How do I install the Triage skill?

Run npx skillmds@latest add darkroomengineering/triage in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Triage safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Triage?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Triage free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Triage?

darkroomengineering (@darkroomengineering) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Triage by darkroomengineering — Agent Skill

Name: Triage
Author: darkroomengineering

File contents

Repo Triage

First-pass sweep of a repo you didn't build. Output is a report, not a diff.

Guardrail (non-negotiable)

If the repo's origin is outside the darkroomengineering org: read-only. Never commit, never push, never open a PR (incident 2026-07-07). Findings go in the report; the user decides what crosses the org boundary. Check first:

git remote get-url origin

Pipeline

Record the current state with git branch --show-current, git status --short, git log -1 --oneline, and git remote get-url origin. Do not checkout, pull, fetch, reset, stash, or otherwise change an external repository. State that freshness against the remote is unknown unless the current checkout already contains evidence that proves it.
Farolero coverage check. Read package.json and record whether the repository declares farolero. Do not execute repository binaries during read-only triage, including node_modules/.bin/farolero: executable project dependencies can mutate state or expose credentials. If coverage is absent, note that bun add -D farolero && bunx farolero baseline write is an adoption path for the repository owner to run later. Do not install anything on an external repo.
Fan out explore agents in ONE message:
- (a) structure + dependency freshness
- (b) TypeScript/lint/config hygiene
- (c) obvious perf and a11y issues on key pages
- (d) security smells (exposed env, secrets in history, unpinned actions)
Rank findings: Critical / Should-fix / Cosmetic. Each with file:line and a one-line fix sketch. Max 15 findings — this is a triage, not an audit; recommend /audit codebase if depth is warranted.
End with a split: "safe to fix directly" vs "needs client conversation".

Output

Ranked findings table (Critical / Should-fix / Cosmetic)
Org-boundary status: internal (fixes allowed) or external (report-only)
Recommended next skill: /fix, /audit codebase, or nothing

---name: triagedescription: First-pass, read-only review of a client or unfamiliar repo with ranked glaring issues. Triggers "triage this repo", "point out glaring issues", "first pass on this client repo".---# Repo TriageFirst-pass sweep of a repo you didn't build. Output is a report, not a diff.## Guardrail (non-negotiable)If the repo's origin is outside the darkroomengineering org: **read-only. Never commit, never push, never open a PR** (incident 2026-07-07). Findings go in the report; the user decides what crosses the org boundary. Check first:```bashgit remote get-url origin```## Pipeline1. Record the current state with `git branch --show-current`, `git status --short`, `git log -1 --oneline`, and `git remote get-url origin`. Do not checkout, pull, fetch, reset, stash, or otherwise change an external repository. State that freshness against the remote is unknown unless the current checkout already contains evidence that proves it.2. **Farolero coverage check.** Read `package.json` and record whether the repository declares `farolero`. Do not execute repository binaries during read-only triage, including `node_modules/.bin/farolero`: executable project dependencies can mutate state or expose credentials. If coverage is absent, note that `bun add -D farolero && bunx farolero baseline write` is an adoption path for the repository owner to run later. Do not install anything on an external repo.3. Fan out `explore` agents in ONE message: - (a) structure + dependency freshness - (b) TypeScript/lint/config hygiene - (c) obvious perf and a11y issues on key pages - (d) security smells (exposed env, secrets in history, unpinned actions)4. Rank findings: Critical / Should-fix / Cosmetic. Each with `file:line` and a one-line fix sketch. Max 15 findings — this is a triage, not an audit; recommend `/audit codebase` if depth is warranted.5. End with a split: "safe to fix directly" vs "needs client conversation".## Output- Ranked findings table (Critical / Should-fix / Cosmetic)- Org-boundary status: internal (fixes allowed) or external (report-only)- Recommended next skill: `/fix`, `/audit codebase`, or nothing

Frequently asked questions

Triage