Best for
- After /review-change reports REVIEW-FAIL with fix-now rows, or /audit-pr reports VERDICT: BLOCKED (every blocker is fix-now). If the ledger is absent or incomplete, reconstruct rows from the verdict in Step 0. Never pro…
gtrabanco/agentic-workflow/skills/fold-findings/SKILL.md
Repair persisted fix-now findings in compatible atomic batches: root-cause fixes, green gate, commit/push, and per-row `folded: yes` updates. Never reclassify or substitute backlog notes. Triggers: "fold-findings", "fix the review findings", "repair audit blockers".
Decision brief
Repair persisted fix-now findings. review-change and audit-pr classify; this skill fixes each root cause, never relabeling, deferring, or weakening its check.
Compatibility matrix
| Platform | Status | Evidence | What to check |
|---|---|---|---|
| Codex | Not declared | No explicit evidence | Portability before use |
| Claude Code | Declared | Source record | Install path and trigger |
| Cursor | Not declared | No explicit evidence | Portability before use |
| Gemini CLI | Not declared | No explicit evidence | Portability before use |
Installation
The source command is displayed only when detected. A safe inspection prompt is always available so your agent can explain every action before execution.
npx skills add https://github.com/gtrabanco/agentic-workflow --skill "skills/fold-findings"Inspect the Agent Skill "fold-findings" from https://github.com/gtrabanco/agentic-workflow/blob/e84db167d6b608e991d68e98bc31f1f91f42cf85/skills/fold-findings/SKILL.md at commit e84db167d6b608e991d68e98bc31f1f91f42cf85. List every install step, command, network request, credential, file read/write, external action, and rollback step. Explain whether it fits my task. Do not install or execute anything until I approve.
Workflow
Per Workflow conventions, read:
Any unchecked box means the turn is not done.
After /review-change reports REVIEW-FAIL with fix-now rows, or /audit-pr reports VERDICT: BLOCKED (every blocker is fix-now). If the ledger is absent or incomplete, reconstruct rows from the verdict in Step 0. Never process postpone/wontfix/promote/documented-tradeoff rows; thos…
The allowlist is exactly these two paths; read both, in order, before changing code or the ledger:
Per finding, in processing order:
Permission review
No configured static risk pattern was detected
This is not proof of safety. Runtime behavior, indirect dependencies, and hidden external systems are outside the static scan.
Evidence record
| Signal | Value | Evidence type | Meaning |
|---|---|---|---|
| Quality score | 95/100 | Computed | Documentation, specificity, maintenance, and trust rules |
| Repository stars | 19 | Source | Repository attention, not individual Skill quality |
| Compatibility | 1 platforms | Source | Declared in the catalog source record |
| Usage guide | automated source guide | Editorial | Generated or reviewed according to the visible evidence level |
Pinned source
Repair persisted fix-now findings. review-change and audit-pr classify; this
skill fixes each root cause, never relabeling, deferring, or weakening its check.
✓ 1. Every finding taken up this turn produced its fixed per-finding output
line (FOLDED <sha> | DISPUTED <reason> | BLOCKED <missing input> |
REPLAN <proposed phase(s)>) — no finding silently skipped.
✓ 2. For each FOLDED batch: the gate was RUN (not assumed) and green, one
atomic commit was RUN with its sha pasted, and (if the branch has an open PR)
`git push` was RUN immediately after that commit.
✓ 3. The ledger row for each FOLDED finding was flipped `folded: no → yes`
in the same commit — never a bare code fix with the ledger left stale.
✓ 4. No finding was reclassified: no severity downgrade, no fix-now →
non-fix-now, no "actually this is fine" — a genuine objection produced
`DISPUTED` with evidence for a user decision, never a silent drop/issue.
✓ 5. The closing `Folded: n/m · Disputed: k · Blocked: j[ · Replan: r]` tally
and outcome-branched `→ Next:` block are printed as the ABSOLUTE last output.
Every affected finding ID is named in that block, joined with ` + `.
Any unchecked box means the turn is not done.
After /review-change reports REVIEW-FAIL with fix-now rows, or /audit-pr
reports VERDICT: BLOCKED (every blocker is fix-now). If the ledger is absent or
incomplete, reconstruct rows from the verdict in Step 0. Never process
postpone/wontfix/promote/documented-tradeoff rows; those belong to /triage-issue.
