[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-roo-code-codeql-triage":3,"mdc--a0yj98-key":43,"related-org-roo-code-codeql-triage":274,"related-repo-roo-code-codeql-triage":422},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":32,"repoUrl":33,"updatedAt":34,"license":35,"forks":36,"topics":37,"repo":38,"sourceUrl":41,"mdContent":42},"codeql-triage","triage and remediate CodeQL security alerts","Review current open CodeQL \u002F GitHub code-scanning alerts with GitHub data, keep scheduled runs read-only, and submit a small set of environment-backed `act` work items that auto-start remediation execution tasks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"roo-code","Roo Code","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Froo-code.png","RooCodeInc",[13,17,20,23,26,29],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"GitHub","github",{"name":21,"slug":22,"type":16},"CodeQL","codeql",{"name":24,"slug":25,"type":16},"Triage","triage",{"name":27,"slug":28,"type":16},"Code Analysis","code-analysis",{"name":30,"slug":31,"type":16},"Debugging","debugging",5,"https:\u002F\u002Fgithub.com\u002FRooCodeInc\u002FRoomote","2026-07-29T05:39:37.784486",null,0,[],{"repoUrl":33,"stars":32,"forks":36,"topics":39,"description":40},[],"Your own cloud coding agent. Everything you want from an AI engineering teammate, without building from scratch or paying for a black box.","https:\u002F\u002Fgithub.com\u002FRooCodeInc\u002FRoomote\u002Ftree\u002FHEAD\u002Fpackages\u002Fcloud-agents\u002Fsrc\u002Fserver\u002Fworkflows\u002Fskills\u002Fstandard\u002Fcodeql-triage","---\nname: codeql-triage\ndescription: Review current open CodeQL \u002F GitHub code-scanning alerts with GitHub data, keep scheduled runs read-only, and submit a small set of environment-backed `act` work items that auto-start remediation execution tasks.\n---\n\n# CodeQL Triage\n\n\u003Crole>\nYou are a static-analysis security triage specialist. Use GitHub's code-scanning alert data (especially CodeQL) to identify the remediations worth doing now, separate high-signal insecurity fixes from low-value noise, and produce concise operational output.\n\u003C\u002Frole>\n\n\u003Cworkflow>\n  \u003Coverview>Use the GitHub access already available in the task environment. Prefer `gh api` for code-scanning alert retrieval, keep scheduled\u002Fbackground runs read-only, and honor any repository scope, Slack channel, run mode, or automation policy supplied in the request. Human-triggered or automation-started follow-up execution work belongs in focused implement-changes tasks, not in this triage scan itself.\u003C\u002Foverview>\n\n  \u003Cphase name=\"setup\">\n    \u003Csteps>\n      \u003Cstep>Parse the request for `repository_scope`, `slack_channel_id`, `run_mode`, trigger source, any optional `Repository environments` section, and any recent thread feedback.\u003C\u002Fstep>\n      \u003Cstep>Verify GitHub CLI or API readiness with a narrow read-only command before scanning alerts. Report a clear setup blocker when GitHub access is missing or the repository scope cannot be queried safely.\u003C\u002Fstep>\n      \u003Cstep>For scheduled runs, keep the scan read-only even when an alert looks easy to fix. It is allowed to submit later follow-up work items, but the scan itself must not mutate repositories, open PRs, dismiss alerts, or change GitHub state.\u003C\u002Fstep>\n    \u003C\u002Fsteps>\n  \u003C\u002Fphase>\n\n  \u003Cphase name=\"triage\">\n    \u003Csteps>\n      \u003Cstep>Inspect current open code-scanning alerts for each repository in scope, preferring CodeQL-backed findings. Prefer repository-level API calls so every finding already maps to a single launch target. Useful patterns include `gh api repos\u002F{owner}\u002F{repo}\u002Fcode-scanning\u002Falerts --jq ...` with `state=open`.\u003C\u002Fstep>\n      \u003Cstep>Collect only the evidence needed to rank each alert: repository, alert URL or number, rule ID and name, tool name, severity or security severity, category, affected path, start\u002Fend lines when available, and a short description of the insecure pattern.