菜单
Use when resolving how to run ORL via the gombocai/orl Docker image in community workflows. No side effects.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when scanning code for security/compliance issues — detect language, load policies, walk AST, report findings and rule coverage. Depends on: gomboc_community_know_gomboc_mcp, gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_resolve_existing_rules, gomboc_community_cap_orl_walk.
Use when building an ORL rule package — workspace, AST explore, write rule/tests, test loop. Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_setup_rule_workspace, gomboc_community_cap_orl_walk, gomboc_community_task_write_orl_rule, gomboc_community_task_run_orl_test_loop.
Use when running orl test and iterating on a rule package until tests pass or the attempt budget is exhausted. Depends on: gomboc_community_cap_run_orl_test.
Use when authoring the main .orl rule and test.orl for a package using tree-sitter AST queries. Depends on: gomboc_community_know_language_guidance, gomboc_community_cap_orl_walk.
Use when running `orl remediate` (dry-run or apply) against a workspace via Docker, writing a report and submitting it to integrations (non-blocking). Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_gomboc_mcp.
Use when applying a fix with an existing ORL rule or by generating a new one. Does not own save/release — callers (e.g. flow_fix Phase 3) handle enrich and push. Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_resolve_existing_rules, gomboc_community_cap_orl_remediate, gomboc_community_task_setup_rule_workspace, gomboc_community_task_write_orl_rule, gomboc_community_task_run_orl_test_loop.
| name | gomboc_community_know_orl_runtime_resolution |
| description | Use when resolving how to run ORL via the gombocai/orl Docker image in community workflows. No side effects. |
All orl commands in this plugin run via Docker. Mount the working directory at /workspace.
docker run --rm -v "${PWD}:/workspace" -w /workspace gombocai/orl <command> [args...]
Pull/update the image when needed:
docker pull gombocai/orl
Prefer host env GOMBOC_PAT (same token as hosted MCP / plugin userConfig). Never log the token value.
Resolve the host token in this order:
GOMBOC_PAT is set → use it.RULE_SERVICE_TOKEN is set → use it, and log a warning that RULE_SERVICE_TOKEN is deprecated for community skills and callers should migrate to GOMBOC_PAT (do not document RULE_SERVICE_TOKEN in user-facing setup; keep this fallback for backward compatibility only).GOMBOC_PAT.The orl binary reads RULE_SERVICE_TOKEN inside the container. Always forward the resolved host token under that name:
# After resolving TOKEN from GOMBOC_PAT (or legacy RULE_SERVICE_TOKEN with warning):
docker run --rm -v "${PWD}:/workspace" -w /workspace \
-e RULE_SERVICE_TOKEN="${TOKEN}" \
gombocai/orl rules <pull|push> ...
Example resolution (never echo the secret):
if [ -n "${GOMBOC_PAT:-}" ]; then
TOKEN="${GOMBOC_PAT}"
elif [ -n "${RULE_SERVICE_TOKEN:-}" ]; then
echo "warning: RULE_SERVICE_TOKEN is deprecated; set GOMBOC_PAT instead" >&2
TOKEN="${RULE_SERVICE_TOKEN}"
else
echo "error: GOMBOC_PAT is not set" >&2
exit 1
fi
orl rules pull writes rule packages under -o (default .). Prefer a dedicated cache/rulespace such as .gomboc/cache/rules/ or .orl-rules/ so remediations can pass -r <path> or --rulespace.
PWD is ambiguous.double_run) are not orl arguments.gomboc_community_cap_*) over ad-hoc docker run in flows.