소스 정보
- 저장소
- Aditya232-rtx/Ouroboros
- 최근 소스 활동
- 2026년 8월 22일 22:16
- 감지된 SKILL.md 언어
- 영어
- 스타
- 3
- 포크
- 0
설치 방법
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
소스 파일 검토
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
메뉴
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/Aditya232-rtx/Ouroboros --skill hermes-agent-skill-authoring명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
Add security scanning to CI/CD with Fang — GitHub Actions, GitLab CI, or any pipeline — so every pull request gets a diff-scoped AI pentest that blocks vulnerable code before it merges, with results as PR comments and SARIF uploaded to code scanning. Covers both the self-hosted open-source CLI (runs in your runner) and the managed app.fang.ai platform (GitHub/GitLab app or API, no runner infra). Use when the user asks to add security scanning, SAST/DAST, pentesting, vulnerability checks, or automated security review to their CI pipeline, pre-merge gate, or PR workflow.
Fix security vulnerabilities found by a Fang pentest (open-source CLI or app.fang.ai cloud) — triage by severity, patch the root cause rather than the symptom, and re-run Fang to prove each fix actually closes the exploit. Handles injection, XSS, SSRF, broken access control, IDOR, and other validated findings. Use after a Fang scan reports findings, or when the user asks to remediate, patch, or fix security issues from a fang_runs report, vulnerabilities.json, findings.sarif, or a cloud scan.
Run a managed pentest of a web app or API through the app.fang.ai REST API — no local Docker, LLM key, or install needed. Create an API token, register domain/repository assets, launch and poll scans, triage vulnerabilities, export SARIF, download PDF/DOCX pentest reports for SOC 2 and other compliance evidence (Enterprise plan), start PR reviews, and set up schedules and webhooks. Use when the user wants continuous or scheduled pentesting-as-a-service, an auditor-ready pentest report, scans tracked in a team dashboard, or security testing from a sandboxed agent/CI environment with no infrastructure.
SKILL.md 표시 중
| name | hermes-agent-skill-authoring |
| description | Author in-repo SKILL.md files: frontmatter and structure. |
| version | 2.0.0 |
| author | Ouro |
| license | MIT |
| platforms | ["linux","macos","windows"] |
| metadata | {"hermes":{"tags":["skills","authoring","ouro-agent","conventions","skill-md"],"related_skills":["plan","requesting-code-review"]}} |
There are two places a SKILL.md can live:
~/.ouro/skills/<maybe-category>/<name>/SKILL.md — personal, not shared. Created via skill_manage(action='create').skills/<category>/<name>/SKILL.md or optional-skills/<category>/<name>/SKILL.md inside the ouro-agent repo — committed, shipped with the package. Use write_file + git add. skill_manage(action='create') does NOT target this tree.In-repo skills must meet the repo's hardline authoring standards (see AGENTS.md, "Skill authoring standards (HARDLINE)" — that section is the source of truth; this skill is the operational walkthrough). Reviewers reject PRs that violate them, so meeting them up front is cheaper than a salvage pass later.
skills/ or optional-skills/ (use patch for small edits, write_file for rewrites; skill_manage still works for patch on in-repo skills, but not for create)~/.ouro/skills/ (just use skill_manage)skills/<category>/) — daily-driver behavior, broadly useful across many user types, low footprint. Hard bar: you can say "a user will load this in 5+ sessions per month" with a straight face.optional-skills/<category>/) — niche, vertical-specific (blockchain, gaming, finance, one app), recurring-job/task skills, or anything heavy. Installed via ouro skills install official/<category>/<skill>.When in doubt, optional. Promoting later is easy; demoting is churn. "Would be useful to anyone who ever needs this" is an optional-tier argument, not a bundled one.
Pick the category by what the tool IS, not what it feels like (an AI-agent CLI goes in autonomous-ai-agents/ even if it "feels productivity"). Confirm existing categories with search_files(pattern='*', target='files', path='skills') and don't invent new top-level categories casually.
No router / index / hub skills. A skill whose core content is a routing table pointing at sibling skills adds an indirection hop and duplicates the siblings' own When to Use triggers. If the skill would be empty without "load skill X instead" pointers, don't write it — the catalog and each sibling's triggers already do that job.
Validator source of truth: tools/skill_manager_tool.py::_validate_frontmatter. Validator hard requirements:
--- as the first bytes (no leading blank line).\n---\n before the body.name field present.description field present (validator ceiling 1024 chars — but see the repo hardline below, which is much stricter).---.Repo-standard shape (all fields expected, even where the validator doesn't enforce them):
---
name: my-skill-name # lowercase, hyphens, ≤64 chars (MAX_NAME_LENGTH)
description: Concise capability statement, under sixty chars.
version: 0.1.0 # semver; new skills start at 0.1.0
author: Real Name (github-handle), Ouro
license: MIT
platforms: [linux, macos, windows] # audit, don't guess — see Platform Gating
metadata:
hermes:
tags: [Short, Descriptive, Tags]
related_skills: [other-in-repo-skill]
---
description rules (HARDLINE — the validator's 1024 is NOT the standard):, wrap it in double quotes or YAML parses it as a mapping and the docs generator crashes. Quotes don't count toward the 60.Good: Track named companies for material news with cited digests.
