triage

name	triage
description	Guide agent supply-chain triage after Claude Code MCP, plugin, skill, hook, command, or settings changes.
argument-hint	[what changed]
allowed-tools	["Bash","Read"]

OpenACA Triage

Use this skill when the user has added or changed MCP servers, plugins, skills, hooks, commands, .claude/settings.json, or other agent runtime configuration and wants a security-oriented review.

Triage Flow

1. Identify the changed scope: endpoint config, project config, repo files, or a stored Agent BOM.
2. If the user only needs to see what changed, generate a fresh BOM and, when a previous BOM exists and the installed CLI supports it, compare the snapshots:

uvx --isolated --from openaca openaca bom endpoint --project . --output openaca-agent-bom.json
uvx --isolated --from openaca openaca bom diff --before openaca-agent-bom.previous.json --after openaca-agent-bom.json

3. Run the narrowest useful scan when the user wants advisory or posture evidence. Include posture findings — triage is exactly where configuration-hygiene issues (mutable install refs, insecure transport, missing remote auth) are most useful:

uvx --isolated --from openaca openaca scan endpoint -v --project . --include-posture

4. If the user only wants inventory and has no previous BOM, generate a BOM instead:

uvx --isolated --from openaca openaca bom endpoint --project . --output openaca-agent-bom.json

5. Summarize new or relevant components: plugins, MCP servers, skills, hooks, commands, and direct components.
6. Separate evidence classes: advisory matches, posture findings, and composition inventory.
7. Recommend next steps only where evidence supports them.

If uvx is unavailable but openaca is installed, use the same command without the uvx prefix.

Safety

Ask before making changes. Do not disable components, edit settings, or remove files without explicit user approval.