Impediment Prioritization
GitHubOfficialCreated by ajennsDistributed by GitHub
- Skill
- Workflow
- Business and productivity
- MIT
- No issues found
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
This skill provides a structured, data-driven approach to prioritizing remediation items, risks, and gaps. By applying a standardized value-stream scoring model—evaluating ROI, implementation cost, ease of deployment, and risk—it transforms subjective lists into a ranked, actionable backlog. It is designed to be domain-agnostic, making it suitable for everything from security findings and audit results to retrospective action items and architecture gaps.
What it does
- Ingests lists of impediments and their corresponding countermeasures.
- Applies a fixed mathematical formula to calculate a priority score for each item.
- Scores items based on ROI, implementation cost, deployment ease, and risk factor.
- Generates a ranked table of prioritized actions.
- Provides a rationale for each score to ensure transparency in the decision-making process.
- Identifies the top three items to act on first based on the calculated priority.
When to use it
- When you need to rank or triage a backlog of remediation items, risks, or findings.
- When stakeholders ask for a data-backed recommendation on what to fix first.
- When performing retrospective analysis to determine which improvements to implement.
- When evaluating architecture review gaps or audit non-conformances.
- When you need to apply lean or value-stream prioritization principles to a list of problems.
Advantages
- Reduces subjectivity in decision-making through a standardized scoring rubric.
- Ensures consistent prioritization across different types of technical or operational debt.
- Provides clear, defensible rationales for why specific items are prioritized.
- Prevents divide-by-zero errors with a robust, fixed mathematical formula.
- Flexible enough to handle various inputs like GHQR findings, risk registers, or retro items.
Usage examples
- “Prioritize this list of retrospective action items: 1. Flaky test suite, 2. Missing runbook, 3. Manual release notes.”
- The agent will score each item based on the rubric, calculate the priority, and return a ranked table with a rationale for the top three items.
- “We have these security findings from our audit: [list]. Please rank them by priority.”
- The agent will map the findings to countermeasures, apply the scoring formula, and present a prioritized list of remediation actions.
Install
Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/github/impediment-prioritization/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip impediment-prioritization.zip -d .agents/skills
Documentation by ajenns
Impediment Prioritization Skill
A domain-agnostic skill for ranking impediments and their countermeasures. Works with any {impediment, countermeasure} list — GHQR findings, audit results, retro action items, risk registers, architecture review gaps, etc.
When to Activate
Activate when the user:
Asks to prioritize, rank, sequence, or triage impediments, gaps, risks, findings, or remediation items
Provides a list of impediments with proposed countermeasures (or asks you to propose countermeasures for a list of problems)
Asks "what should we fix first" on any improvement / remediation backlog
Mentions value-stream prioritization, A3 countermeasures, ROI-vs-effort, or lean impediment ranking
Inputs
Accepted input: a list of {impediment, countermeasure} pairs. Sources include (non-exhaustive):
| Source | Maps to Impediment | Maps to Countermeasure |
|---|---|---|
| GHQR / health-check findings | Finding or gap (Status ≠ Expected) | Recommendation / expected value |
| Audit results | Non-conformance | Remediation action |
| Retrospective | "What went wrong" item | Agreed improvement |
| Risk register | Risk | Mitigation |
| Architecture review | Gap vs. target state | Proposed change |
| User free-form list | Problem statement | Proposed fix |
Rules:
One countermeasure per impediment. If the input suggests multiple remediation paths, select the primary one and note alternatives in the rationale — do not emit multiple rows for the same impediment.
Collapse duplicates before scoring.
If a source link / citation is available, attach it to the countermeasure.
If a confidence level is available on the source, surface it as an optional
Confidencecolumn.
