cuioss/ext-triage-java
marketplace/bundles/pm-dev-java/skills/ext-triage-java/SKILL.md
Triage extension for Java findings during plan-finalize phase
$ install --global
skillsauthnpx skillsauth add cuioss/plan-marshall ext-triage-javaInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 26, 2026, 3:32 AM69.9s4 files scanned
SKILL.md
- name:
- ext-triage-java
- description:
- Triage extension for Java findings during plan-finalize phase
- user-invocable:
- false
- implements:
- plan-marshall:extension-api/standards/ext-point-triage
Java Triage Extension
Provides decision-making knowledge for triaging Java-related findings during the finalize phase.
Purpose
This skill is a triage extension loaded by the plan-finalize workflow skill when processing Java-related findings. It provides domain-specific knowledge for deciding whether to fix, suppress, or accept findings.
Key Principle: This skill provides knowledge, not workflow control. The finalize skill owns the process.
When This Skill is Loaded
Loaded via resolve-workflow-skill-extension --domain java --type triage during finalize phase when:
- Build/test verification produces findings
- Sonar analysis reports issues
- PR review comments reference Java code
- Lint/format checks fail
- PR review comment disposition is required (FIX, REPLY-AND-RESOLVE, or ESCALATE on bot review threads)
Standards
| Document | Purpose | |----------|---------| | suppression.md | Java suppression syntax (@SuppressWarnings, NOSONAR) | | severity.md | Java-specific severity guidelines and decision criteria | | pr-comment-disposition.md | PR review comment disposition (FIX / REPLY-AND-RESOLVE / ESCALATE) for Java |
Extension Registration
Registered in marshal.json under the java domain:
"java": {
"workflow_skill_extensions": {
"triage": "pm-dev-java:ext-triage-java"
}
}
Quick Reference
Suppression Methods
| Finding Type | Syntax |
|--------------|--------|
| Sonar rule | @SuppressWarnings("java:S1234") |
| Deprecation | @SuppressWarnings("deprecation") |
| Unchecked cast | @SuppressWarnings("unchecked") |
| Null warning | @SuppressWarnings("null") or JSpecify annotations |
| All warnings | // NOSONAR (line comment, use sparingly) |
Decision Guidelines
| Severity | Default Action | |----------|----------------| | BLOCKER | Fix (mandatory) | | CRITICAL | Fix (mandatory for vulnerabilities) | | MAJOR | Fix or suppress with justification | | MINOR | Fix, suppress, or accept | | INFO | Accept (low priority) |
Acceptable to Accept
- Generated code in
**/generated/** - Test data builders with intentionally permissive patterns
- Legacy code with documented migration plan
- Framework-mandated patterns (e.g., Serializable)
- Documented false positives
Related Documents
pm-dev-java:java-core- Core Java patterns
Related Skills
cuioss/test-skill
testing
VerifiedTrustedCommunity
A test skill for README generation
5SKILL.mdUpdated May 29, 2026
cuioss/test-skill
testing
VerifiedTrustedCommunity
A test skill with existing references
5SKILL.mdUpdated May 29, 2026
cuioss/skill-no-refs
tools
VerifiedTrustedCommunity
Skill without references directory
5SKILL.mdUpdated May 29, 2026
cuioss/table-references-test
development
VerifiedTrustedCommunity
Test skill with table-format references
5SKILL.mdUpdated May 29, 2026