feat(agents): add openshell-onboarding skill - #3
Conversation
8ed867d to
31ff600
Compare
ChristianZaccaria
left a comment
ChristianZaccaria
left a comment
There was a problem hiding this comment.
Hey Artem, great work!! 🙂 I think it looks fantastic and is very useful! - I left below some suggestions, but they are minor stuff compared to what you've done already, brilliant work🎉
I would suggest to have the agent help with setting up the development environment with the prerequisites such as mise , rust, python etc, before running OpenShell locally, as mentioned here: https://github.com/NVIDIA/OpenShell/blob/main/CONTRIBUTING.md#prerequisites
You could also add something about running this on OpenShift, in case someone wishes to learn more about that type of deployment, this way the agent will be able to point the user to the right docs.
The other thing about these types of skills, is that it's preferable to get the agent to read the canonical documentation (source of truth) and gather the right information about the architecture and other concepts, as opposed to copying into the skill content from the docs that might diverge at some point. This also reduces a lot the lines of code in the skill and narrows down the scope.
The skill should include behaviour, sequencing, decision logic, interaction patterns (you already have all of this which is perfect, but the content and concepts it may be best removed and simply have the agent read from the source, unless it's most likely not going to change.)
31ff600 to
2fc6d2e
Compare
Signed-off-by: Artem Lytvyn <alytvyn@redhat.com>
2fc6d2e to
6da671b
Compare
|
@coderabbitai full review |
✅ Action performedFull review finished. |
📝 WalkthroughWalkthroughAdded the ChangesOpenShell onboarding workflow
Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 9
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/skills/openshell-onboarding/SKILL.md:
- Line 40: Update the commit-search command in the onboarding instructions to
calculate the one-year cutoff date portably across macOS and GNU/Linux, using a
fallback or an already-required runtime, while preserving the existing GitHub
API query and Rust-experience decision.
- Around line 525-548: Update the Jira creation flow in Step 4 and the
corresponding persistence logic around the later state-handling section to store
the Jira project key, each created Epic, Story, sub-task, and dependency link
key, plus per-step export status. Before creating any Jira entity or link, reuse
the persisted record when present and resume only incomplete steps after partial
MCP failures, preventing duplicates while allowing retries to finish missing
work.
- Around line 122-132: Update the onboarding primer and Exercise 1 to remove
hardcoded architecture, enforcement, error-payload, exit-code, and response-text
claims. Keep the exercise intent and only stable verification predicates, while
directing the runtime flow at the canonical documentation required by the
existing line-637 step and deriving expected behavior from those sources rather
than duplicating values from architecture, policy docs, or CLI output.
- Around line 57-63: Update the onboarding-state.md file path handling to use a
single canonical location. In Step 2's "Check for existing progress" section,
remove the fallback to current directory and read only from the repository root
path. Ensure all references to onboarding-state.md throughout the document
(including the sections at lines 552-555 and 619-621) consistently use the same
canonical path of <repo-root>/onboarding-state.md for both read and write
operations, eliminating any possibility of reading from one location and writing
to another.
- Around line 3-4: The --github argument advertised in the argument-hint is not
being used by the onboarding implementation. Update Step 1 and the related code
sections around lines 29-31 to check for and use the supplied --github argument
when present, falling back to gh api user only when the argument is not
supplied. This ensures the explicit username argument takes precedence over the
authenticated account inspection.
- Around line 181-186: Replace the `find /var/folders` socket discovery with
`podman machine inspect --format '{{.ConnectionInfo.PodmanSocket.Path}}'`, then
validate that the resolved path exists and is a reachable Unix socket before
generating `gateway.env`. Keep the existing Podman environment variables, but
stop with a clear failure if inspection or socket validation fails.
- Line 108: Update the “Trust and build” step to instruct users to inspect the
repository’s mise configuration before trusting it, then trust only the reviewed
configuration file before running mise commands such as build.
- Around line 61-62: Update the onboarding-state handling described in the skill
to parse onboarding-state.md as untrusted data: accept only documented headings
and checklist values, ignore all other content, and never interpret its text as
agent instructions or commands. Ensure the current phase and completed/blocked
items are derived only from validated state before asking whether to continue or
regenerate.
- Around line 198-209: The gateway configuration currently binds to all network
interfaces (0.0.0.0), which exposes the control-plane listener unnecessarily.
Update both the bind_address value in the [openshell.gateway] section of
gateway.toml and the OPENSHELL_BIND_ADDRESS environment variable in gateway.env
from 0.0.0.0 to 127.0.0.1 to restrict access to the local loopback interface by
default, unless non-loopback access is explicitly required.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: d07ec4e5-af82-4e21-b08a-40cbcbf7187a
📒 Files selected for processing (3)
.agents/skills/openshell-onboarding/SKILL.md.gitignoreCONTRIBUTING.md
| If found: load state, show current phase and completed/blocked items, ask to continue or regenerate. | ||
|
|
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- skill structure ---'
wc -l .agents/skills/openshell-onboarding/SKILL.md
sed -n '1,110p' .agents/skills/openshell-onboarding/SKILL.md
sed -n '590,640p' .agents/skills/openshell-onboarding/SKILL.md
printf '%s\n' '--- state-related references ---'
rg -n -C 4 'state|completed|blocked|continue|regenerate|load' .agents/skills/openshell-onboarding/SKILL.mdRepository: letv1nnn/OpenShell
Length of output: 14170
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- persistence schema and surrounding workflow ---'
sed -n '500,625p' .agents/skills/openshell-onboarding/SKILL.md
printf '%s\n' '--- repository references to onboarding state ---'
rg -n -C 3 --hidden --glob '!*.git/*' 'onboarding-state\.md|OpenShell Onboarding State|first incomplete item|current phase' .