Bad: Use when a user asks to monitor named competitors or companies for product launches, pricing changes, funding, ... (240 chars — rejected in review)
author rulesBen Barclay (benbarclay), Ouro.author: Ouro alone for contributed skills — credit the human, not the tool, even (especially) when an agent drafted the text.Teknium (teknium1), Ouro.related_skills rules~/.ouro/skills/.search_files(pattern='<name>', target='files', path='skills') (and optional-skills/).platforms: gates loading by host OS. Set it from what the skill's prose and scripts actually invoke:
| Skill uses only… | platforms: |
|---|---|
| Ouro tools + stdlib Python + cross-platform CLIs | [linux, macos, windows] |
bash pipelines, grep/awk/sed chains, heredocs | [linux, macos] |
osascript, defaults, pmset | [macos] |
apt/systemctl//proc | [linux] |
POSIX-only signals to search for in scripts/: fcntl, termios, pty, os.fork, os.killpg, signal.SIGKILL, os.kill(pid, 0) liveness checks, hardcoded /tmp /proc /etc. Default posture: fix cross-platform first (tempfile.gettempdir(), pathlib.Path, psutil.pid_exists); gate narrower only when the dependency is genuinely platform-bound, and say why in ## Pitfalls.
MAX_SKILL_CONTENT_CHARS), but target ~100 lines for a simple skill, ~200 for a complex one. Peer skills sit at 8-14k chars.references/*.md, templates/, or scripts/ — pointed to from SKILL.md, not inlined.scripts/ and reference it by path.# <Skill> Skill
2-3 sentence intro: what it does, what it doesn't do, dependency stance.
## When to Use — bulleted triggers (+ "Don't use for:" counter-triggers)
## Prerequisites — exact env vars, installs, API key sourcing
## How to Run — canonical invocation through the `terminal` tool
## Quick Reference — flat command list, no narration
## Procedure — numbered steps, each with a checkable completion criterion
## Pitfalls — known limits, things that look broken but aren't
## Verification — how to prove the skill worked
Not every section applies to every skill (a pure-procedure task skill may have no Quick Reference), but When to Use + actionable body + Pitfalls + Verification are the minimum. Cut marketing intros, "Setup Check" no-ops, and re-explanations of env vars already in Prerequisites.
When the skill needs a capability, name the proper Ouro tool in backticks: terminal, read_file, write_file, patch, search_files, web_search, web_extract, browser_navigate, vision_analyze, delegate_task, cronjob. Do NOT name shell utilities the agent already has wrapped (grep → search_files, cat → read_file, sed/awk → patch, find/ls → search_files target='files'). A CLI-wrapper skill should frame invocations as terminal(command="<tool> ...", timeout=...) — bare shell prose ("run foo --version") is a review-blocking non-conformance. If the skill depends on an MCP server, name it and document setup in Prerequisites.
Write repo-relative paths (skills/..., tools/skill_manager_tool.py). A /home/<you>/... path baked into a committed skill breaks for every other user and is an instant review flag.
A skill exists to make the agent's process more predictable — the agent reliably follows the same useful discipline.
tests/skills/test_<skill>_skill.py — stdlib + pytest + unittest.mock only, no live network. Run via scripts/run_tests.sh tests/skills/test_<skill>_skill.py -q. (The generic tests/tools/test_skill_manager_tool.py passing proves nothing about YOUR skill.)python website/scripts/generate-skill-docs.py, then apply scope discipline — the generator rewrites EVERY auto-gen page. git checkout -- everything that isn't yours; the final diff must show only your SKILL.md, your one per-skill docs page, a one-line catalog row, and a one-line website/sidebars.ts insertion (verify with search_files(pattern='<your-slug>', path='website/sidebars.ts') — exactly one hit, or the page is an orphan)..env.example (only if the skill needs new env vars): one clearly delimited commented block; touch nothing else in the file.search_files(target='files') and read 2-3 peer SKILL.md files to match tone and structure. Prefer extending an existing skill over creating a narrow sibling.write_file to skills/<category>/<name>/SKILL.md (or optional-skills/...).import yaml, re, pathlib
content = pathlib.Path("skills/<category>/<name>/SKILL.md").read_text()
assert content.startswith("---")
m = re.search(r'\n---\s*\n', content[3:])
fm = yaml.safe_load(content[3:m.start()+3])
assert "name" in fm and "description" in fm
assert len(fm["description"]) <= 60, f"description {len(fm['description'])} chars — hardline is 60"
assert fm["description"].endswith(".")
assert "platforms" in fm
assert len(content) <= 100_000
Also verify every related_skills entry exists in-repo.skill_view / skills_list will not see the new skill until a new session. This is expected, not a bug.skill_manage(action='patch', ...) works on in-repo skills, as does patch.write_file the whole SKILL.md.write_file to references/, templates/, or scripts/ under the skill dir.skill_manage(action='create') for an in-repo skill. It writes to ~/.ouro/skills/, not the repo tree. Use write_file.platforms:, author format, tests, or docs — review does.author: Ouro on a contributed skill. Credit the human first.---. Validation fails on any leading blank line or BOM.related_skills pointing at skills that don't exist in-repo (user-local, planned, or in a sibling PR).optional-skills/)skills/<category>/<name>/SKILL.md or optional-skills/<category>/<name>/SKILL.md---, closes with \n---\nname, description, version, author, license, platforms, metadata.hermes.{tags, related_skills} all presentauthor credits the human contributor firstplatforms: audited against actual prose/scripts, not copied from a siblingrelated_skills entry resolves in-repotests/skills/test_<skill>_skill.py pass under scripts/run_tests.shgit add + commit on the intended branch; PR opened