chore(ci): agent ci skills and nightly build - #201
Conversation
github-actions
Bot
added
scope(ci)
github_actions
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe PR renames agent skills, adds CI failure investigation and upkeep workflows, implements deterministic upkeep task selection, and schedules daily CI runs. ChangesAgent skill naming and guidance
Scheduled CI debugging
Deterministic upkeep selection
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant select-task.js
participant Git remote
participant Repository filesystem
select-task.js->>Git remote: Check remote upkeep branches
Git remote-->>select-task.js: Return branch status
select-task.js->>Repository filesystem: Discover eligible task candidates
Repository filesystem-->>select-task.js: Return candidate metadata
select-task.js-->>select-task.js: Rank and emit one task
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
ESLint install failed. For unrecoverable errors, disable the tool in CodeRabbit configuration. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/skills/agent-debug-ci/SKILL.md:
- Around line 65-79: Update the `pnpm run ci:reset` instruction in the debugging
workflow to invoke the command through `mise exec`, consistent with the other
repository toolchain commands. Preserve the existing guidance to use it only
when stale generated output or cache state is indicated.
- Around line 87-88: Update the workflow guidance in the relevant debugging
instructions so agents explicitly fetch or refresh origin/main before verifying
the failure or creating a fix branch, then base all investigation on that
updated reference.
In @.agents/skills/agent-upkeep/scripts/select-task.js:
- Around line 109-114: Update inFlightBranches so any failure from the git fetch
refresh is propagated or causes a non-zero exit instead of being swallowed. Only
perform the upkeep branch selection after the remote branch list has been
refreshed successfully; preserve the existing branch detection behavior on
successful fetches.
- Around line 260-270: Update the test-discovery regex in the source-scanning
logic to match only it.skip, it.todo, it.fails, test.skip, test.todo, and
test.fails calls. Exclude describe and all other suite-level modifiers while
preserving the existing candidate construction, title extraction, and
visual-baseline weighting behavior.
In @.agents/skills/agent-upkeep/SKILL.md:
- Line 12: Update the pull-request contract in the agent-upkeep skill to allow
an authenticated GitHub integration/tool for creating draft pull requests and
applying the required upkeep label; alternatively, explicitly change the
workflow to stop after pushing the branch and remove any requirements that
cannot be fulfilled with git-only tooling.
- Around line 29-47: Ensure coverage task selection uses fresh coverage data:
update .agents/skills/agent-upkeep/SKILL.md lines 29-47 to make coverage
generation or freshness validation occur before selection, and update
.agents/skills/agent-upkeep/scripts/select-task.js lines 174-188 to generate or
validate fresh coverage before ranking candidates, emitting no coverage task
when freshness cannot be established.
- Around line 67-90: Make Mode A actionable by requiring selector-provided
package targets and invocation context instead of emitting only the shared
ESLint config. Update .agents/skills/agent-upkeep/SKILL.md lines 67-90 to
instruct agents to use only the affected packages, working directories, and
suppression-file locations supplied by the selector. Update
.agents/skills/agent-upkeep/scripts/select-task.js lines 318-326 to discover and
emit that complete package-specific context, including each workingDirectory and
suppressionsFile; no direct change is needed elsewhere.
In @.github/workflows/ci.yml:
- Around line 8-10: Update the scheduled workflow cron expression under schedule
to run at an off-hour minute, such as 01:17 America/Chicago, instead of exactly
01:00. Preserve the existing daily cadence and timezone.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: ca576ddf-97f4-4bcf-ae83-98826b951ebf
📒 Files selected for processing (6)
.agents/skills/agent-availability-report/SKILL.md.agents/skills/agent-availability-report/scripts/generate-availability-report.js.agents/skills/agent-debug-ci/SKILL.md.agents/skills/agent-upkeep/SKILL.md.agents/skills/agent-upkeep/scripts/select-task.js.github/workflows/ci.yml
b9a7e1c to
f225bf5
Compare
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/skills/agent-debug-ci/SKILL.md:
- Around line 31-37: Update the documented gh run view --log-failed command to
include the resolved attempt number when inspecting rerun workflows. Use the
attempt value returned by the preceding run metadata query, while preserving the
existing run identifier and failed-log behavior.