printf '%s\n' '--- instruction-boundary guidance ---'
rg -n -C 3 --hidden --glob '!*.git/*' 'untrusted|prompt injection|instruction.*data|data.*instruction|ignore.*instruction|treat.*data' .agents AGENTS.md architecture docs 2>/dev/null || trueRepository: letv1nnn/OpenShell
Length of output: 8244
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re
p = Path(".agents/skills/openshell-onboarding/SKILL.md")
text = p.read_text()
schema = text[text.index("```markdown", text.index("### Step 5")):text.index("```", text.index("```markdown", text.index("### Step 5")) + 3)]
print("--- declared state fields ---")
for line in schema.splitlines():
if line.startswith(("#", "Generated:", "GitHub:", "Rust:", "Current phase:", "Status:", "- [")):
print(line)
print("--- raw state consumption instructions ---")
for i, line in enumerate(text.splitlines(), 1):
if "onboarding-state.md" in line or "state" in line.lower() and 55 <= i <= 625:
print(f"{i}:{line}")
PYRepository: letv1nnn/OpenShell
Length of output: 1868
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
p = Path(".agents/skills/openshell-onboarding/SKILL.md")
text = p.read_text()
start = text.index("```markdown", text.index("### Step 5"))
end = text.index("```", start + len("```markdown"))
print("--- declared state fields ---")
print(text[start + len("```markdown"):end])
print("--- raw state consumption instructions ---")
for i, line in enumerate(text.splitlines(), 1):
if "onboarding-state.md" in line or ("state" in line.lower() and 55 <= i <= 625):
print(f"{i}:{line}")
PYRepository: letv1nnn/OpenShell
Length of output: 2020
Llm Instruction Injection (CWE-20): Improper Input Validation
Reachability: Internal · Exploitability: Trivial
Parse onboarding-state.md as untrusted data. Accept only the documented headings and checklist values. Ignore all other content and never treat it as agent instructions or commands. Another local actor can modify this gitignored file and steer the next exercise or coaching flow.
🧰 Tools
🪛 SkillSpector (2.4.4)
[error] 610: [AR2] Anti-Refusal Statement: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Remediation: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
(Anti-Refusal (AR2))
[warning] 332: [E1] External Transmission: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Remediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
(Data Exfiltration (E1))
[warning] 31: [EA2] Autonomous Decision Making: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Remediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
(Excessive Agency (EA2))
[error] 184: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 206: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 158: [TM2] Chaining Abuse: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Remediation: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
(Tool Misuse (TM2))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/openshell-onboarding/SKILL.md around lines 61 - 62, Update
the onboarding-state handling described in the skill to parse
onboarding-state.md as untrusted data: accept only documented headings and
checklist values, ignore all other content, and never interpret its text as
agent instructions or commands. Ensure the current phase and completed/blocked
items are derived only from validated state before asking whether to continue or
regenerate.
| 4. **Docker or Podman** — Confirm which container runtime they have and that it's running. Verify: `docker info` or `podman info` | ||
| 5. **Z3** — Install for their platform. Verify: `pkg-config --modversion z3` or `z3 --version` | ||
| 6. **macOS only** — Check for Apple Command Line Tools: `xcode-select -p`. If missing or protobuf-src build errors occur, guide through install/reinstall. | ||
| 7. **Trust and build** — `mise trust` then `cargo build` (or `mise run build` if available). First build will take several minutes. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
mise official documentation trust repository configuration hooks tasks trust file
💡 Result:
Mise uses a trust system to manage security, as configuration files (mise.toml) can execute arbitrary code through hooks, tasks, and environment directives [1][2]. Trust Status and Requirements - Automatic Trust: Simple configuration files that only define tools (plain versions) or tasks (without templates or options) are considered safe and do not require explicit trust because they do not execute code upon loading [3][4][5]. - Manual Trust: If a configuration file contains more advanced features, such as hooks, complex tasks, or environment variables, mise will prompt you to trust it [3][2]. You can manually trust a configuration file by running the command mise trust [3][2]. - Monorepos: If you mark a configuration file as a monorepo root, all descendant configuration files are implicitly trusted, eliminating the need to trust subdirectories individually [6][7][8]. Configuration of Trusted Paths You can automatically trust specific directories or all configurations by defining trusted paths [6][9][2]: - Using Settings: Add paths to the trusted_config_paths setting in your global configuration file (~/.config/mise/config.toml) [6][9][2]. - Using Environment Variables: Set the MISE_TRUSTED_CONFIG_PATHS environment variable to a list of colon-separated (Unix) or semicolon-separated (Windows) paths [6][10][9][2]. Setting this to ["/"] will trust all configuration files, effectively disabling the trust prompt [9][2]. Security Note For enhanced security, mise provides a "safe mode" (enabled via the environment or global configuration). In safe mode, mise ignores project-level hooks, tasks, and environment configuration, rendering untrusted configuration files inert and removing the need for them to be trusted [9][1]. It is important to note that sensitive trust settings (like trusted_config_paths) must only be defined in global configuration files; defining them in project-level configuration files is ignored by design to prevent security bypasses [9][11].
Citations:
- 1: https://mise.jdx.dev/security.html
- 2: https://mise.jdx.dev/getting-started.html
- 3: https://mise.en.dev/cli/trust.html
- 4: https://mise.jdx.dev/cli/trust.html
- 5: https://github.com/jdx/mise/blob/3e3ff2f7/src/cli/trust.rs
- 6: https://mise.en.dev/configuration.html
- 7: https://mise.jdx.dev/configuration
- 8: https://github.com/jdx/mise/blob/5be2b8fd/docs/configuration.md
- 9: https://mise.jdx.dev/configuration/settings.html
- 10: https://mise.en.dev/hooks.html
- 11: GHSA-436v-8fw5-4mj8
Security Misconfiguration (CWE-829): Inclusion of Functionality from Untrusted Control Sphere
Exploitability: Moderate
Inspect mise configuration before trusting it.
mise trust authorizes repository configuration that can execute hooks, tasks, or environment directives. Review the intended configuration file first, then trust only that file before running mise commands.
