菜单
Use when pulling rules from the Gomboc Rules Service with `orl rules pull` (--search and/or --channel). Search via orl is a pull. Prefer MCP channel/rule lookup first when available. Depends on: gomboc_community_know_gomboc_mcp, gomboc_community_know_orl_runtime_resolution.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when scanning code for security/compliance issues — detect language, load policies, walk AST, report findings and rule coverage. Depends on: gomboc_community_know_gomboc_mcp, gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_resolve_existing_rules, gomboc_community_cap_orl_walk.
Use when building an ORL rule package — workspace, AST explore, write rule/tests, test loop. Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_setup_rule_workspace, gomboc_community_cap_orl_walk, gomboc_community_task_write_orl_rule, gomboc_community_task_run_orl_test_loop.
Use when running orl test and iterating on a rule package until tests pass or the attempt budget is exhausted. Depends on: gomboc_community_cap_run_orl_test.
Use when authoring the main .orl rule and test.orl for a package using tree-sitter AST queries. Depends on: gomboc_community_know_language_guidance, gomboc_community_cap_orl_walk.
Use when running `orl remediate` (dry-run or apply) against a workspace via Docker, writing a report and submitting it to integrations (non-blocking). Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_gomboc_mcp.
Use when applying a fix with an existing ORL rule or by generating a new one. Does not own save/release — callers (e.g. flow_fix Phase 3) handle enrich and push. Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_resolve_existing_rules, gomboc_community_cap_orl_remediate, gomboc_community_task_setup_rule_workspace, gomboc_community_task_write_orl_rule, gomboc_community_task_run_orl_test_loop.
| name | gomboc_community_cap_orl_rules_pull |
| description | Use when pulling rules from the Gomboc Rules Service with `orl rules pull` (--search and/or --channel). Search via orl is a pull. Prefer MCP channel/rule lookup first when available. Depends on: gomboc_community_know_gomboc_mcp, gomboc_community_know_orl_runtime_resolution. |
There is no orl rules search. Matching remote rules uses rules pull with --search and/or --channel, which downloads rule packages.
Follow gomboc_community_know_gomboc_mcp (including Pagination):
get_channels (metadata/query only).get_channels_rules with the channel name. Paginate with page / perPage until all total rules are fetched. When an item includes body, write it into out_dir as the local package / .orl and skip Docker for that rule. If an item omits body, call get_rules for that name before falling back.search_rules (paginate fully), then get_rules for any hit missing body. For each known rule name, call get_rules — the response includes the rule body. Write into out_dir and skip Docker for that rule.orl rules pull below only when MCP is unavailable, list/search/get_rules fails, or bodies are still missing after full pagination (and any get_rules follow-ups). Do not fall back because the channel/search result set is large or only the first page was retrieved.| Parameter | Required | Description |
|---|---|---|
out_dir | yes | Host directory for pulled rules (-o) |
search | no | Prefix-notation query for --search |
channel | no | Channel name for --channel |
Auth: resolve host token per gomboc_community_know_orl_runtime_resolution (GOMBOC_PAT, else legacy RULE_SERVICE_TOKEN with warning).
# TOKEN resolved per know_orl_runtime_resolution (prefer GOMBOC_PAT)
docker run --rm -v "${PWD}:/workspace" -w /workspace \
-e RULE_SERVICE_TOKEN="${TOKEN}" \
gombocai/orl rules pull -o "${OUT_DIR}" \
--search '(and (any "<classification>" $.classification) (eq $.metadata.language "<lang>"))'
Or by channel:
docker run --rm -v "${PWD}:/workspace" -w /workspace \
-e RULE_SERVICE_TOKEN="${TOKEN}" \
gombocai/orl rules pull -o "${OUT_DIR}" --channel default
ORL_RULES_PULL_RESULT_START
OUT_DIR: <path>
MATCH_COUNT: <n or unknown>
ORL_RULES_PULL_RESULT_END
The --search flag uses prefix (Polish) notation:
| Operator | Description | Example |
|---|---|---|
(eq $.field "value") | Exact equality | (eq $.metadata.language "terraform") |
(any "value" $.field) | Deep search in field | (any "CIS" $.classification) |
(contains "value" $.field) | String/array contains | (contains "security" $.tags) |
(matches "/regex/" $.field) | Regex match | (matches "/aws_s3/" $.name) |
(and expr1 expr2 ...) | All must be true | (and (any "CIS" $.classification) ...) |
--search queries (classification + language + resource).gomboc_community_task_resolve_existing_rules.