cuioss/ext-triage-reqs
marketplace/bundles/pm-requirements/skills/ext-triage-reqs/SKILL.md
Triage extension for requirements findings during plan-finalize phase
$ install --global
skillsauthnpx skillsauth add cuioss/plan-marshall ext-triage-reqsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 28, 2026, 2:16 AM163.2s4 files scanned
SKILL.md
- name:
- ext-triage-reqs
- description:
- Triage extension for requirements findings during plan-finalize phase
- user-invocable:
- false
- mode:
- knowledge
- implements:
- plan-marshall:extension-api/standards/ext-point-triage
Requirements Triage Extension
Provides decision-making knowledge for triaging requirements-related findings during the finalize phase.
Purpose
This skill is a triage extension loaded by the plan-finalize workflow skill when processing requirements documentation findings. It provides domain-specific knowledge for deciding whether to fix, suppress, or accept findings.
Key Principle: This skill provides knowledge, not workflow control. The finalize skill owns the process.
When This Skill is Loaded
Loaded via resolve-workflow-skill-extension --domain requirements --type triage during finalize phase when:
- Document validation errors occur in requirements documents (for AsciiDoc-specific validation, see
pm-documents:ref-asciidoc) - Requirements structure issues are detected
- Traceability gaps are identified
- Acceptance criteria format issues are found
- PR review comment disposition is required (FIX, REPLY-AND-RESOLVE, or ESCALATE on bot review threads)
Standards
| Document | Purpose | |----------|---------| | suppression.md | AsciiDoc comment syntax for suppression | | severity.md | Requirements-specific severity guidelines | | pr-comment-disposition.md | PR review comment disposition (FIX / REPLY-AND-RESOLVE / ESCALATE) for requirements |
Extension Registration
Registered in marshal.json under the requirements domain:
"requirements": {
"workflow_skill_extensions": {
"triage": "pm-requirements:ext-triage-reqs"
}
}
Quick Reference
Suppression Methods
| Finding Type | Syntax |
|--------------|--------|
| Document lint | Inline comment suppression (see pm-documents:ref-asciidoc for format-specific syntax) |
| Link validation | // skip-link-check comment |
| Structure issue | Document exception in requirements metadata |
Decision Guidelines
| Severity | Default Action | |----------|----------------| | Structure error | Fix (requirements must be well-formed) | | Missing traceability | Fix or document exception | | Format inconsistency | Fix for consistency | | Style warning | Accept or fix |
Acceptable to Accept
- Draft requirements pending review
- Placeholder acceptance criteria in early stages
- Legacy requirements pending migration
- External reference format differences
Related Documents
pm-requirements:requirements-authoring- Requirements authoring standards
Related Skills
cuioss/parse-rewrite-log
development
VerifiedTrustedCommunity
Domain-owned OpenRewrite log-line finding parser for the java-cui domain — parses the
5SKILL.mdUpdated Jul 28, 2026
cuioss/search-markers
development
VerifiedTrustedCommunity
Domain-owned OpenRewrite marker detection for the java-cui domain — scans Java/Kotlin sources for cui-rewrite TODO markers, categorizes them by recipe, and fails the gate on any detected marker
5SKILL.mdUpdated Jul 23, 2026
cuioss/manage-build-server
development
VerifiedTrustedCommunity
Operator control surface for the marshalld build server — enrol/drop a project in the machine-global registry (the opt-in enable signal and anti-laundering wall), manage the daemon lifecycle (start, stop, drain, status, install, upgrade) version-pinned to the verified bundle copy, and inspect the daemon's per-project interaction-audit log (read-only)
5SKILL.mdUpdated Jul 19, 2026
cuioss/build-server-client
tools
VerifiedTrustedCommunity
The tiny build-consumption client for the marshalld build server — submit a build job, bounded long-poll for its result, ping the daemon identity, and preflight registry-plus-liveness in one call; consumption only, never provisioning or enrolment
5SKILL.mdUpdated Jul 19, 2026