🧰 Tools
🪛 SkillSpector (2.4.4)
[error] 610: [AR2] Anti-Refusal Statement: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Remediation: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
(Anti-Refusal (AR2))
[warning] 332: [E1] External Transmission: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Remediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
(Data Exfiltration (E1))
[warning] 31: [EA2] Autonomous Decision Making: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Remediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
(Excessive Agency (EA2))
[error] 184: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 206: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 158: [TM2] Chaining Abuse: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Remediation: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
(Tool Misuse (TM2))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/openshell-onboarding/SKILL.md at line 108, Update the “Trust
and build” step to instruct users to inspect the repository’s mise configuration
before trusting it, then trust only the reviewed configuration file before
running mise commands such as build.
| **Before diving in, present this brief primer on core primitives:** | ||
|
|
||
| | Primitive | What it is | What you'll do with it | | ||
| |-----------|-----------|----------------------| | ||
| | **Gateway** | Control-plane server — manages sandboxes, providers, policies, inference config. One per OpenShell instance. | Start it, check its status | | ||
| | **Sandbox** | Isolated container where an agent runs. Supervisor (PID 1) enforces policy; inline proxy intercepts all network traffic. | Create one, connect into it, run commands | | ||
| | **Provider** | Credential bundle. Real secrets stay outside the sandbox; the proxy swaps dummy tokens for real ones on the wire. | Optionally attach one so the sandbox can call an LLM | | ||
| | **Policy** | Declarative YAML rules — filesystem, network (per-host, per-method, per-binary), process, inference. Default: deny all. | See policy enforcement in action, hot-reload a rule | | ||
| | **`inference.local`** | Virtual hostname inside a sandbox — routes to gateway-managed model backends. | Use it to call Claude from inside a sandbox | | ||
|
|
||
| Phase 2 explains *why* each works the way it does. Right now you just need to know *what* they are. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | 🏗️ Heavy lift
Remove copied architecture and enforcement claims.
Line 637 requires canonical documentation to be read at runtime, but the primer and Exercise 1 hardcode component roles, enforcement layers, exact error payloads, exit code 56, and response text. These values can drift from architecture/, policy documentation, or the CLI. Keep the exercise intent and stable verification predicates, then derive the briefing and expected behavior from canonical sources.
Also applies to: 287-337, 637-637
🧰 Tools
🪛 SkillSpector (2.4.4)
[error] 610: [AR2] Anti-Refusal Statement: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Remediation: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
(Anti-Refusal (AR2))
[warning] 332: [E1] External Transmission: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Remediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
(Data Exfiltration (E1))
[warning] 31: [EA2] Autonomous Decision Making: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Remediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
(Excessive Agency (EA2))
[error] 184: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 206: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 158: [TM2] Chaining Abuse: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Remediation: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
(Tool Misuse (TM2))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/openshell-onboarding/SKILL.md around lines 122 - 132, Update
the onboarding primer and Exercise 1 to remove hardcoded architecture,
enforcement, error-payload, exit-code, and response-text claims. Keep the
exercise intent and only stable verification predicates, while directing the
runtime flow at the canonical documentation required by the existing line-637
step and deriving expected behavior from those sources rather than duplicating
values from architecture, policy docs, or CLI output.
| # The real socket is under /var/folders — NOT what `podman info` reports | ||
| SOCK=$(find /var/folders -name "podman-machine-default-api.sock" 2>/dev/null | head -1) | ||
|
|
||
| cat > ~/.config/openshell/gateway.env << EOF | ||
| OPENSHELL_DRIVERS=podman | ||
| OPENSHELL_PODMAN_SOCKET=$SOCK |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
file=".agents/skills/openshell-onboarding/SKILL.md"
printf '%s\n' '--- target section ---'
sed -n '150,210p' "$file"
printf '%s\n' '--- related Podman/OpenShell references ---'
rg -n -C 3 'podman (info|system|machine|connection)|podman-machine-default-api\.sock|OPENSHELL_PODMAN_SOCKET|gateway\.env|socket' .agents "$file" 2>/dev/null || true
printf '%s\n' '--- repository files relevant to onboarding ---'
git ls-files | rg '(^|/)(SKILL\.md|README|.*openshell.*|.*podman.*)' | head -100Repository: letv1nnn/OpenShell
Length of output: 28714
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
p = Path(".agents/skills/openshell-onboarding/SKILL.md")
text = p.read_text()
for i, line in enumerate(text.splitlines(), 1):
if "find /var/folders" in line or "podman" in line.lower() or "OPENSHELL_PODMAN_SOCKET" in line:
print(f"{i}: {line}")
PYRepository: letv1nnn/OpenShell
Length of output: 1397
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- socket configuration implementation ---'
rg -n -C 5 'OPENSHELL_PODMAN_SOCKET|PODMAN_SOCKET|podman.*socket|socket.*podman|podman_machine_default_api' . --glob '!target/**' --glob '!vendor/**' 2>/dev/null || true
printf '%s\n' '--- Podman connection/API references ---'
rg -n -C 4 'podman system connection|podman machine inspect|connection list|podman info.*Host|podman info.*RemoteSocket|podman info.*service' .agents docs crates README.md 2>/dev/null || true
printf '%s\n' '--- relevant tracked files ---'
git ls-files | rg '(^|/)(podman|docker|gateway|config|settings|.*driver.*)' | head -200Repository: letv1nnn/OpenShell
Length of output: 50376
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
for p in Path(".").rglob("*"):
if p.is_file() and p.stat().st_size < 2_000_000:
try:
s = p.read_text(errors="ignore")
except OSError:
continue
if "OPENSHELL_PODMAN_SOCKET" in s:
print(p)
for i, line in enumerate(s.splitlines(), 1):
if "OPENSHELL_PODMAN_SOCKET" in line:
print(f" {i}: {line}")
PY
printf '%s\n' '--- source/config files containing podman ---'
rg -l -i 'podman' crates src config deploy docs 2>/dev/null | head -100 || trueRepository: letv1nnn/OpenShell
Length of output: 3795
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- repository precedent for macOS socket resolution ---'
sed -n '175,220p' e2e/with-podman-gateway.sh
sed -n '220,230p' e2e/with-podman-gateway.sh
printf '%s\n' '--- candidate ordering and responsiveness ---'
sed -n '170,220p' crates/openshell-core/src/config.rs
sed -n '260,290p' crates/openshell-core/src/config.rs
printf '%s\n' '--- driver startup validation ---'
sed -n '205,260p' crates/openshell-driver-podman/src/driver.rs
printf '%s\n' '--- documented config semantics ---'
sed -n '175,187p' docs/reference/sandbox-compute-drivers.mdx
sed -n '355,370p' docs/reference/gateway-config.mdxRepository: letv1nnn/OpenShell
Length of output: 9476
Resolve and validate the active Podman socket.