Scoring Rubric (1–10 scales)
Score each impediment's countermeasure against all four criteria. See references/scoring-rubric.md for anchoring examples at the 1 / 5 / 10 levels across multiple domains (platform engineering, security, SRE, application development, governance).
| Criterion | Scale | Definition |
|---|---|---|
| Return on Investment (ROI) | 1 = low, 10 = high | Efficiency gain delivered by the countermeasure to this step AND to the overall value stream. Not purely financial — weight throughput, cycle-time reduction, defect removal, user / developer experience, and compliance lift. |
| Cost to Implement | 1 = inexpensive, 10 = very expensive | Human capital (salary + time of people needed) plus any purchases, licenses, or infrastructure required to implement the countermeasure. |
| Ease of Deployment | 1 = extremely hard, 10 = very easy | Remediation effort required to actually deploy the countermeasure end-to-end. Reflects technical complexity, change-management burden, and rollback risk. |
| Risk Factor | 1 = low risk, 10 = very high risk | Risk weighted on impact to the overall value stream if the countermeasure goes wrong, stalls, or is deferred. |
Every score must be accompanied by a one-line rationale. When a score is an estimate rather than drawn from explicit data, mark the rationale with (estimated).
Formula
Priority = ((ROI * (10 / Cost)) + (Ease * (10 / Risk))) / 2Theoretical range: 1 → 100. Practical range on typical backlogs: ~1 → 100.
The scale minimum of
1guarantees Cost and Risk are never zero (no divide-by-zero).Higher Priority = do first.
Boundary checks:
ROI=10, Cost=1, Ease=10, Risk=1 →
((10*10)+(10*10))/2 = 100ROI=1, Cost=10, Ease=1, Risk=10 →
((1*1)+(1*1))/2 = 1
Use the formula verbatim. Do not reweight, normalize, or substitute.
Method (agent procedure)
Ingest the impediment list. Confirm 1:1 impediment-to-countermeasure mapping; collapse duplicates.
Confirm the countermeasure for each impediment. Prefer documented best practice for the domain. Cite a public / authoritative link when one is available.
Score all four criteria using the rubric. Write a one-line rationale per criterion.
Compute Priority using the formula. Round to one decimal place.
Sort rows by Priority descending. Assign Rank starting at 1.
Render the output table (see below).
Call out the top 3 impediments with a short "why act first" paragraph.
Optional tags: if the workflow requires ownership flags (e.g.,
[CSA Action Required]vs.[Customer Self-Service]for GHQR/PAK, or[Owner: Team X]/[Self-Service]for internal backlogs), include them on the top-ranked items. Skip if not requested.
Output Template
## Prioritized Impediments
**Scoring:** ROI (1 low → 10 high), Cost (1 cheap → 10 expensive), Ease (1 hard → 10 easy), Risk (1 low → 10 high).
**Formula:** `Priority = ((ROI * (10/Cost)) + (Ease * (10/Risk))) / 2`
| Rank | Impediment | Countermeasure | ROI | Cost | Ease | Risk | Priority | Rationale |
|------|------------|----------------|-----|------|------|------|----------|-----------|
| 1 | [gap] | [action + link] | [n] | [n] | [n] | [n] | [n.n] | ROI: …<br>Cost: …<br>Ease: …<br>Risk: … |
### Top 3 — Act First
1. **[Impediment]** — [why it wins on the formula + optional ownership tag]
2. …
3. …Worked example (GitHub Enterprise adoption):
| Rank | Impediment | Countermeasure | ROI | Cost | Ease | Risk | Priority | Rationale |
|---|---|---|---|---|---|---|---|---|
| 1 | 2FA not enforced at org level | Enforce org-wide 2FA (docs) | 9 | 2 | 8 | 2 | 42.5 | ROI: removes broad credential-compromise class<br>Cost: admin toggle + member comms<br>Ease: single org setting, members re-enroll<br>Risk: low — can stage with grace period |
