菜单
Generate boilerplate for wrapping Gemini CLI agents in ORGA governance. Use when building headless agents that run inside Symbiont's CliExecutor or when integrating Gemini CLI with Symbiont's trust stack.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Parse, validate, and create Symbiont DSL agent definitions. Use when writing new agents, debugging DSL syntax errors, or understanding existing agent definitions.
Query and analyze Symbiont's cryptographic audit logs. Use when reviewing agent activity, investigating incidents, or preparing compliance reports.
Initialize a Symbiont-governed project. Creates agent definitions, Cedar policies, and configuration files. Use when setting up a new project with AI agent governance or adding Symbiont to an existing project.
Create, edit, or validate Cedar authorization policies for Symbiont agents. Use when defining access control rules, setting up security policies, or debugging policy evaluation.
Verify MCP tool schemas using SchemaPin cryptographic verification. Use when adding new MCP servers, auditing existing tool integrations, or checking tool integrity.
| name | symbi-agent-sdk |
| description | Generate boilerplate for wrapping Gemini CLI agents in ORGA governance. Use when building headless agents that run inside Symbiont's CliExecutor or when integrating Gemini CLI with Symbiont's trust stack. |
Help the user create Gemini CLI agents that are governed by Symbiont's ORGA loop.
In the runtime-first (Mode B) pattern, Symbiont's CliExecutor spawns Gemini CLI as a governed subprocess:
Symbiont Runtime (ORGA Loop)
-> CliExecutor (sandbox + budget)
-> Gemini CLI (execution)
-> symbi extension (awareness bridge)
-> parent MCP server (governance tools)
When the user wants to define a Gemini CLI agent in DSL, use the executor block:
agent task_name(input: InputType) -> OutputType {
capabilities = ["read", "analyze", "write"]
executor {
type = "gemini_cli"
allowed_tools = ["read_file", "write_file", "run_shell_command", "symbi__*"]
extension = "symbi"
model = "gemini-2.5-pro"
}
policy access_policy {
allow: read(any) if true
deny: write(any) if not input.approved
audit: all_operations
}
with sandbox = "tier1", timeout = "30m" {
result = execute(input)
return result
}
}
When Symbiont spawns Gemini CLI, these environment variables are set:
| Variable | Purpose |
|---|---|
SYMBIONT_MANAGED=true | Signals the extension is inside a managed runtime |
SYMBIONT_MCP_URL | HTTP endpoint to connect back to parent MCP server |
SYMBIONT_RUNTIME_SOCKET | Unix socket for runtime communication |
SYMBIONT_SESSION_ID | Unique session ID for audit correlation |
SYMBIONT_BUDGET_TOKENS | Token budget for this execution |
SYMBIONT_BUDGET_TIMEOUT | Timeout for this execution |
executor block for gemini_clisymbiont.toml configuration if neededsymbi__parse_dslsymbi run <agent_name> --prompt "..."