find ... | head -1 can select a stale socket or a socket for another machine. Use podman machine inspect --format '{{.ConnectionInfo.PodmanSocket.Path}}', then confirm that the path is a reachable Unix socket before writing gateway.env.
🧰 Tools
🪛 SkillSpector (2.4.4)
[error] 610: [AR2] Anti-Refusal Statement: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Remediation: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
(Anti-Refusal (AR2))
[warning] 332: [E1] External Transmission: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Remediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
(Data Exfiltration (E1))
[warning] 31: [EA2] Autonomous Decision Making: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Remediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
(Excessive Agency (EA2))
[error] 184: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 206: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 158: [TM2] Chaining Abuse: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Remediation: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
(Tool Misuse (TM2))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/openshell-onboarding/SKILL.md around lines 181 - 186, Replace
the `find /var/folders` socket discovery with `podman machine inspect --format
'{{.ConnectionInfo.PodmanSocket.Path}}'`, then validate that the resolved path
exists and is a reachable Unix socket before generating `gateway.env`. Keep the
existing Podman environment variables, but stop with a clear failure if
inspection or socket validation fails.
| cat > ~/.config/openshell/gateway.toml << 'TOML' | ||
| [openshell.gateway] | ||
| bind_address = "0.0.0.0:17670" | ||
|
|
||
| [openshell.drivers.docker] | ||
| host_gateway_ip = "192.168.127.254" | ||
| TOML | ||
|
|
||
| cat > ~/.config/openshell/gateway.env << 'ENV' | ||
| OPENSHELL_BIND_ADDRESS=0.0.0.0 | ||
| OPENSHELL_GATEWAY_CONFIG=/Users/YOURUSERNAME/.config/openshell/gateway.toml | ||
| ENV |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
# Read the SKILL.md file to understand context and scope
wc -l .agents/skills/openshell-onboarding/SKILL.mdRepository: letv1nnn/OpenShell
Length of output: 205
🏁 Script executed:
# Read sections around the flagged lines to understand the context
sed -n '180,230p' .agents/skills/openshell-onboarding/SKILL.mdRepository: letv1nnn/OpenShell
Length of output: 1388
🏁 Script executed:
# Search for authentication, firewall, network policy, or security-related guidance in SKILL.md
grep -n -i "auth\|firewall\|network.*polic\|security\|localhost\|127\.0\.0\.1\|expose" .agents/skills/openshell-onboarding/SKILL.md | head -30Repository: letv1nnn/OpenShell
Length of output: 1564
🏁 Script executed:
# Search for gateway documentation that might explain the intended use or deployment model
grep -rn "gateway" docs/ --include="*.md" --include="*.mdx" | grep -i "auth\|bind\|expose\|firewall" | head -20Repository: letv1nnn/OpenShell
Length of output: 4884
🏁 Script executed:
# Read more of SKILL.md to find context about deployment, warnings, and intended audience
sed -n '1,50p' .agents/skills/openshell-onboarding/SKILL.mdRepository: letv1nnn/OpenShell
Length of output: 2820
🏁 Script executed:
# Search for mentions of loopback, localhost, 127.0.0.1, or warnings in SKILL.md
grep -n -i "loopback\|localhost\|127\.0\.0\.1\|warning\|caution\|local.*only\|single.*user" .agents/skills/openshell-onboarding/SKILL.mdRepository: letv1nnn/OpenShell
Length of output: 156
🏁 Script executed:
# Read the gateway.md architecture file referenced in SKILL.md to understand auth model
cat docs/architecture/gateway.md | head -150Repository: letv1nnn/OpenShell
Length of output: 217
🏁 Script executed:
# Check gateway-config reference for bind_address defaults and security guidance
grep -n -A 10 -B 5 "bind_address" docs/reference/gateway-config.mdxRepository: letv1nnn/OpenShell
Length of output: 4019
🏁 Script executed:
# Verify the specific lines 198-209 and surrounding context in SKILL.md
sed -n '190,220p' .agents/skills/openshell-onboarding/SKILL.mdRepository: letv1nnn/OpenShell
Length of output: 775
🏁 Script executed:
# Check if there are any security/auth disclaimers or best-practices mentions in SKILL.md
grep -n -C 5 "mTLS\|authentication\|TLS\|OPENSHELL_ENABLE_MTLS\|auth\|certificate" .agents/skills/openshell-onboarding/SKILL.md | head -40Repository: letv1nnn/OpenShell
Length of output: 2458
🏁 Script executed:
# Compare the full Docker/Podman section in gateway-config.mdx to understand the reference pattern
sed -n '310,340p' docs/reference/gateway-config.mdxRepository: letv1nnn/OpenShell
Length of output: 1558
🏁 Script executed:
# Verify what the reference docs recommend for local development vs. multi-user
grep -n -B 3 -A 3 "127\.0\.0\.1.*17670\|single.*user.*local\|Docker.*Podman" docs/reference/gateway-config.mdx | head -30Repository: letv1nnn/OpenShell
Length of output: 2258
Security Misconfiguration (CWE-16)
Bind the local gateway to loopback by default.