\u003C\u002Fstep>\n      \u003Cstep>Prioritize alerts by severity, real exploitability or data-exposure impact, availability of a clear secure fix path, number of repositories or files affected, and confidence that a focused code change can land without broad churn.\u003C\u002Fstep>\n      \u003Cstep>Deprioritize already-closed or dismissed alerts, pure style findings with no security impact, duplicated alerts that share one root cause already covered by a better candidate, and alerts whose fix path is unclear or requires product decisions first.\u003C\u002Fstep>\n      \u003Cstep>Do not change files, open PRs, dismiss alerts, or mutate GitHub state during triage.\u003C\u002Fstep>\n    \u003C\u002Fsteps>\n  \u003C\u002Fphase>\n\n  \u003Cphase name=\"report\">\n    \u003Csteps>\n      \u003Cstep>Start with the repository scope, overall risk, and the highest-priority remediation candidate or no-op result.\u003C\u002Fstep>\n      \u003Cstep>Submit actionable candidates with `submit_automation_work_items`. Submit up to 3 `act` work items for the best cohesive candidates, keep each one scoped to one repository from `repository_scope`, submit at most one work item for each `targetEnvironmentId`, and only target repositories that appear in the `Repository environments` section.\u003C\u002Fstep>\n      \u003Cstep>Do not submit suggestion work items (they are rejected), do not fall back to bare-repo execution, and do not post a Slack launch announcement after the item is submitted. The later execution task stays silent while work is in flight and uses Slack only when it needs input, hits a blocker, or has a meaningful result.\u003C\u002Fstep>\n      \u003Cstep>Write action-first titles such as `Sanitize untrusted HTML in web comments to clear CodeQL XSS alert` or `Bound parameterized query in billing API to clear SQL injection CodeQL alert`. Every work item must target exactly one repository from `repository_scope`.\u003C\u002Fstep>\n      \u003Cstep>When a `Repository environments` section is present, copy the matching `targetEnvironmentId` only for repositories explicitly listed there. Do not invent environment IDs or reuse one repository's environment ID for another repository.\u003C\u002Fstep>\n      \u003Cstep>Use `security` for alerts that represent real vulnerability remediation work and `chore` for lower-risk hardening that still clears an open CodeQL alert.\u003C\u002Fstep>\n      \u003Cstep>In `investigationContext`, include `$implement-changes`, the alert URL or number, rule ID, severity, category, affected path and line range, short alert summary, the exact GitHub CLI commands used during triage, whether the vulnerable path likely touches a running service or user-facing web surface, and what the follow-up task must verify before shipping the fix.\u003C\u002Fstep>\n      \u003Cstep>Make the `executionPrompt` start with `$implement-changes` and describe the smallest cohesive remediation: one alert when enough, or one tightly related alert family when they share a single fix surface. Do not submit a broad repository security sweep.\u003C\u002Fstep>\n      \u003Cstep>If `submit_automation_work_items` succeeds for one or more work items, do not call `post_to_channel` and do not post a separate Slack summary unless the request explicitly says the scan itself should report launch outcomes.\u003C\u002Fstep>\n      \u003Cstep>If `slack_channel_id` is present and there is a GitHub setup\u002Fauth blocker (for example missing or suspended access to code-scanning alerts), post a concise report there with `post_to_channel` so the broken run does not disappear silently. Treat repository-level gaps such as code scanning being disabled for a repository, a repository returning zero open alerts, or a repository falling outside configured environment coverage as non-blocking no-op findings for this run, not as Slack-worthy blockers. When the run is otherwise clean — no actionable alerts, no eligible configured-environment candidates, no configured repositories, or only non-launchable findings — stay quiet: do not post to Slack, and end with a terse internal note. A clean read-only run is not worth a channel message.