菜单
Use when resolving a usable local rule path for a finding — local disk first, then cache, then MCP lookup, then orl rules pull. Depends on: gomboc_community_know_gomboc_mcp, gomboc_community_know_orl_runtime_resolution, gomboc_community_cap_orl_rules_pull.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when scanning code for security/compliance issues — detect language, load policies, walk AST, report findings and rule coverage. Depends on: gomboc_community_know_gomboc_mcp, gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_resolve_existing_rules, gomboc_community_cap_orl_walk.
Use when building an ORL rule package — workspace, AST explore, write rule/tests, test loop. Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_setup_rule_workspace, gomboc_community_cap_orl_walk, gomboc_community_task_write_orl_rule, gomboc_community_task_run_orl_test_loop.
Use when running orl test and iterating on a rule package until tests pass or the attempt budget is exhausted. Depends on: gomboc_community_cap_run_orl_test.
Use when authoring the main .orl rule and test.orl for a package using tree-sitter AST queries. Depends on: gomboc_community_know_language_guidance, gomboc_community_cap_orl_walk.
Use when running `orl remediate` (dry-run or apply) against a workspace via Docker, writing a report and submitting it to integrations (non-blocking). Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_gomboc_mcp.
Use when applying a fix with an existing ORL rule or by generating a new one. Does not own save/release — callers (e.g. flow_fix Phase 3) handle enrich and push. Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_resolve_existing_rules, gomboc_community_cap_orl_remediate, gomboc_community_task_setup_rule_workspace, gomboc_community_task_write_orl_rule, gomboc_community_task_run_orl_test_loop.
| name | gomboc_community_task_resolve_existing_rules |
| description | Use when resolving a usable local rule path for a finding — local disk first, then cache, then MCP lookup, then orl rules pull. Depends on: gomboc_community_know_gomboc_mcp, gomboc_community_know_orl_runtime_resolution, gomboc_community_cap_orl_rules_pull. |
Remote discovery via orl is a pull (orl rules pull --search). There is no search-only orl command. Prefer hosted MCP lookup first per gomboc_community_know_gomboc_mcp (including Pagination for list/search tools).
| Parameter | Required | Description |
|---|---|---|
language | yes | ORL language id |
classification | no | Policy / classification id |
resource | no | Resource type hint |
cache_dir | no | Default .gomboc/cache/rules |
cache_ttl_hours | no | Default 24 |
/orl-rules/final/, .orl-rules/, or .orl-fixes/ exists, use orl list_rules / rule_metadata (via Docker per know skill) and match classification + language + resource.cache_dir has fresh metadata (metadata.json within TTL), reuse pulled packages.get_rules per gomboc_community_know_gomboc_mcp. When data.body is present, write under cache_dir and treat as resolved (SOURCE: mcp).search_rules and/or get_channels_rules — paginate fully (page / perPage) before concluding MCP cannot help. Materialize hits that include body; call get_rules for names missing body. Use get_channels / get_classifications / search_classifications (paginated) only to refine names/queries.get_rules, continue to pull.gomboc_community_cap_orl_rules_pull with a compound --search query into cache_dir; refresh cache metadata (Docker only when MCP cannot supply bodies after the steps above).RULE_RESOLVE_START
STATUS: existing | partial | none
RULE_PATH: <path or none>
SOURCE: local | cache | mcp | pull
RULE_RESOLVE_END
gomboc_community_cap_orl_remediate.