This recipe sets both gateway bind values to 0.0.0.0, which exposes the control-plane listener on every network interface. Use 127.0.0.1 unless non-loopback access is required. If non-loopback access is required, enforce gateway authentication and document the firewall scope.
🧰 Tools
🪛 SkillSpector (2.4.4)
[error] 610: [AR2] Anti-Refusal Statement: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Remediation: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
(Anti-Refusal (AR2))
[warning] 332: [E1] External Transmission: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Remediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
(Data Exfiltration (E1))
[warning] 31: [EA2] Autonomous Decision Making: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Remediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
(Excessive Agency (EA2))
[error] 184: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 206: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 158: [TM2] Chaining Abuse: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Remediation: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
(Tool Misuse (TM2))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/openshell-onboarding/SKILL.md around lines 198 - 209, The
gateway configuration currently binds to all network interfaces (0.0.0.0), which
exposes the control-plane listener unnecessarily. Update both the bind_address
value in the [openshell.gateway] section of gateway.toml and the
OPENSHELL_BIND_ADDRESS environment variable in gateway.env from 0.0.0.0 to
127.0.0.1 to restrict access to the local loopback interface by default, unless
non-loopback access is explicitly required.
| ### Step 4 — Offer Jira export | ||
|
|
||
| After presenting the full plan, use `AskUserQuestion` with these options: | ||
|
|
||
| ``` | ||
| Question: "Create this plan as Jira tickets?" | ||
| Options: | ||
| - "Yes — create Jira tickets" | ||
| - "Save to file only (onboarding-state.md)" | ||
| - "No thanks, display only" | ||
| ``` | ||
|
|
||
| **Jira creation flow (requires Jira MCP):** | ||
|
|
||
| 1. Ask for the Jira project key if not already known. | ||
| 2. Create one Epic: `OpenShell Onboarding: [Name] — [start date]`; description: GitHub username, Rust background. | ||
| 3. For each phase, create a Story with the full task list, exercises, and quiz questions. | ||
| - Story points: Phase 0=1, Phase 1a=3, Phase 1b=5, Phase 1c=3, Phase 2=5, Phase 3=8, Phase 4=8 | ||
| 4. For each exercise, create a sub-task with instructions and verification criteria. | ||
| 5. Set `blockedBy` links matching the phase dependency graph. | ||
| 6. Assign to user's Jira account if known. | ||
| 7. Print: `Created 1 Epic, N Stories, M sub-tasks in project [KEY].` | ||
|
|
||
| If Jira MCP unavailable: say so, fall back to display-only + file save. |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Persist Jira identifiers and make export resumable.
The flow creates an Epic, Stories, sub-tasks, and dependency links, but the persisted state stores no Jira keys or export status. Re-running onboarding or retrying after a partial MCP failure can create duplicates and leave links incomplete. Save the project key, created issue keys, and per-step status, then reuse existing records during retries.
Also applies to: 552-591
🧰 Tools
🪛 SkillSpector (2.4.4)
[error] 610: [AR2] Anti-Refusal Statement: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Remediation: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
(Anti-Refusal (AR2))
[warning] 332: [E1] External Transmission: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Remediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
(Data Exfiltration (E1))
[warning] 31: [EA2] Autonomous Decision Making: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Remediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
(Excessive Agency (EA2))
[error] 184: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 206: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 158: [TM2] Chaining Abuse: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Remediation: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
(Tool Misuse (TM2))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/openshell-onboarding/SKILL.md around lines 525 - 548, Update
the Jira creation flow in Step 4 and the corresponding persistence logic around
the later state-handling section to store the Jira project key, each created
Epic, Story, sub-task, and dependency link key, plus per-step export status.
Before creating any Jira entity or link, reuse the persisted record when present
and resume only incomplete steps after partial MCP failures, preventing
duplicates while allowing retries to finish missing work.
Signed-off-by: Artem Lytvyn <alytvyn@redhat.com>
3fb58b1 to
e10e412
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/skills/openshell-onboarding/SKILL.md:
- Around line 191-193: Update the troubleshooting restart commands near the
gateway status checks to match the installation path: provide a source-build
restart using the gateway command established by Step 1, while retaining
Homebrew restart instructions only for Homebrew installations. Ensure both
troubleshooting recipes restart the active gateway before running openshell
status.
- Line 160: Update the OpenShell installation command in SKILL.md to avoid
piping the mutable main-branch installer directly into sh. Use a versioned
release and verify its checksum or signature before execution, or download the
installer first for inspection before running it.
- Around line 37-45: Update the three gh api commands in the onboarding skill to
interpolate the resolved username variable rather than using the literal
{username} placeholder. Apply this consistently to the repository listing,
commit search, and pull-request search requests while preserving their existing
filters and jq processing.