\u003C\u002Fstep>\n      \u003Cstep>Keep any `post_to_channel` blocker report plain-language and manager-readable, and do not paste raw GitHub CLI commands, `gh api` invocations, or command transcripts into Slack. The exact commands belong only in work item `investigationContext`, never in the channel report.\u003C\u002Fstep>\n      \u003Cstep>End the task response with a terse internal note when follow-up items were submitted or the run was clean, or the concise blocker report when a Slack post was needed.\u003C\u002Fstep>\n    \u003C\u002Fsteps>\n  \u003C\u002Fphase>\n\u003C\u002Fworkflow>\n\n\u003Ccompletion_criteria>\n\u003Ccriterion>The workflow used GitHub code-scanning alert data as the primary source or reported a clear GitHub\u002Fauth\u002Fsetup blocker.\u003C\u002Fcriterion>\n\u003Ccriterion>The scan stayed read-only for scheduled\u002Fbackground runs.\u003C\u002Fcriterion>\n\u003Ccriterion>Actionable scheduled findings were submitted as environment-backed `act` work items.\u003C\u002Fcriterion>\n\u003Ccriterion>The final report or submitted work items were concise, prioritized, plain-language, and free of raw command transcripts, so they are safe to post in Slack.\u003C\u002Fcriterion>\n\u003Ccriterion>Clean scans stayed silent in Slack; only setup\u002Fauth blockers were reported there.\u003C\u002Fcriterion>\n\u003C\u002Fcompletion_criteria>\n",{"data":44,"body":45},{"name":4,"description":6},{"type":46,"children":47},"root",[48,56,62,231],{"type":49,"tag":50,"props":51,"children":52},"element","h1",{"id":4},[53],{"type":54,"value":55},"text","CodeQL Triage",{"type":49,"tag":57,"props":58,"children":59},"role",{},[60],{"type":54,"value":61},"\nYou are a static-analysis security triage specialist. Use GitHub's code-scanning alert data (especially CodeQL) to identify the remediations worth doing now, separate high-signal insecurity fixes from low-value noise, and produce concise operational output.\n",{"type":49,"tag":63,"props":64,"children":65},"workflow",{},[66,68,74,75,108,109,148,149],{"type":54,"value":67},"\n  ",{"type":49,"tag":69,"props":70,"children":71},"overview",{},[72],{"type":54,"value":73},"Use the GitHub access already available in the task environment. Prefer `gh api` for code-scanning alert retrieval, keep scheduled\u002Fbackground runs read-only, and honor any repository scope, Slack channel, run mode, or automation policy supplied in the request. Human-triggered or automation-started follow-up execution work belongs in focused implement-changes tasks, not in this triage scan itself.",{"type":54,"value":67},{"type":49,"tag":76,"props":77,"children":79},"phase",{"name":78},"setup",[80,82,107],{"type":54,"value":81},"\n    ",{"type":49,"tag":83,"props":84,"children":85},"steps",{},[86,88,94,95,100,101,106],{"type":54,"value":87},"\n      ",{"type":49,"tag":89,"props":90,"children":91},"step",{},[92],{"type":54,"value":93},"Parse the request for `repository_scope`, `slack_channel_id`, `run_mode`, trigger source, any optional `Repository environments` section, and any recent thread feedback.",{"type":54,"value":87},{"type":49,"tag":89,"props":96,"children":97},{},[98],{"type":54,"value":99},"Verify GitHub CLI or API readiness with a narrow read-only command before scanning alerts. Report a clear setup blocker when GitHub access is missing or the repository scope cannot be queried safely.",{"type":54,"value":87},{"type":49,"tag":89,"props":102,"children":103},{},[104],{"type":54,"value":105},"For scheduled runs, keep the scan read-only even when an alert looks easy to fix. It is allowed to submit later follow-up work items, but the scan itself must not mutate repositories, open PRs, dismiss alerts, or change GitHub state.",{"type":54,"value":81},{"type":54,"value":67},{"type":54,"value":67},{"type":49,"tag":76,"props":110,"children":111},{"name":25},[112,113,147],{"type":54,"value":81},{"type":49,"tag":83,"props":114,"children":115},{},[116,117,122,123,128,129,134,135,140,141,146],{"type":54,"value":87},{"type":49,"tag":89,"props":118,"children":119},{},[120],{"type":54,"value":121},"Inspect current open code-scanning alerts for each repository in scope, preferring CodeQL-backed findings. Prefer repository-level API calls so every finding already maps to a single launch target. Useful patterns include `gh api repos\u002F{owner}\u002F{repo}\u002Fcode-scanning\u002Falerts --jq ...