| 2 | Secret scanning disabled | Enable secret scanning + push protection org-wide (docs) | 8 | 3 | 7 | 3 | 25.0 | ROI: catches leaked creds pre-merge<br>Cost: GHAS seats if not bundled (estimated)<br>Ease: org-level default<br>Risk: push-protection may block legitimate commits; stage per repo |
| 3 | No CODEOWNERS on critical repos | Add CODEOWNERS to top-20 repos (docs) | 6 | 4 | 6 | 4 | 15.0 | ROI: targeted review coverage<br>Cost: team time to define owners (estimated)<br>Ease: file-level change, but requires owner buy-in<br>Risk: review bottlenecks if owners undersized |
Worked example (generic retrospective action items):
| Rank | Impediment | Countermeasure | ROI | Cost | Ease | Risk | Priority |
|---|---|---|---|---|---|---|---|
| 1 | Flaky test suite blocks deploys daily | Quarantine top-10 flaky tests + add retry policy | 9 | 2 | 8 | 2 | 42.5 |
| 2 | No on-call runbook for payment service | Draft runbook from last 3 incidents | 7 | 3 | 8 | 2 | 31.7 |
| 3 | Manual release notes take 2h/release | Generate from Conventional Commits via CI | 6 | 4 | 5 | 3 | 15.8 |
Assumptions & Guardrails
Scores are estimates informed by the rubric and any available source / citation. Mark estimated rationales explicitly with
(estimated).Never fabricate context (team size, budget, tool inventory, organizational constraints). If required, ask the user or mark the score as estimated.
Final ranking is a recommendation — it should be reviewed with the accountable team / owner before it's committed to an execution plan.
Read-only by default — this skill does not execute remediations; it produces a ranked list consumed downstream.
Downstream Integration (optional)
The ranked table produced by this skill is the deliverable. Wire it into whatever downstream artifact your workflow needs (Jira epic, ADR, OKR backlog, incident review, health check report, etc.). This skill does not depend on any sibling skills or external templates.
Files
- ATTRIBUTION.mdAdded by AutoGineer923 B
- LICENSELicence file added by AutoGineer1.0 KiB
- SKILL.md8.9 KiB
- references/scoring-rubric.md5.8 KiB
references/scoring-rubric.md
Scoring Rubric — Anchoring Examples
Anchor examples for each criterion at scores 1, 5, and 10. Use these to calibrate estimates. Interpolate for intermediate scores.
All scales are 1–10. See the main SKILL.md for formal definitions and the prioritization formula.
Anchors are drawn from multiple domains — pick the row closest to your countermeasure's character and adjust. If your domain isn't represented, reason by analogy.
Return on Investment (ROI)
1 = low efficiency gain to the step and value stream. 10 = high efficiency gain.
| Score | Platform / DevEx | Security | SRE / Ops | App Dev / Governance |
|---|---|---|---|---|
| 1 | Cosmetic repo metadata cleanup (description, topics) on low-traffic repos. | Rotating a credential no service actually uses. | Renaming a dashboard widget. | Renaming variables to fix a lint warning nobody reads. |
| 5 | Adding CODEOWNERS to the top-20 most-active repos — targeted review coverage. | Enabling MFA for a single high-privilege admin group. | Adding SLO alerting to one tier-2 service. | Documenting API contracts for one service via OpenAPI. |
| 10 | Enforcing 2FA org-wide, enabling secret scanning + push protection, or shipping a CI pipeline to a team that previously merged untested. | Enforcing SSO + MFA enterprise-wide; removing standing admin rights. | Auto-remediating the top-2 pager-driving alert classes. | Replacing a failing manual approval gate with automated policy-as-code. |
Cost to Implement
1 = inexpensive (minutes of admin time). 10 = very expensive (multi-quarter program, new licenses, dedicated headcount).