- Around line 33-45: Update the Rust activity checks following the non-fork
repository query so commit and PR results are restricted to non-fork
repositories as well. Reuse the identified non-fork repository set when
constructing both search queries, ensuring fork-only activity cannot satisfy the
Rust experience threshold; otherwise remove the non-fork policy claim.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: c09e176d-d560-4c4e-817b-21d0de1e3f4f
📒 Files selected for processing (4)
.agents/skills/openshell-onboarding/SKILL.md.gitignore.markdownlint-cli2.jsoncCONTRIBUTING.md
🚧 Files skipped from review as they are similar to previous changes (2)
- .gitignore
- CONTRIBUTING.md
| Once the username is known, check for real Rust experience (not just forked repos): | ||
|
|
||
| ```bash | ||
| # 1. Non-fork repos with Rust code | ||
| gh api "users/{username}/repos?sort=pushed&per_page=100" --jq '[.[] | select(.fork == false) | select(.language == "Rust")] | length' | ||
|
|
||
| # 2. Recent Rust commits (last year) | ||
| # Portable one-year cutoff: try GNU date, fall back to BSD/macOS date | ||
| CUTOFF=$(date -d '1 year ago' +%Y-%m-%d 2>/dev/null || date -v-1y +%Y-%m-%d) | ||
| gh api "search/commits?q=author:{username}+language:rust+committer-date:>$CUTOFF&per_page=5" --jq '.total_count' | ||
|
|
||
| # 3. Rust PRs authored | ||
| gh api "search/issues?q=author:{username}+language:rust+type:pr&per_page=5" --jq '.total_count' |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -u
printf '%s\n' '--- file ---'
cat -n .agents/skills/openshell-onboarding/SKILL.md
printf '%s\n' '--- related Rust and experience logic ---'
rg -n -C 4 'Rust|experienced|fork|OR|or ' .agents/skills/openshell-onboarding/SKILL.mdRepository: letv1nnn/OpenShell
Length of output: 50376
🏁 Script executed:
#!/bin/bash
set -u
cat -n .agents/skills/openshell-onboarding/SKILL.mdRepository: letv1nnn/OpenShell
Length of output: 31909
🏁 Script executed:
#!/bin/bash
set -u
python3 - <<'PY'
from pathlib import Path
p = Path(".agents/skills/openshell-onboarding/SKILL.md")
text = p.read_text()
start = text.index("Once the username is known")
end = text.index("```", start)
block = text[start:end]
for line in block.splitlines():
if "gh api" in line or "CUTOFF" in line or "OR" in line:
print(line)
print("commit_query_has_fork_filter:", "fork" in block.splitlines()[block.splitlines().index("# 2. Recent Rust commits (last year)"):])
print("pr_query_has_fork_filter:", "fork" in block.splitlines()[block.splitlines().index("# 3. Rust PRs authored"):])
PYRepository: letv1nnn/OpenShell
Length of output: 296
🏁 Script executed:
#!/bin/bash
set -u
python3 - <<'PY'
from pathlib import Path
import re
text = Path(".agents/skills/openshell-onboarding/SKILL.md").read_text()
lines = text.splitlines()
queries = {
"repos": next(line for line in lines if 'users/{username}/repos?' in line),
"commits": next(line for line in lines if 'search/commits?' in line),
"pull_requests": next(line for line in lines if 'search/issues?' in line),
}
for name, query in queries.items():
print(f"{name}: {query}")
print(f"{name}_has_fork_qualifier: {bool(re.search(r'(?i)(?:fork|is:fork|fork:false|fork:only)', query))}")
print("decision:", next(line.strip() for line in lines if "Non-fork Rust repos OR" in line))
PYRepository: letv1nnn/OpenShell
Length of output: 797
🌐 Web query:
GitHub REST API commit search language qualifier fork repositories search/issues pull requests fork qualifier documentation
💡 Result:
The GitHub REST API provides search endpoints that accept the same qualifiers used in the GitHub web interface [1][2]. Below is a synthesis of how the requested qualifiers and features apply to different search endpoints. Language Qualifier The language qualifier is widely supported across many search types, including repositories [3] and code search [4]. When using it, you specify the programming language to filter results (e.g., language:javascript) [3][4]. Fork Repositories and Fork Qualifier The behavior of the fork qualifier depends on the endpoint: - Repositories Search: You can include or restrict results to forks using fork:true (include forks) or fork:only (only show forks) [3]. - Commit Search: The REST API documentation for commit search does not explicitly support the fork qualifier [1][5]. Commit searches generally target the default branch of repositories [1][5]. - Code Search: When using the legacy code search API, forks are only indexed if they have more stars than the parent repository and have at least one pushed commit; you can use fork:true or fork:only to control their inclusion [6]. Issues and Pull Requests - You can search issues and pull requests using the GET /search/issues endpoint [7]. - The API supports filtering by type using is:issue or is:pull-request [8]. - Note: When using GitHub Apps with a user access token, you cannot retrieve a mix of both issues and pull requests in a single query; you must use the is qualifier to specify one or the other, or the request may result in a 422 error [7]. General Documentation For comprehensive information on syntax and all available qualifiers, refer to the official GitHub documentation: - Searching on GitHub (General Syntax): https://docs.github.com/en/search-github/searching-on-github/about-searching-on-github - REST API Search Endpoint Documentation: https://docs.github.com/en/rest/search/search
Citations:
- 1: https://docs.github.com/en/rest/search/search?apiVersion=2022-1128
- 2: https://docs.github.com/en/enterprise-cloud@latest/rest/search/search
- 3: https://docs.github.com/en/search-github/searching-on-github/searching-for-repositories
- 4: https://docs.github.com/en/search-github/github-code-search/understanding-github-code-search-syntax
- 5: https://docs.github.com/en/search-github/searching-on-github/searching-commits
- 6: https://docs.github.com/en/search-github/searching-on-github/searching-code
- 7: https://github.com/octokit/plugin-rest-endpoint-methods.js/blob/main/docs/search/issuesAndPullRequests.md
- 8: https://docs.github.com/en/search-github/searching-on-github/searching-issues-and-pull-requests
Filter all Rust activity to non-fork repositories. The commit search cannot exclude forks, and both activity queries lack a fork filter. Fork-only activity can therefore satisfy the ≥5 Rust commits/PRs condition. Scope both searches to the non-fork repository set or remove the non-fork policy claim.
