菜单
Use when adding community metadata (name, description, classifications, annotations) to an ORL rule for publishing. Prefer MCP classification lookup when available. Depends on: gomboc_community_know_gomboc_mcp, gomboc_community_know_release_checklist.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | gomboc_community_task_enrich_rule |
| description | Use when adding community metadata (name, description, classifications, annotations) to an ORL rule for publishing. Prefer MCP classification lookup when available. Depends on: gomboc_community_know_gomboc_mcp, gomboc_community_know_release_checklist. |
You add essential metadata to completed ORL rules so they can be discovered when published. Required annotation checklist: gomboc_community_know_release_checklist. Classification lookup: prefer MCP per gomboc_community_know_gomboc_mcp.
Every rule must have these fields in the metadata: section:
metadata:
name: gomboc-ai/<rule-name>
display_name: <Human Readable Title, max 10 words>
description: |
## Description
<What the rule does and why, in markdown>
classifications:
- gomboc-ai/policy/<category>/<subcategory>
annotations:
contributed-by: <user name or handle>
gomboc-ai/provider: <AWS|Azure|GCP>
gomboc-ai/resource: <resource type>
gomboc-ai/visibility: public
gomboc-ai/public-rule-bodies: "true"
gomboc-ai/description-plain: "<one-line plaintext description>"
namegomboc-ai/<descriptive-snake-case-name>gomboc-ai/ensure_s3_bucket_encryption_enableddisplay_name<action> <resource> <goal>description## Descriptionclassificationsgomboc-ai/policy/* classification is requiredget_classifications by exact name, or search_classifications when browsing (paginate per gomboc_community_know_gomboc_mcp); otherwise search ../../references/classifications.txtgomboc-ai/policy/encryption/encryption_at_rest/...gomboc-ai/policy/encryption/encryption_in_transit/...gomboc-ai/policy/secure_networking/prevent_public_access_via_explicit_settinggomboc-ai/policy/secure_management/accidental_deletion_protection/...gomboc-ai/policy/logging_and_monitoring/...annotations| Key | Description | Example |
|---|---|---|
contributed-by | Who created the rule | community-user |
gomboc-ai/provider | Cloud provider | AWS, Azure, GCP |
gomboc-ai/resource | Resource type from the IaC language | aws_s3_bucket, Microsoft.Storage/storageAccounts, AWS::S3::Bucket |
gomboc-ai/visibility | Always public for community rules | public |
gomboc-ai/public-rule-bodies | Always "true" for community rules | "true" |
gomboc-ai/description-plain | One-line plaintext summary | "Ensure S3 buckets have encryption enabled." |
get_classifications (known name) or paginated search_classifications (browse/query) per gomboc_community_know_gomboc_mcp; fall back to grepping ../../references/classifications.txtmetadata: sectionBefore:
metadata:
name: gomboc-ai/ensure_s3_encryption
spec:
...
After:
metadata:
name: gomboc-ai/ensure_s3_encryption
display_name: Ensure S3 Bucket Encryption at Rest
description: |
## Description
Ensures that AWS S3 buckets have server-side encryption enabled using AES-256 or AWS KMS.
classifications:
- gomboc-ai/policy/encryption/encryption_at_rest/encryption_at_rest_with_provider_managed_key
annotations:
contributed-by: community-user
gomboc-ai/provider: AWS
gomboc-ai/resource: aws_s3_bucket
gomboc-ai/visibility: public
gomboc-ai/public-rule-bodies: "true"
gomboc-ai/description-plain: "Ensure AWS S3 buckets have server-side encryption enabled."
spec:
...
Use when scanning code for security/compliance issues — detect language, load policies, walk AST, report findings and rule coverage. Depends on: gomboc_community_know_gomboc_mcp, gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_resolve_existing_rules, gomboc_community_cap_orl_walk.
Use when building an ORL rule package — workspace, AST explore, write rule/tests, test loop. Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_setup_rule_workspace, gomboc_community_cap_orl_walk, gomboc_community_task_write_orl_rule, gomboc_community_task_run_orl_test_loop.
Use when running orl test and iterating on a rule package until tests pass or the attempt budget is exhausted. Depends on: gomboc_community_cap_run_orl_test.
Use when authoring the main .orl rule and test.orl for a package using tree-sitter AST queries. Depends on: gomboc_community_know_language_guidance, gomboc_community_cap_orl_walk.
Use when running `orl remediate` (dry-run or apply) against a workspace via Docker, writing a report and submitting it to integrations (non-blocking). Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_gomboc_mcp.
Use when applying a fix with an existing ORL rule or by generating a new one. Does not own save/release — callers (e.g. flow_fix Phase 3) handle enrich and push. Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_resolve_existing_rules, gomboc_community_cap_orl_remediate, gomboc_community_task_setup_rule_workspace, gomboc_community_task_write_orl_rule, gomboc_community_task_run_orl_test_loop.