github-triage
A Claude Code plugin for systematic GitHub issue and PR triage, with a security-gated PR review workflow.
Components
Skill: github-triage
Full triage workflow across 7 phases:
- Phase 1–5: Discover patterns, propose label taxonomy, create labels, tag issues/PRs, summarize
- Phase 6: Validate open issues against the codebase (oldest-first), close resolved ones with evidence
- Phase 7: Security-gated PR review — security analysis → parallel code review + local tests → merge + author credit
Agent: github-triage:pr-security-review
Read-only security analysis agent (tools: Read, Grep, Glob, WebFetch — no execution, no writes).
Analyzes PR diffs before any local code checkout for:
- Malware and backdoors
- Supply chain attacks and typosquatting
- Credential theft and data exfiltration
- CI/CD and build script poisoning
- Test weaponization
Returns: ✅ SAFE / ⚠️ REVIEW NEEDED / 🚫 BLOCK
Installation
claude plugin marketplace add /path/to/github-triage --name github-triage-dev
claude plugin install github-triage@github-triage-dev
Usage
Use the github-triage skill for full triage sessions, or invoke github-triage:pr-security-review directly via the Task tool before checking out PR code.