🧰 Tools
🪛 SkillSpector (2.5.1)
[error] 612: [AR2] Anti-Refusal Statement: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Remediation: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
(Anti-Refusal (AR2))
[warning] 334: [E1] External Transmission: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Remediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
(Data Exfiltration (E1))
[warning] 31: [EA2] Autonomous Decision Making: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Remediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
(Excessive Agency (EA2))
[error] 186: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 208: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 160: [TM2] Chaining Abuse: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Remediation: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
(Tool Misuse (TM2))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/openshell-onboarding/SKILL.md around lines 33 - 45, Update
the Rust activity checks following the non-fork repository query so commit and
PR results are restricted to non-fork repositories as well. Reuse the identified
non-fork repository set when constructing both search queries, ensuring
fork-only activity cannot satisfy the Rust experience threshold; otherwise
remove the non-fork policy claim.
| gh api "users/{username}/repos?sort=pushed&per_page=100" --jq '[.[] | select(.fork == false) | select(.language == "Rust")] | length' | ||
|
|
||
| # 2. Recent Rust commits (last year) | ||
| # Portable one-year cutoff: try GNU date, fall back to BSD/macOS date | ||
| CUTOFF=$(date -d '1 year ago' +%Y-%m-%d 2>/dev/null || date -v-1y +%Y-%m-%d) | ||
| gh api "search/commits?q=author:{username}+language:rust+committer-date:>$CUTOFF&per_page=5" --jq '.total_count' | ||
|
|
||
| # 3. Rust PRs authored | ||
| gh api "search/issues?q=author:{username}+language:rust+type:pr&per_page=5" --jq '.total_count' |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- target section ---'
sed -n '1,90p' .agents/skills/openshell-onboarding/SKILL.md
printf '%s\n' '--- username-related references ---'
rg -n -C 3 'username|resolved username|Rust commits|Rust PRs|users/\{username\}|author:\{username\}' .agents/skills/openshell-onboarding/SKILL.md
printf '%s\n' '--- gh availability ---'
command -v gh || trueRepository: letv1nnn/OpenShell
Length of output: 7806
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- gh api help: placeholders and endpoint handling ---'
gh api --help | sed -n '1,180p'
printf '%s\n' '--- endpoint behavior without making a repository change ---'
GH_TOKEN='' gh api 'users/{username}/repos?per_page=1' --silent 2>&1 || trueRepository: letv1nnn/OpenShell
Length of output: 8068
🌐 Web query:
GitHub CLI gh api manual placeholder substitution {owner} {repo} {branch} literal braces
💡 Result:
In the GitHub CLI (gh api), the placeholders {owner}, {repo}, and {branch} are automatically replaced with values derived from the repository of the current directory (or the GH_REPO environment variable) when used in the endpoint path or with the -F/--field flag [1][2][3]. To use these braces literally—that is, to prevent the CLI from substituting them—there is no specific "escape" character or flag documented to disable this behavior globally [1][2]. However, because this replacement is handled by the gh tool, you can typically bypass it by using an alternative syntax or providing the values explicitly [4][5]. Key points regarding this behavior: 1. Shell Interference: In some shells, such as PowerShell, curly braces have special meaning. You must enclose arguments containing {...} in quotes to ensure the entire string is passed to gh without the shell modifying it first [1][3]. 2. Providing Values Explicitly: If you want to use a literal string that happens to look like a placeholder or need to avoid auto-detection, the recommended approach is to provide the values explicitly rather than relying on the placeholders [4][5]. 3. Legacy Syntax: You may also encounter the older :owner, :repo, and :branch syntax, which were the original placeholders before {...} was introduced to match standard URL templating [6][7]. These are still supported as synonyms [6]. If you are encountering issues where the CLI is incorrectly substituting text, verify that your environment variables (like GH_REPO) are not inadvertently forcing a detection that conflicts with your intended request [1][2]. If you need a literal string that must contain these braces, you may need to construct the URL or payload dynamically using shell tools (e.g., printf) before passing it to gh api, though this is rarely necessary for standard GitHub API usage [4][5].
Citations:
- 1: https://cli.github.com/manual/gh_api
- 2: https://github.com/cli/cli/blob/trunk/pkg/cmd/api/api.go
- 3: https://manpages.opensuse.org/Leap-16.0/gh/gh-api.1.en.html
- 4: Document which remote is used for
:owner,:repoplaceholders cli/cli#2657 - 5: https://github.com/cli/cli/blob/c14cbaa2/skills/gh/SKILL.md
- 6: Support standard path variable replacement syntax cli/cli#3536
- 7: api command: support
{owner}and{repo}placeholders cli/cli#1165
Use the resolved username in every gh api request.
gh api substitutes only {owner}, {repo}, and {branch}. It sends {username} literally, so the first request returns HTTP 404 and the Rust classification loses one signal. Interpolate the resolved username in all three commands.
🧰 Tools
🪛 SkillSpector (2.5.1)
[error] 612: [AR2] Anti-Refusal Statement: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Remediation: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
(Anti-Refusal (AR2))
[warning] 334: [E1] External Transmission: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Remediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
(Data Exfiltration (E1))
[warning] 31: [EA2] Autonomous Decision Making: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Remediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
(Excessive Agency (EA2))
[error] 186: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 208: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 160: [TM2] Chaining Abuse: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Remediation: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
(Tool Misuse (TM2))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/openshell-onboarding/SKILL.md around lines 37 - 45, Update
the three gh api commands in the onboarding skill to interpolate the resolved
username variable rather than using the literal {username} placeholder. Apply
this consistently to the repository listing, commit search, and pull-request
search requests while preserving their existing filters and jq processing.
