Menu
Configure, check, or run explicit OpenACA Cloud sync for a Claude Code endpoint.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Generate fast local OpenACA inventory from Claude Code endpoint or project configuration without running advisory lookups.
Run OpenACA scans from Claude Code when the user asks to scan agent components, check Claude Code configuration, inspect MCP servers/plugins/skills/hooks, or assess agent supply-chain risk.
Guide agent supply-chain triage after Claude Code MCP, plugin, skill, hook, command, or settings changes.
Generate an OpenACA Agent BOM when the user asks for a bill of materials, Agent BOM, inventory export, or structured list of agent components.
Explain OpenACA findings, Agent BOM entries, scan output, severity, confidence, source provenance, and suggested next steps.
Based on SOC occupation classification
| name | sync |
| description | Configure, check, or run explicit OpenACA Cloud sync for a Claude Code endpoint. |
| argument-hint | [configure|status|endpoint] [optional project path] |
| allowed-tools | ["Bash","Read"] |
Use this skill when the user asks to connect OpenACA to Cloud, check sync status, upload endpoint state, or share a local Agent BOM/fleet view.
Cloud sync is opt-in. Confirm before running an upload command.
When the user wants to configure a Cloud token, do NOT run the configure
command as a Bash tool call, and do NOT pass --token <value> on the CLI:
either one embeds the secret in the tool invocation, the process argument
list, the shell history, and the session transcript.
Instead, tell the user to run the configure command themselves in a private
terminal session, outside of Claude — without --token. The CLI prompts
for the token with input hidden, so the secret never lands in argv or shell
history:
uvx --isolated --from openaca openaca remote configure
Once the user confirms the command succeeded, proceed to status or
sync to verify the connection.
Do not repeat token values back to the user. Do not include token values in summaries or logs.
Check local remote configuration:
uvx --isolated --from openaca openaca remote status
Run the normal endpoint sync first:
uvx --isolated --from openaca openaca remote sync endpoint
Include project-local Claude configuration when requested:
uvx --isolated --from openaca openaca remote sync endpoint --project .
Optional external scanners must remain explicit. If the user asks for SkillSpector-backed observations, name the extra scanner in the command:
uvx --isolated --from openaca openaca remote sync endpoint --scanner nvidia-skillspector
If uvx is unavailable but openaca is installed, use the same command
without the uvx prefix.
Summarize:
Do not run sync implicitly after inventory or scan. Do not upload full skill, plugin, MCP, or endpoint state unless the user explicitly asks.