- Around line 69-75: Update the scheduled CI reproduction guidance in the skill
to run both commands with PAGES_BASE_URL="/elements/": pnpm run ci followed by
projects/internals/ci/cache-validate.js ci only after the first succeeds.
Preserve the existing isolation and environment-matching guidance while
documenting the complete command sequence.
In @.agents/skills/agent-upkeep/scripts/select-task.js:
- Around line 315-325: Preserve Mode B suppression-file context by updating
suppressionCandidates output handling in select-task.js
(.agents/skills/agent-upkeep/scripts/select-task.js:315-325) to emit
suppressionsFile relative to workingDirectory or as an absolute path. Update the
Mode B pruning commands in .agents/skills/agent-upkeep/SKILL.md:67-70 and
:94-101 to pass this value to --prune-suppressions using
--suppressions-location.
In @.agents/skills/agent-upkeep/SKILL.md:
- Line 120: Add the `text` language identifier to the fenced Markdown blocks at
the referenced locations in `SKILL.md`, including the block around line 120 and
the additional blocks around lines 190 and 205, while preserving their contents.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: fd2a9709-e599-4fa4-9efd-d741c185d2dd
📒 Files selected for processing (6)
.agents/skills/agent-availability-report/SKILL.md.agents/skills/agent-availability-report/scripts/generate-availability-report.js.agents/skills/agent-debug-ci/SKILL.md.agents/skills/agent-upkeep/SKILL.md.agents/skills/agent-upkeep/scripts/select-task.js.github/workflows/ci.yml
| Useful commands include: | ||
|
|
||
| ```shell | ||
| gh run view <run-id> \ | ||
| --json databaseId,attempt,event,headBranch,headSha,status,conclusion,url,workflowName,jobs | ||
| gh run view <run-id> --log-failed | ||
| ``` |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/sh
set -eu
printf '%s\n' '--- .agents/skills/agent-debug-ci/SKILL.md ---'
nl -ba .agents/skills/agent-debug-ci/SKILL.md | sed -n '1,110p'
printf '%s\n' '--- gh run view references ---'
rg -n -C 4 -- '--attempt|--log-failed|gh run view' .agents .github 2>/dev/null || trueRepository: NVIDIA/elements
Length of output: 1082
🌐 Web query:
GitHub CLI gh run view --attempt --log-failed official manual
💡 Result:
The gh run view command in the GitHub CLI is used to display a summary or logs of a specific workflow run [1][2]. Regarding the flags you mentioned: --attempt : This flag allows you to specify the attempt number of the workflow run you wish to view [1][3]. It defaults to 0 (typically representing the latest attempt) [1]. This is useful for accessing logs or summaries of previous run attempts that are no longer the most recent [4]. --log-failed: This flag is used to view the logs specifically for any failed steps within a workflow run or a specific job [1][5]. Common usage examples include: View a specific run attempt: gh run view --attempt View failed logs for a run: gh run view --log-failed View failed logs for a specific job: gh run view --job --log-failed You can combine these with other flags like --job to narrow your focus to a specific part of the workflow, or --exit-status to have the command return a non-zero exit code if the run failed, which is useful for automation and CI/CD pipelines [1][2][5].
Citations:
- 1: https://cli.github.com/manual/gh_run_view
- 2: https://github.com/github/docs/blob/main/content/actions/how-tos/monitor-workflows/view-workflow-run-history.md
- 3: https://manpages.ubuntu.com/manpages/stonking/man1/gh-run-view.1.html
- 4:
gh run view --attemptcli/cli#6088 - 5: https://manpages.debian.org/bookworm/gh/gh-run-view.1.en.html
🏁 Script executed:
#!/bin/sh
set -eu
nl -ba .agents/skills/agent-debug-ci/SKILL.md | sed -n '1,110p'
rg -n -C 4 -- '--attempt|--log-failed|gh run view' .agents .github 2>/dev/null || trueRepository: NVIDIA/elements
Length of output: 1004
Pass the resolved attempt to --log-failed.