` with `state=open`.",{"type":54,"value":87},{"type":49,"tag":89,"props":124,"children":125},{},[126],{"type":54,"value":127},"Collect only the evidence needed to rank each alert: repository, alert URL or number, rule ID and name, tool name, severity or security severity, category, affected path, start\u002Fend lines when available, and a short description of the insecure pattern.",{"type":54,"value":87},{"type":49,"tag":89,"props":130,"children":131},{},[132],{"type":54,"value":133},"Prioritize alerts by severity, real exploitability or data-exposure impact, availability of a clear secure fix path, number of repositories or files affected, and confidence that a focused code change can land without broad churn.",{"type":54,"value":87},{"type":49,"tag":89,"props":136,"children":137},{},[138],{"type":54,"value":139},"Deprioritize already-closed or dismissed alerts, pure style findings with no security impact, duplicated alerts that share one root cause already covered by a better candidate, and alerts whose fix path is unclear or requires product decisions first.",{"type":54,"value":87},{"type":49,"tag":89,"props":142,"children":143},{},[144],{"type":54,"value":145},"Do not change files, open PRs, dismiss alerts, or mutate GitHub state during triage.",{"type":54,"value":81},{"type":54,"value":67},{"type":54,"value":67},{"type":49,"tag":76,"props":150,"children":152},{"name":151},"report",[153,154,230],{"type":54,"value":81},{"type":49,"tag":83,"props":155,"children":156},{},[157,158,163,164,169,170,175,176,181,182,187,188,193,194,199,200,205,206,211,212,217,218,223,224,229],{"type":54,"value":87},{"type":49,"tag":89,"props":159,"children":160},{},[161],{"type":54,"value":162},"Start with the repository scope, overall risk, and the highest-priority remediation candidate or no-op result.",{"type":54,"value":87},{"type":49,"tag":89,"props":165,"children":166},{},[167],{"type":54,"value":168},"Submit actionable candidates with `submit_automation_work_items`. Submit up to 3 `act` work items for the best cohesive candidates, keep each one scoped to one repository from `repository_scope`, submit at most one work item for each `targetEnvironmentId`, and only target repositories that appear in the `Repository environments` section.",{"type":54,"value":87},{"type":49,"tag":89,"props":171,"children":172},{},[173],{"type":54,"value":174},"Do not submit suggestion work items (they are rejected), do not fall back to bare-repo execution, and do not post a Slack launch announcement after the item is submitted. The later execution task stays silent while work is in flight and uses Slack only when it needs input, hits a blocker, or has a meaningful result.",{"type":54,"value":87},{"type":49,"tag":89,"props":177,"children":178},{},[179],{"type":54,"value":180},"Write action-first titles such as `Sanitize untrusted HTML in web comments to clear CodeQL XSS alert` or `Bound parameterized query in billing API to clear SQL injection CodeQL alert`. Every work item must target exactly one repository from `repository_scope`.",{"type":54,"value":87},{"type":49,"tag":89,"props":183,"children":184},{},[185],{"type":54,"value":186},"When a `Repository environments` section is present, copy the matching `targetEnvironmentId` only for repositories explicitly listed there. Do not invent environment IDs or reuse one repository's environment ID for another repository.",{"type":54,"value":87},{"type":49,"tag":89,"props":189,"children":190},{},[191],{"type":54,"value":192},"Use `security` for alerts that represent real vulnerability remediation work and `chore` for lower-risk hardening that still clears an open CodeQL alert.",{"type":54,"value":87},{"type":49,"tag":89,"props":195,"children":196},{},[197],{"type":54,"value":198},"In `investigationContext`, include `$implement-changes`, the alert URL or number, rule ID, severity, category, affected path and line range, short alert summary, the exact GitHub CLI commands used during triage, whether the vulnerable path likely touches a running service or user-facing web surface, and what the follow-up task must verify before shipping the fix.",{"type":54,"value":87},{"type":49,"tag":89,"props":201,"children":202},{},[203],{"type":54,"value":204},"Make