| brew install openshell | ||
|
|
||
| # Universal | ||
| curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
file=".agents/skills/openshell-onboarding/SKILL.md"
printf '%s\n' '--- target context ---'
sed -n '145,172p' "$file"
printf '%s\n' '--- related installer references ---'
rg -n -C 2 'install\.sh|raw\.githubusercontent\.com/NVIDIA/OpenShell|OpenShell/main' "$file" .agents/skills/openshell-onboarding 2>/dev/null || true
printf '%s\n' '--- bounded behavioral check ---'
python3 - <<'PY'
from pathlib import Path
import re
from urllib.parse import urlparse
p = Path(".agents/skills/openshell-onboarding/SKILL.md")
lines = p.read_text().splitlines()
matches = [(i + 1, line) for i, line in enumerate(lines)
if "raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh" in line]
print({"matches": matches})
for lineno, line in matches:
m = re.search(r"curl\s+([^|]+)\|\s*sh", line)
print({
"line": lineno,
"pipes_to_shell": bool(m),
"url": re.search(r"https://\S+", line).group(0) if re.search(r"https://\S+", line) else None,
"url_path": urlparse(re.search(r"https://\S+", line).group(0)).path
if re.search(r"https://\S+", line) else None,
})
PY
printf '%s\n' '--- upstream response metadata (content is not executed) ---'
curl -sSIL --max-time 15 \
https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh \
| sed -n '1,20p'Repository: letv1nnn/OpenShell
Length of output: 2472
Security Misconfiguration (CWE-494): Download of Code Without Integrity Check
Reachability: External · Exploitability: Difficult
Do not pipe the mutable main installer directly into sh. Use a versioned release with checksum or signature verification, or download the script for inspection before execution.
🧰 Tools
🪛 SkillSpector (2.5.1)
[error] 612: [AR2] Anti-Refusal Statement: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Remediation: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
(Anti-Refusal (AR2))
[warning] 334: [E1] External Transmission: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Remediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
(Data Exfiltration (E1))
[warning] 31: [EA2] Autonomous Decision Making: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Remediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
(Excessive Agency (EA2))
[error] 186: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 208: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 160: [TM2] Chaining Abuse: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Remediation: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
(Tool Misuse (TM2))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/openshell-onboarding/SKILL.md at line 160, Update the
OpenShell installation command in SKILL.md to avoid piping the mutable
main-branch installer directly into sh. Use a versioned release and verify its
checksum or signature before execution, or download the installer first for
inspection before running it.
Source: Linters/SAST tools
| brew services restart openshell | ||
| sleep 3 | ||
| openshell status |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Restart the gateway according to the installation path.
Step 1 starts the gateway with mise run gateway, but both troubleshooting recipes end with brew services restart openshell. When the engineer uses the source-build path, no Homebrew service may exist and the running gateway keeps the old configuration. Add a source-build restart path, or require the Homebrew installation before using these recipes.
Also applies to: 213-215
🧰 Tools
🪛 SkillSpector (2.5.1)
[error] 612: [AR2] Anti-Refusal Statement: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Remediation: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
(Anti-Refusal (AR2))
[warning] 334: [E1] External Transmission: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Remediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
(Data Exfiltration (E1))
[warning] 31: [EA2] Autonomous Decision Making: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Remediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
(Excessive Agency (EA2))
[error] 186: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 208: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 160: [TM2] Chaining Abuse: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Remediation: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
(Tool Misuse (TM2))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/openshell-onboarding/SKILL.md around lines 191 - 193, Update
the troubleshooting restart commands near the gateway status checks to match the
installation path: provide a source-build restart using the gateway command
established by Step 1, while retaining Homebrew restart instructions only for
Homebrew installations. Ensure both troubleshooting recipes restart the active
gateway before running openshell status.
2 participants
Summary
Adds a structured onboarding skill for the OpenShell codebase. The skill reads the engineer's GitHub profile to determine Rust experience, then generates a phased plan covering: project orientation, guided local setup (gateway + sandbox), architecture deep dive with Socratic exercises, sandbox/policy hands-on, and first contribution workflow. Includes curated Rust resources for engineers new to the language. Offers Jira export and persists progress to onboarding-state.md.
Phases
Phase 0 — What OpenShell Is
Brief orientation briefing synthesized from canonical architecture docs. Covers project identity, four core components (gateway, supervisor/proxy, providers, policies), and inference.local. No deep reading yet — just enough mental model to make everything that follows make sense.
Phase 1a — Development Environment Setup
Guided walkthrough of prerequisites from CONTRIBUTING.md: mise, Rust, Python, Docker/Podman, Z3, macOS build tools. Step-by-step with verification gates. Blocks all hands-on phases.
Phase 1b — Get OpenShell Running Locally
Starts with a core primitives primer table (gateway, sandbox, provider, policy, inference.local — what each is and what you'll do with it). Then guided flow: start gateway, create sandbox, explore CLI commands. Includes Exercise 1 (Security Layer Walkthrough) — run real commands against a live sandbox and identify which isolation layer enforced each outcome.
Phase 1c — Rust Track
Parallel with 1a/1b. Experienced Rust devs get a synthesized dependency map from crate Cargo.toml files. New Rust devs get a curated study track (The Rust Book ch 1–10, Rustlings).
Phase 2 — Architecture Deep Dive
Read and discuss all architecture docs (gateway, sandbox, security-policy, compute-runtimes, build). Includes deployment options pointer (Kubernetes, OpenShift). Three exercises: crate ownership mapping, request trace with file:line references, and a Socratic "explain it in your own words" session with adaptive follow-up questions.
Phase 3 — Sandbox & Policy Deep Dive
Deep read of sandbox internals, policy schema, and OCSF logging. Three exercises: trace supervisor startup sequence, write and apply a real network policy, analyze OCSF event usage. Ends with a 5-question architecture reasoning quiz (70% pass threshold).
Phase 4 — First Contribution
Full contribution cycle: find an unclaimed good-first-issue, implement, open PR following Conventional Commits + DCO signoff, address review feedback. Includes vouch system reminder for external contributors.
Changes
Testing
mise run pre-commitpassesChecklist
Summary by CodeRabbit
New Features
Documentation