cuioss/ext-triage-js
marketplace/bundles/pm-dev-frontend/skills/ext-triage-js/SKILL.md
Triage extension for JavaScript findings during plan-finalize phase
$ install --global
skillsauthnpx skillsauth add cuioss/plan-marshall ext-triage-jsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 28, 2026, 2:12 AM88.2s4 files scanned
SKILL.md
- name:
- ext-triage-js
- description:
- Triage extension for JavaScript findings during plan-finalize phase
- user-invocable:
- false
- mode:
- knowledge
- implements:
- plan-marshall:extension-api/standards/ext-point-triage
JavaScript Triage Extension
Provides decision-making knowledge for triaging JavaScript findings during the finalize phase.
Purpose
This skill is a triage extension loaded by the plan-finalize workflow skill when processing JavaScript-related findings. It provides domain-specific knowledge for deciding whether to fix, suppress, or accept findings.
Key Principle: This skill provides knowledge, not workflow control. The finalize skill owns the process.
When This Skill is Loaded
Loaded via resolve-workflow-skill-extension --domain javascript --type triage during finalize phase when:
- ESLint reports rule violations
- Jest test failures occur
- Prettier formatting issues are detected
- Stylelint reports CSS issues
- PR review comment disposition is required (FIX, REPLY-AND-RESOLVE, or ESCALATE on bot review threads)
- The JavaScript arch-gate (dependency-cruiser) emits
arch-constraintfindings for structural-boundary violations
Standards
| Document | Purpose | |----------|---------| | suppression.md | JavaScript suppression syntax (eslint-disable) | | severity.md | JavaScript-specific severity guidelines and decision criteria | | pr-comment-disposition.md | PR review comment disposition (FIX / REPLY-AND-RESOLVE / ESCALATE) for JavaScript and CSS |
Quick Reference
Suppression Methods
| Finding Type | Syntax |
|--------------|--------|
| ESLint rule | // eslint-disable-next-line rule-name |
| ESLint block | /* eslint-disable rule-name */ |
| Prettier | Not suppressible (fix or configure) |
| Stylelint | /* stylelint-disable rule-name */ |
Decision Guidelines
| Severity | Default Action | |----------|----------------| | error | Fix (blocks build/CI) | | warn | Fix or suppress with justification | | off | N/A (disabled rule) |
Acceptable to Accept
- Generated code in
**/generated/**,**/dist/** - Legacy JavaScript files with tracked plan to address
- Test mocks requiring flexibility
arch-constraint Findings (dependency-cruiser arch-gate)
The JavaScript arch-gate runs dependency-cruiser's module-graph rules as a dedicated invocation and emits one arch-constraint-typed finding per structural-boundary violation (a module-boundary rule, a forbidden-dependency rule, an orphan/circular-dependency rule), carrying the violated rule's identity in the finding's rule field. These findings route here for the per-finding disposition exactly as lint-issue / sonar-issue findings do:
| Disposition | When |
|-------------|------|
| Fix | The violation is a genuine structural-boundary breach — correct the import, break the cycle, or remove the forbidden cross-module dependency. This is the default for an arch-constraint finding. |
| Suppress | The rule does not apply to this specific case and the exception is documented — narrow the dependency-cruiser rule (e.g. a scoped pathNot/comment) with justification. |
| Accept | The rule itself is wrong or a known false positive — the finding is acknowledged without code change; recurring acceptances signal the rule needs revision. |
A violation of the same rule that recurs across runs reinforces a single arch-constraint lesson (rule-identity dedup; retire-on-quiet / reinforce-on-recurrence), surfaced to planning through the architecture-hints pipe. The structural model and the full findings → triage → lesson loop are owned by the central standard — see arch-gate-fitness-functions.md and the JavaScript binding in pm-dev-frontend:arch-gate-js.
Related Documents
pm-dev-frontend:javascript- Core JavaScript patterns
Related Skills
cuioss/parse-rewrite-log
development
VerifiedTrustedCommunity
Domain-owned OpenRewrite log-line finding parser for the java-cui domain — parses the
5SKILL.mdUpdated Jul 28, 2026
cuioss/search-markers
development
VerifiedTrustedCommunity
Domain-owned OpenRewrite marker detection for the java-cui domain — scans Java/Kotlin sources for cui-rewrite TODO markers, categorizes them by recipe, and fails the gate on any detected marker
5SKILL.mdUpdated Jul 23, 2026
cuioss/manage-build-server
development
VerifiedTrustedCommunity
Operator control surface for the marshalld build server — enrol/drop a project in the machine-global registry (the opt-in enable signal and anti-laundering wall), manage the daemon lifecycle (start, stop, drain, status, install, upgrade) version-pinned to the verified bundle copy, and inspect the daemon's per-project interaction-audit log (read-only)
5SKILL.mdUpdated Jul 19, 2026
cuioss/build-server-client
tools
VerifiedTrustedCommunity
The tiny build-consumption client for the marshalld build server — submit a build job, bounded long-poll for its result, ping the daemon identity, and preflight registry-plus-liveness in one call; consumption only, never provisioning or enrolment
5SKILL.mdUpdated Jul 19, 2026