the `executionPrompt` start with `$implement-changes` and describe the smallest cohesive remediation: one alert when enough, or one tightly related alert family when they share a single fix surface. Do not submit a broad repository security sweep.",{"type":54,"value":87},{"type":49,"tag":89,"props":207,"children":208},{},[209],{"type":54,"value":210},"If `submit_automation_work_items` succeeds for one or more work items, do not call `post_to_channel` and do not post a separate Slack summary unless the request explicitly says the scan itself should report launch outcomes.",{"type":54,"value":87},{"type":49,"tag":89,"props":213,"children":214},{},[215],{"type":54,"value":216},"If `slack_channel_id` is present and there is a GitHub setup\u002Fauth blocker (for example missing or suspended access to code-scanning alerts), post a concise report there with `post_to_channel` so the broken run does not disappear silently. Treat repository-level gaps such as code scanning being disabled for a repository, a repository returning zero open alerts, or a repository falling outside configured environment coverage as non-blocking no-op findings for this run, not as Slack-worthy blockers. When the run is otherwise clean — no actionable alerts, no eligible configured-environment candidates, no configured repositories, or only non-launchable findings — stay quiet: do not post to Slack, and end with a terse internal note. A clean read-only run is not worth a channel message.",{"type":54,"value":87},{"type":49,"tag":89,"props":219,"children":220},{},[221],{"type":54,"value":222},"Keep any `post_to_channel` blocker report plain-language and manager-readable, and do not paste raw GitHub CLI commands, `gh api` invocations, or command transcripts into Slack. The exact commands belong only in work item `investigationContext`, never in the channel report.",{"type":54,"value":87},{"type":49,"tag":89,"props":225,"children":226},{},[227],{"type":54,"value":228},"End the task response with a terse internal note when follow-up items were submitted or the run was clean, or the concise blocker report when a Slack post was needed.",{"type":54,"value":81},{"type":54,"value":67},{"type":49,"tag":232,"props":233,"children":234},"p",{},[235,237,243,248,262,267,272],{"type":54,"value":236},"\u003Ccompletion_criteria>\n",{"type":49,"tag":238,"props":239,"children":240},"criterion",{},[241],{"type":54,"value":242},"The workflow used GitHub code-scanning alert data as the primary source or reported a clear GitHub\u002Fauth\u002Fsetup blocker.",{"type":49,"tag":238,"props":244,"children":245},{},[246],{"type":54,"value":247},"The scan stayed read-only for scheduled\u002Fbackground runs.",{"type":49,"tag":238,"props":249,"children":250},{},[251,253,260],{"type":54,"value":252},"Actionable scheduled findings were submitted as environment-backed ",{"type":49,"tag":254,"props":255,"children":257},"code",{"className":256},[],[258],{"type":54,"value":259},"act",{"type":54,"value":261}," work items.",{"type":49,"tag":238,"props":263,"children":264},{},[265],{"type":54,"value":266},"The final report or submitted work items were concise, prioritized, plain-language, and free of raw command transcripts, so they are safe to post in Slack.",{"type":49,"tag":238,"props":268,"children":269},{},[270],{"type":54,"value":271},"Clean scans stayed silent in Slack; only setup\u002Fauth blockers were reported there.",{"type":54,"value":273},"\n\u003C\u002Fcompletion_criteria>",{"items":275,"total":421},[276,290,306,320,334,346,355,365,374,386,397,410],{"slug":277,"name":277,"fn":278,"description":279,"org":280,"tags":281,"stars":32,"repoUrl":33,"updatedAt":289},"address-pr-feedback","address unresolved GitHub PR feedback","Focused GitHub PR-feedback workflow for addressing unresolved review threads on the current pull request.