Per Workflow conventions, read:
The unit's review-findings.md under docs/features/<NN>-<slug>/ or
docs/fix/<n>-<topic>/; schema is owned by review-change/audit-pr:
| id | file:line | axis | severity | class | route | folded |
After VERDICT: BLOCKED, append missing rows (class: fix-now, folded: no,
next free Fn, dedupe file:line+axis), commit as
docs(<unit>): reconstruct fold ledger from audit-pr blockers, then fold;
never report “no findings”.
Queue folded: no rows; explicit IDs restrict it and leave other rows
untouched. Group by root cause, verifier and rollback boundary.
The project's verification gate and forge CLI (use the declared forge).
Whether the branch has an open PR; this decides immediate push after commit.
The allowlist is exactly these two paths; read both, in order, before changing code or the ledger:
Both are normative and one hop from this file. Missing resource → stop; never infer a classification or fold procedure.
Per finding, in processing order:
| <finding-id> | verdict: FOLDED <sha> | DISPUTED <reason → user decision> | BLOCKED <missing input> | REPLAN <proposed phase(s) → /execute-phase> |
Then exactly:
Folded: n/m · Disputed: k · Blocked: j · Replan: r
Omit · Replan: r when r = 0 (preserves the existing three-field format).
Scope is the ledger (or explicit ID subset); unlisted discoveries are proposals for user triage. Batch only when one root-cause correction, validator set and rollback boundary own the rows: one commit/push, individual ticks/lines. Split otherwise. Do not widen beyond a finding's file/line/axis unless its root cause requires it; explain that in the commit. Artifact language follows user instruction > project docs language > English; conversation language never decides.
Use explicit fallbacks when a primitive is absent: open named SKILL.md files in
a fresh context; use the strongest model for subtle logic/security and never
weaker than the author; process the compatible queue once and re-run only after
new review evidence.
review-change ──FAIL──┐
audit-pr ──BLOCKED─────┼──▶ fold-findings ──FOLDED──▶ re-run review-change / audit-pr
│ ──DISPUTED─▶ user decision
│ ──BLOCKED──▶ user supplies missing input
review-change/audit-pr classify and persist; this skill only flips
folded: no to yes after a real fix. execute-phase's embedded fold checklist
is the inline fallback; this standalone path keeps frozen classification and its
forbidden list and never runs above its tier. DISPUTED stops for user evidence;
no issue is created.
Every queued finding has its per-finding verdict and tally; every FOLDED
finding belongs to a pushed atomic batch and ticked row. Nothing is reclassified
or touched outside the queue.
→ Next: (branches on outcome; list every affected finding ID once as `F1 + F2 + …`)
· all FOLDED (<F1> + <F2> + …) → /review-change — re-review the branch now that all listed findings are fixed
· any DISPUTED (<F1> + <F2> + …) → user decision — resolve every evidenced dispute without creating backlog
· any BLOCKED (<F1> + <F2> + …) → supply the listed missing inputs, then re-run /fold-findings
· any REPLAN (<F1> + <F2> + …) → confirm all proposed SPEC phases, then /execute-phase on this same branch
Replace placeholders with every actual affected finding ID before printing; never
print <F2>, …, or a single representative ID in a live hand-off.
Frequently asked questions
Repair persisted fix-now findings. review-change and audit-pr classify; this skill fixes each root cause, never relabeling, deferring, or weakening its check.
The source record exposes this install command: npx skills add https://github.com/gtrabanco/agentic-workflow --skill "skills/fold-findings". Inspect the command and pinned source before running it.
The pinned source record declares support for: claude code.
Alternatives
narrative-io/narrative-skills-marketplace
Translate a fuzzy analytical question into a rigorous investigation plan. Interrogates the ask, grounds the plan in the available data dictionary, applies analytical best practices, and produces a structured brief of query specifications for a downstream query-writing skill. Plans, does not write SQL. Use when: "why did X drop", "is there a relationship between A and B", "who are our highest-value customers", "what's driving the change in Y", "investigate this trend", "design an analysis for", "
brucesongs/kali-claw
Insecure Design (OWASP A06:2025) focuses on security flaws in system architecture and design phases, rather than code implementation-level bugs.
vasilyu1983/AI-Agents-public
Scans public GitHub repos for agent skills, dev practices, and code patterns. Use when enriching skills, setting team policy, or researching a build domain.
brucesongs/kali-claw
Binary reverse engineering covers the complete chain from static analysis, dynamic debugging, to vulnerability discovery, exploit development, and malware analysis.