dir]
Note:
review-actions.jsonscaffolding is generated fromreview-state.targets, which now includes unresolved review threads, review bodies, and issue comments.- Compound review bodies: A single
pull_request_reviewtarget may contain multiple distinct findings (e.g., CodeRabbit bundles "outside diff range" comments, actionable comments, and nitpicks into one review body). The triager must decompose these into individual action items during triage — never blanket-dismiss a review body without reading its content.
Behavior
- Compute deterministic paths:
<output-dir>/review-state.json<output-dir>/review-actions.json<output-dir>/review-actions.md
- Enforce artifact safety before generation (must be ignored by git):
node ../review-fetch-phase/scripts/guard-review-artifacts-ignored.mjs --dir <output-dir>
- Bootstrap canonical action scaffold from review state:
node ./scripts/bootstrap-review-actions.mjs --in <output-dir>/review-state.json --out <output-dir>/review-actions.json
- Delegate triage to:
./agents/review-triager.md
- Require triager output contract:
review-actions.jsonis valid v2- targets use node IDs only
- actions remain intentionally ordered
- every
deferaction includes a Linear issue identifier - will-address actions for
review_threadtargets must remain actionable via thread replies (not PR reviews)
- Create Linear tracking for deferred work:
- create one or more Linear tickets (group related deferred comments)
- attach each deferred action to a Linear issue ID (
linearIssue) - ensure the deferred thread reply includes that Linear ticket URL
- Validate canonical actions JSON and enforce completed triage decisions:
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- agents/review-triager.md 7.9 KB
- package.json 405 B
- scripts/bootstrap-review-actions.mjs 4.5 KB runs code
- scripts/render-review-actions.mjs 7.3 KB runs code
- scripts/render-review-actions.test.mjs 2.4 KB runs code
- scripts/review-artifacts.mjs 6.0 KB runs code
- scripts/validate-review-actions.mjs 2.9 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 104 lines · 36 tokens per session scan A 5c7f5ff6a7ee
review-triage-phase is a skill published in the GitHub repository prisma/prisma-next (418 stars, last pushed 13d ago), licensed Apache-2.0. It adds 36 tokens to every session and 835 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. It is 91% identical to review-triage-phase, differing in 4 lines, and is treated as a copy.
Other skills, from other repositories
triage-contributor-pr
Triage open pull requests from external contributors to prisma/prisma and produce a per-PR verdict with evidence. Use when a maintainer asks to triage, evaluate, assess, or review the queue of incoming contributor PRs, to decide whether a fork PR is safe to run CI on, to check whether a PR is in scope for its version…
review-implement-phase
Implements triaged review actions, commits focused fixes, and posts Done plus resolves threads. Use when the user wants only the implementation phase of the review-framework workflow.
review-triage-phase
Produces canonical review actions from fetched review state and renders action markdown. Use when the user wants only triage/action-planning for the review-framework workflow.
no-bare-casts
Writing as in TypeScript or TSX production code, modifying a file that contains a bare as cast, silencing a type error with a cast, encountering as unknown as, or reviewing a cast site.
record-gotchas
Capture surprises, workarounds, and rough edges hit while consuming the public surface of Prisma Next, Prisma Compute, or Prisma Postgres — anything a real user of these products would experience. Fires whenever an operator (or agent) writes a workaround, hits a surprising failure mode, or finds undocumented behaviour…
contrib-pr
Open a high-quality external contributor PR against prisma/orm. Use when the user is an outside contributor (not a Prisma maintainer) and wants to submit a change as a pull request from a fork. Encodes the contribution flow from CONTRIBUTING.md so the resulting PR passes review on the first round.