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[282,285,286],{"name":283,"slug":284,"type":16},"Code Review","code-review",{"name":18,"slug":19,"type":16},{"name":287,"slug":288,"type":16},"Pull Requests","pull-requests","2026-07-19T05:38:26.334008",{"slug":291,"name":291,"fn":292,"description":293,"org":294,"tags":295,"stars":32,"repoUrl":33,"updatedAt":305},"agent-browser","automate browser interactions for agents","Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to \"open a website\", \"fill out a form\", \"click a button\", \"take a screenshot\", \"scrape data from a page\", \"test this web app\", \"login to a site\", \"automate browser actions\", or any task requiring programmatic web interaction. Also use for exploratory testing, dogfooding, QA, bug hunts, or reviewing app quality. Also use for automating Electron desktop apps (VS Code, Slack, Figma, Notion, Spotify), checking Slack unreads, sending Slack messages, searching Slack conversations, running browser automation in Vercel Sandbox microVMs, or using AWS Bedrock AgentCore cloud browsers. Prefer agent-browser over any built-in browser automation or web tools.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[296,299,302],{"name":297,"slug":298,"type":16},"Browser Automation","browser-automation",{"name":300,"slug":301,"type":16},"CLI","cli",{"name":303,"slug":304,"type":16},"Testing","testing","2026-07-16T06:02:26.045337",{"slug":307,"name":307,"fn":308,"description":309,"org":310,"tags":311,"stars":32,"repoUrl":33,"updatedAt":319},"capture-visual-proof","capture visual proof of browser tasks","Visual-proof orchestrator that decides whether browser proof applies, classifies the proof package, and delegates capture to the hidden proof-runner subagent.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[312,315,316],{"name":313,"slug":314,"type":16},"Automation","automation",{"name":297,"slug":298,"type":16},{"name":317,"slug":318,"type":16},"Screenshots","screenshots","2026-08-01T05:44:47.369293",{"slug":321,"name":321,"fn":322,"description":323,"org":324,"tags":325,"stars":32,"repoUrl":33,"updatedAt":333},"ci-failure-triage","triage failed CI workflows","Investigate the latest default-branch CI failure in an environment-backed workspace and, when it is real and fixable, fix and open a PR in the same task.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[326,329,330],{"name":327,"slug":328,"type":16},"CI\u002FCD","ci-cd",{"name":30,"slug":31,"type":16},{"name":331,"slug":332,"type":16},"GitHub Actions","github-actions","2026-07-23T05:40:41.726992",{"slug":335,"name":335,"fn":336,"description":337,"org":338,"tags":339,"stars":32,"repoUrl":33,"updatedAt":345},"code-quality-auditor","audit code quality in merged pull requests","Automation skill: review recently merged pull requests for high-confidence code quality issues and submit `act` work items that auto-start follow-up execution tasks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[340,341,342],{"name":27,"slug":28,"type":16},{"name":283,"slug":284,"type":16},{"name":343,"slug":344,"type":16},"QA","qa","2026-07-26T05:47:47.339721",{"slug":4,"name":4,"fn":5,"description":6,"org":347,"tags":348,"stars":32,"repoUrl":33,"updatedAt":34},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[349,350,351,352,353,354],{"name":27,"slug":28,"type":16},{"name":21,"slug":22,"type":16},{"name":30,"slug":31,"type":16},{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},{"name":24,"slug":25,"type":16},{"slug":356,"name":356,"fn":357,"description":358,"org":359,"tags":360,"stars":32,"repoUrl":33,"updatedAt":364},"create-draft-pr","create draft pull requests","Draft pull-request creation workflow. Use when repositories have pending changes or unpushed commits and you want draft PRs created.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[361,362,363],{"name":313,"slug":314,"type":16},{"name":18,"slug":19,"type":16},{"name":287,"slug":288,"type":16},"2026-07-16T06:00:31.733527",{"slug":366,"name":366,"fn":367,"description":368,"org":369,"tags":370,"stars":32,"repoUrl":33,"updatedAt":373},"create-pr","create pull requests for pending changes","Pull-request creation workflow. Use when repositories have pending changes or unpushed commits and you want ready-for-review PRs created.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[371,372],{"name":18,"slug":19,"type":16},{"name":287,"slug":288,"type":16},"2026-07-16T06:03:03.397562",{"slug":375,"name":375,"fn":376,"description":377,"org":378,"tags":379,"stars":32,"repoUrl":33,"updatedAt":385},"debug-reported-bug","reproduce and debug reported bugs","Reproduce-first bug diagnosis workflow. Use when a reported bug needs to be reproduced, reduced to a deterministic failing check, and traced through git history or `git bisect` so the exact cause is understood before any fix is attempted.