pr-skill-triage

Triage GitHub PRs modifying SKILL.md files with security and schedule checks.

626|225|Updated Mar 4, 2026
One-click install
npx skills add https://github.com/aaronjmars/aeon --skill pr-skill-triage
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: pr-skill-triage
Source: https://github.com/aaronjmars/aeon/tree/main/skills/pr-skill-triage
Command: npx skills add https://github.com/aaronjmars/aeon --skill pr-skill-triage

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Structured triage for inbound PRs that introduce or modify Skill files, replacing slow manual review with a single clear receipt that highlights security risks, required secrets, and schedule conflicts.

Core Features & Use Cases

  • Security scan per Skill.md: Runs the existing scanner across every changed SKILL.md in the PR and summarizes the first high-severity findings.
  • Required-secrets enumeration: Extracts the environment variables referenced by the Skill content so operators know what to provision before enabling it.
  • Cron schedule collision detection: Checks proposed Skill schedules against existing schedules to prevent noisy runner contention.
  • Operator-ready PR receipt: Posts one structured comment with verdict and evidence, and logs results for traceability.

Quick Start

Ask the system to run the pr-skill-triage Skill on the target PR number from aaronjmars/aeon, for example by providing PR number 241 as the var input.

Frequently Asked Questions about pr-skill-triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate pull request triage for GitHub PRs that modify Skill files?

Automating pull request triage involves scanning changed SKILL.md files to produce a structured receipt with a deterministic verdict. It runs security scans, enumerates required secrets, and detects cron schedule conflicts, posting results as a single PR comment.

How does cron conflict detection work for GitHub scheduled workflows?

Cron conflict detection checks proposed Skill schedules against the existing aeon.yml schedule set to prevent runner contention. It identifies overlapping cron slots across scheduled workflows and reports collisions within the PR triage receipt.

What is the best way to enumerate required secrets for a proposed GitHub Skill?

Enumerating required secrets extracts environment variables referenced in the Skill content from the PR head SHA. It provides operators with a list of necessary credentials to provision before the Skill can be successfully enabled.

Does the triage process integrate with existing security scanning scripts?

The triage process integrates with security scanning by invoking the existing skills/skill-security-scan/scan.sh script. It establishes security truth and summarizes the first high-severity findings for each changed SKILL.md file.

Can I retrieve PR metadata and file content at the head SHA using gh api?

Retrieving PR metadata and file content at the head SHA is supported through gh api calls. The triage process uses the GitHub CLI to fetch pull request details and changed files to ensure the review reflects the exact proposed state.

What are the limitations of automated workflow-dispatch driven skill PR review?

The limitations of automated skill PR review include its strict scope of processing only PRs that add or modify SKILL.md files. It relies on the existing scan.sh for security truth and does not generate verdicts outside the structured triage receipt.