菜单
Use when running `orl remediate` (dry-run or apply) against a workspace via Docker, writing a report and submitting it to integrations (non-blocking). Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_gomboc_mcp.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when scanning code for security/compliance issues — detect language, load policies, walk AST, report findings and rule coverage. Depends on: gomboc_community_know_gomboc_mcp, gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_resolve_existing_rules, gomboc_community_cap_orl_walk.
Use when building an ORL rule package — workspace, AST explore, write rule/tests, test loop. Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_setup_rule_workspace, gomboc_community_cap_orl_walk, gomboc_community_task_write_orl_rule, gomboc_community_task_run_orl_test_loop.
Use when running orl test and iterating on a rule package until tests pass or the attempt budget is exhausted. Depends on: gomboc_community_cap_run_orl_test.
Use when authoring the main .orl rule and test.orl for a package using tree-sitter AST queries. Depends on: gomboc_community_know_language_guidance, gomboc_community_cap_orl_walk.
Use when applying a fix with an existing ORL rule or by generating a new one. Does not own save/release — callers (e.g. flow_fix Phase 3) handle enrich and push. Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_resolve_existing_rules, gomboc_community_cap_orl_remediate, gomboc_community_task_setup_rule_workspace, gomboc_community_task_write_orl_rule, gomboc_community_task_run_orl_test_loop.
Use when scanning code and applying fixes — existing rules or generated ones; optional save/release. Entry point for /fix. Depends on: gomboc_community_flow_diagnose, gomboc_community_flow_apply_fix, gomboc_community_task_enrich_rule, gomboc_community_task_release_rule.
| name | gomboc_community_cap_orl_remediate |
| description | Use when running `orl remediate` (dry-run or apply) against a workspace via Docker, writing a report and submitting it to integrations (non-blocking). Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_gomboc_mcp. |
| Parameter | Required | Description |
|---|---|---|
workspace | yes | Path to engineer code |
rule_path | yes | Local rule package or rulespace path (-r) |
language | yes | ORL language id |
dry_run | no | Default true |
report_out | no | Host path for --out (default .orl-report.yaml) |
Resolve runtime via gomboc_community_know_orl_runtime_resolution.
Always pass --include-location-info and --out so the report includes finding locations (required for integrations payloads).
Dry-run (default):
docker run --rm -v "${PWD}:/workspace" -w /workspace gombocai/orl \
remediate -d --language "${LANGUAGE}" -r "${RULE_PATH}" \
--include-location-info --out "/workspace/${REPORT_OUT}" \
"${WORKSPACE}"
Apply (only after engineer confirmation upstream):
docker run --rm -v "${PWD}:/workspace" -w /workspace gombocai/orl \
remediate --language "${LANGUAGE}" -r "${RULE_PATH}" \
--include-location-info --out "/workspace/${REPORT_OUT}" \
"${WORKSPACE}"
Default REPORT_OUT is .orl-report.yaml (container path /workspace/.orl-report.yaml).
After every remediate (dry-run or apply), submit the report. Prefer MCP post_external_run_event per gomboc_community_know_gomboc_mcp when you can build a valid accountId + event payload from the report; otherwise use the script (never invent tool args). Submission must not fail the remediate workflow.
python3 "${PLUGIN_ROOT}/scripts/integrations/submit_orl_report.py" \
--report "${PWD}/${REPORT_OUT}" --workspace "${PWD}" \
--branch "$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo '')" --duration 0
PLUGIN_ROOT is the community-skills plugin / repo root (where scripts/integrations/ lives). Auth uses GOMBOC_PAT. Missing SDK, token, or network → skip with a warning; exit must not block the caller.
ORL_REMEDIATE_RESULT_START
DRY_RUN: true | false
LANGUAGE: <id>
RULE_PATH: <path>
WORKSPACE: <path>
REPORT_OUT: <path>
SUBMIT: mcp | script | skipped
ORL_REMEDIATE_RESULT_END
--include-location-info or --out when remediating.