| Score | Platform / DevEx | Security | SRE / Ops | App Dev / Governance |
|---|---|---|---|---|
| 1 | Flipping an org-level toggle — single admin, < 1 hour, no purchase. | Enabling a free advisory scanner in alert-only mode. | Adjusting an alert threshold. | Adding a CONTRIBUTING.md. |
| 5 | Rolling out org-wide rulesets across 50–200 repos — cross-team coordination, a week of engineering, no new SKU. | Implementing a secrets manager for one business unit. | Standing up centralized logging for a mid-size estate. | Refactoring a shared library used by ~10 services. |
| 10 | Enterprise-wide GHAS rollout on unlicensed repos — new seat purchase, procurement, security-team ownership, training funded for months. | Replacing identity provider; zero-trust program. | Multi-region active/active rearchitecture. | Re-platforming a monolith to services; multi-quarter, funded team. |
Ease of Deployment
1 = extremely hard to deploy. 10 = very easy to deploy.
| Score | Platform / DevEx | Security | SRE / Ops | App Dev / Governance |
|---|---|---|---|---|
| 1 | GHES → GHEC migration with custom SAML, self-hosted runners, LFS. Deep cut-over planning, downtime windows. | Enforcing SSO for the first time on a large enterprise without a grace period. | Live database engine swap with zero downtime. | Breaking API change across hundreds of downstream consumers. |
| 5 | Enabling Dependabot across all active repos — technically simple, operationally non-trivial (PR triage capacity, owner education). | Rolling out EDR agents to a mid-size fleet. | Adding distributed tracing to existing services — library upgrades + coordination. | Moving a shared config to a feature-flag service across ~20 services. |
| 10 | Adding a CODEOWNERS file or enabling auto-delete head branches on a single repo — one commit / one checkbox, immediate effect, trivial rollback. | Toggling secret scanning alerts on one repo. | Adjusting a retry policy in one service. | Adding a README section or a single lint rule. |
Risk Factor
1 = low risk to the value stream. 10 = very high risk.
| Score | Platform / DevEx | Security | SRE / Ops | App Dev / Governance |
|---|---|---|---|---|
| 1 | Enabling secret scanning in alerts-only mode. No developer-facing block; worst case is noisy alerts. | Adding a passive audit log export. | Adding a new dashboard; read-only. | Adding optional documentation. |
| 5 | Rolling out required status checks on default branches — can block releases if CI is flaky; recoverable by loosening rules or fixing CI. | Enforcing MFA on a subset of admins with a grace period. | Changing autoscaling thresholds — could over/under-provision temporarily. | Introducing a new required review policy. |
| 10 | Changing SAML SSO provider or enforcing SSO estate-wide without a grace period. Can lock users out and halt merges across the value stream. | Rotating all production secrets simultaneously without staged cutover. | Cut-over migration of the primary datastore with no parallel run. | Removing a widely-used public API version with no deprecation window. |
Calibration Tips
Cross-check: If ROI is 10 but Cost is also 10, the Priority formula still rewards it when Ease is high and Risk is low. That's intentional — high-leverage, high-investment work remains visible.
Don't anchor Cost on license price alone. Human-capital time (security triage, onboarding, change management, review burden) dominates most rollouts.
Risk ≠ Cost. A cheap change (toggle enforcement) can carry very high Risk if staged poorly.
Ease ≠ ROI. A one-click change with low ROI still ranks modestly; the formula only pushes it up if Risk is also very low.
Estimate explicitly. When you don't have data or user-confirmed context, score against the anchor and mark the rationale
(estimated).Domain mapping. If your item doesn't match any column, pick the closest analog (scale of blast radius, reversibility, and human-hours is what matters — not the technology).
Requirements and compatibility
Written for: GitHub Copilot
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Security
No issues found by our static scan· No issues found
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Created by
- ajenns
- Publisher
- GitHub (Official)
- Distributed by
- GitHub
- Source
- github/awesome-copilot · skills/impediment-prioritization · commit 797337f
- Licence
- MIT License (redistribution allowed)
- LICENSE (added by AutoGineer from LICENSE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
AutoGineer is not affiliated with or endorsed by ajenns or GitHub.
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download impediment-prioritization.zip