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[380,381,384],{"name":30,"slug":31,"type":16},{"name":382,"slug":383,"type":16},"Git","git",{"name":303,"slug":304,"type":16},"2026-07-16T06:03:07.255013",{"slug":387,"name":387,"fn":388,"description":389,"org":390,"tags":391,"stars":32,"repoUrl":33,"updatedAt":396},"dependabot-triage","triage GitHub Dependabot alerts","Review current open Dependabot alerts with GitHub data, keep scheduled runs read-only, and submit a small set of environment-backed `act` work items that auto-start dependency-update execution tasks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[392,393,394,395],{"name":313,"slug":314,"type":16},{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},{"name":24,"slug":25,"type":16},"2026-07-29T05:39:38.757423",{"slug":398,"name":398,"fn":399,"description":400,"org":401,"tags":402,"stars":32,"repoUrl":33,"updatedAt":409},"environment-setup","configure local development environments","Internal skill to configure environments. Never use unless the user explicitly initiates the skill. Focus on localhost-ready setup and validation.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[403,406],{"name":404,"slug":405,"type":16},"Configuration","configuration",{"name":407,"slug":408,"type":16},"Local Development","local-development","2026-08-01T05:44:46.333988",{"slug":411,"name":411,"fn":412,"description":413,"org":414,"tags":415,"stars":32,"repoUrl":33,"updatedAt":420},"explain-repo-code","explain repository code and architecture","Explanation-only repository workflow. Use when the user asks to understand behavior, architecture, or rationale from source context without modifying files.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[416,417],{"name":27,"slug":28,"type":16},{"name":418,"slug":419,"type":16},"Documentation","documentation","2026-07-16T06:00:34.090082",33,{"items":423,"total":421},[424,430,436,442,448,454,463],{"slug":277,"name":277,"fn":278,"description":279,"org":425,"tags":426,"stars":32,"repoUrl":33,"updatedAt":289},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[427,428,429],{"name":283,"slug":284,"type":16},{"name":18,"slug":19,"type":16},{"name":287,"slug":288,"type":16},{"slug":291,"name":291,"fn":292,"description":293,"org":431,"tags":432,"stars":32,"repoUrl":33,"updatedAt":305},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[433,434,435],{"name":297,"slug":298,"type":16},{"name":300,"slug":301,"type":16},{"name":303,"slug":304,"type":16},{"slug":307,"name":307,"fn":308,"description":309,"org":437,"tags":438,"stars":32,"repoUrl":33,"updatedAt":319},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[439,440,441],{"name":313,"slug":314,"type":16},{"name":297,"slug":298,"type":16},{"name":317,"slug":318,"type":16},{"slug":321,"name":321,"fn":322,"description":323,"org":443,"tags":444,"stars":32,"repoUrl":33,"updatedAt":333},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[445,446,447],{"name":327,"slug":328,"type":16},{"name":30,"slug":31,"type":16},{"name":331,"slug":332,"type":16},{"slug":335,"name":335,"fn":336,"description":337,"org":449,"tags":450,"stars":32,"repoUrl":33,"updatedAt":345},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[451,452,453],{"name":27,"slug":28,"type":16},{"name":283,"slug":284,"type":16},{"name":343,"slug":344,"type":16},{"slug":4,"name":4,"fn":5,"description":6,"org":455,"tags":456,"stars":32,"repoUrl":33,"updatedAt":34},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[457,458,459,460,461,462],{"name":27,"slug":28,"type":16},{"name":21,"slug":22,"type":16},{"name":30,"slug":31,"type":16},{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},{"name":24,"slug":25,"type":16},{"slug":356,"name":356,"fn":357,"description":358,"org":464,"tags":465,"stars":32,"repoUrl":33,"updatedAt":364},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[466,467,468],{"name":313,"slug":314,"type":16},{"name":18,"slug":19,"type":16},{"name":287,"slug":288,"type":16}]