Inbox Triage

Today is ${today}. Read memory/MEMORY.md before starting.

Why this skill exists

Hand-tracked follow-ups live in MEMORY.md. vuln-tracker tracks the operator's vuln PRs by scanning branch names and ages the memory/pending-disclosures/ queue. Neither reads from the actual GitHub notification inbox. When a maintainer replies to a vuln PR, or a security advisory opens on a watched repo, it sits unread until someone manually checks GitHub. This skill reads the inbox and routes what needs action.

vuln-tracker covers PR and disclosure lifecycle by branch and draft state. This skill covers the notification layer, inbound responses, review requests, security alerts, mentions.

Steps

1. Fetch GitHub notifications

Run:

gh api /notifications --paginate 2>&1

Parse the JSON array. If the command errors or returns an empty array [], log INBOX_TRIAGE_SKIP: no notifications and stop.

Limit to the first 100 notifications if --paginate returns more (GitHub caps at 50 per page; two pages is enough).

For each notification record:

• id
• reason, why you're being notified (mention, review_requested, author, state_change, security_alert, assign, etc.)
• subject.title
• subject.type, PullRequest, Issue, Release, etc.
• subject.url, API URL for the subject
• repository.full_name
• updated_at, ISO timestamp

2. Filter

Keep notifications where unread: true AND updated_at is within the last 14 days. Discard older or read ones.

If zero remain after filtering: log INBOX_TRIAGE_SKIP: no actionable notifications within 14 days and stop.

3. Categorize

Assign each notification to exactly one category (first match wins):