Menu
Use when resolving how to run ORL via the gombocai/orl Docker image in community workflows. No side effects.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Use when scanning code for security/compliance issues — detect language, load policies, walk AST, report findings and rule coverage. Depends on: gomboc_community_know_gomboc_mcp, gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_resolve_existing_rules, gomboc_community_cap_orl_walk.
Use when building an ORL rule package — workspace, AST explore, write rule/tests, test loop. Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_setup_rule_workspace, gomboc_community_cap_orl_walk, gomboc_community_task_write_orl_rule, gomboc_community_task_run_orl_test_loop.
Use when running orl test and iterating on a rule package until tests pass or the attempt budget is exhausted. Depends on: gomboc_community_cap_run_orl_test.
Use when authoring the main .orl rule and test.orl for a package using tree-sitter AST queries. Depends on: gomboc_community_know_language_guidance, gomboc_community_cap_orl_walk.
Use when running `orl remediate` (dry-run or apply) against a workspace via Docker, writing a report and submitting it to integrations (non-blocking). Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_gomboc_mcp.
Use when applying a fix with an existing ORL rule or by generating a new one. Does not own save/release — callers (e.g. flow_fix Phase 3) handle enrich and push. Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_resolve_existing_rules, gomboc_community_cap_orl_remediate, gomboc_community_task_setup_rule_workspace, gomboc_community_task_write_orl_rule, gomboc_community_task_run_orl_test_loop.
| name | gomboc_community_know_orl_runtime_resolution |
| description | Use when resolving how to run ORL via the gombocai/orl Docker image in community workflows. No side effects. |
All orl commands in this plugin run via Docker. Mount the working directory at /workspace.
docker run --rm -v "${PWD}:/workspace" -w /workspace gombocai/orl <command> [args...]
Pull/update the image when needed:
docker pull gombocai/orl
Prefer host env GOMBOC_PAT (same token as hosted MCP / plugin userConfig). Never log the token value.
Resolve the host token in this order:
GOMBOC_PAT is set → use it.RULE_SERVICE_TOKEN is set → use it, and log a warning that RULE_SERVICE_TOKEN is deprecated for community skills and callers should migrate to GOMBOC_PAT (do not document RULE_SERVICE_TOKEN in user-facing setup; keep this fallback for backward compatibility only).GOMBOC_PAT.The orl binary reads RULE_SERVICE_TOKEN inside the container. Always forward the resolved host token under that name:
# After resolving TOKEN from GOMBOC_PAT (or legacy RULE_SERVICE_TOKEN with warning):
docker run --rm -v "${PWD}:/workspace" -w /workspace \
-e RULE_SERVICE_TOKEN="${TOKEN}" \
gombocai/orl rules <pull|push> ...
Example resolution (never echo the secret):
if [ -n "${GOMBOC_PAT:-}" ]; then
TOKEN="${GOMBOC_PAT}"
elif [ -n "${RULE_SERVICE_TOKEN:-}" ]; then
echo "warning: RULE_SERVICE_TOKEN is deprecated; set GOMBOC_PAT instead" >&2
TOKEN="${RULE_SERVICE_TOKEN}"
else
echo "error: GOMBOC_PAT is not set" >&2
exit 1
fi
orl rules pull writes rule packages under -o (default .). Prefer a dedicated cache/rulespace such as .gomboc/cache/rules/ or .orl-rules/ so remediations can pass -r <path> or --rulespace.
PWD is ambiguous.double_run) are not orl arguments.gomboc_community_cap_*) over ad-hoc docker run in flows.