Issue Triage

Investigate issues against current upstream, prove the disposition, and own the fix. For a real bug, consolidate competing PRs into one maintainer-owned replacement per root-cause cluster, preserving useful work and contributor credit. Do not bounce implementation back to reporters or contributors.

This skill is agent- and repository-independent. Use the host agent's available shell, file, search, and delegation capabilities; no particular tool API or runtime is required. Read companion skills by name using the host's skill loader or their SKILL.md files. Use gh for GitHub, glab for GitLab, or the forge's authenticated API. Repository instructions determine test commands and platform-specific validation.

When to use

• /triage <issue URLs, numbers, range, or query>; a pasted report/thread is valid intake. Naming the skill in ordinary prose works too.
• Backlog sweeps, duplicate/resolution investigations, and issue-to-fix maintainer passes.
• PR-only review belongs to pr-triage; an already-owned PR's CI/reviews belong to pr-ready.

Authority and scope

• Bare /triage is investigate + verdict first, like pr-triage. No forge writes, implementation, commits, or pushes until authorized. Behavioral probes in disposable worktrees are allowed.
• “Fix”, “ship”, “execute”, or “go” authorizes the agreed implementation/publishing scope. Authorization for an entire triage-and-fix sweep carries through without asking per issue. A fix-only request does not authorize unrelated closures. “Audit”, “recommendations only”, and explicit restrictions override execution defaults.
• Establish repository, selected issues, authority, and reviewed base once. Infer the current repo when unambiguous; ask only for genuinely missing scope. An unspecified /triage does not authorize sweeping every repo.
• An authorized fix-and-ship run includes rebase auto-merge for eligible low-risk PRs, enabled when they open under the gate below; do not ask again per PR. Risky or uncertain changes require separate merge authorization. Explicit no-merge/review-only instructions override this default. UI changes still require visual approval before checks/commits/publishing under ui-only.
• No auto-closure for age, popularity, speculative product taste, or failed local setup. Apply the repository's contribution/closure policy. Security reports follow private disclosure policy, not public reproduction comments.