If the run was rerun, the command can inspect the latest attempt instead of the triggering attempt.
Proposed fix
-gh run view <run-id> --log-failed
+gh run view <run-id> --attempt <attempt> --log-failed📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| Useful commands include: | |
| ```shell | |
| gh run view <run-id> \ | |
| --json databaseId,attempt,event,headBranch,headSha,status,conclusion,url,workflowName,jobs | |
| gh run view <run-id> --log-failed | |
| ``` | |
| Useful commands include: | |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/agent-debug-ci/SKILL.md around lines 31 - 37, Update the
documented gh run view --log-failed command to include the resolved attempt
number when inspecting rerun workflows. Use the attempt value returned by the
preceding run metadata query, while preserving the existing run identifier and
failed-log behavior.
|
|
||
| Once you fix a suppressed violation, ESLint exits **non-zero** with: | ||
|
|
||
| ``` |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Add language identifiers to fenced blocks.
markdownlint-cli2 reports MD040 for these blocks. Mark them as text.
Proposed fix
- ```
+ ```textAlso applies to: 190-190, 205-205
🧰 Tools
🪛 markdownlint-cli2 (0.23.1)
[warning] 120-120: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🪛 SkillSpector (2.4.4)
[warning] 53: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 105: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 167: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 236: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 237: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 238: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 239: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 175: [MP2] Context Window Stuffing: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Remediation: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
(Memory Poisoning (MP2))
[error] 61: [P2] Hidden Instructions: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Remediation: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
(Prompt Injection (P2))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/agent-upkeep/SKILL.md at line 120, Add the `text` language
identifier to the fenced Markdown blocks at the referenced locations in
`SKILL.md`, including the block around line 120 and the additional blocks around
lines 190 and 205, while preserving their contents.
Source: Linters/SAST tools
f225bf5 to
40f9f03
Compare
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/skills/agent-availability-report/SKILL.md:
- Line 2: Update renamed skill references in
.agents/skills/agent-upkeep/SKILL.md to use authoring-tests,
authoring-typescript, audit-code, and audit-accessibility instead of the old
identifiers. Align the metadata in .agents/skills/guidance-build-system/SKILL.md
(line 2) with name: guidance-build. The other cited metadata
sites—.agents/skills/agent-availability-report/SKILL.md (line 2),
.agents/skills/audit-accessibility/SKILL.md (line 2),
.agents/skills/audit-ci/SKILL.md (line 2),
.agents/skills/authoring-typescript/SKILL.md (line 2), and
.agents/skills/guidance-api-design/SKILL.md (line 2)—require no direct changes.
In @.agents/skills/agent-upkeep/scripts/select-task.js:
- Around line 271-280: Restrict automatic bug candidates in
.agents/skills/agent-upkeep/scripts/select-task.js lines 271-280 to it.skip and
test.skip, unless the emitted kind includes distinct executable steps for other
kinds. Update .agents/skills/agent-upkeep/SKILL.md lines 134-146 with separate
validation procedures before permitting .todo or .fails tasks; ensure .todo and
.fails are not treated like unskippable tests.
- Around line 221-228: Update the suppression candidate construction in the
Object.entries(data) loop to resolve each file and reject it when
path.relative(root, resolvedFile) indicates it escapes the repository root,
including absolute or parent-traversal keys. Only add candidates for
root-contained paths; preserve the existing count filtering and candidate fields
for valid files.
In @.agents/skills/agent-upkeep/SKILL.md:
- Around line 17-18: Update the scope rules in the Mode A guidance to explicitly
allow editing the shared ESLint config under projects/internals/ and
selector-provided generated suppression files in other projects, while requiring
hand-fixed source changes to remain within one project. Preserve the existing
four-file and 150-line diff cap.
In @.agents/skills/audit-accessibility/SKILL.md:
- Line 41: Update the visual-variant testing guidance in the accessibility skill
to require status and size coverage for all applicable components, while making
disabled-state tests conditional on whether the component supports disabled
behavior.
In @.agents/skills/audit-code/SKILL.md:
- Around line 2-6: Update all renamed skill references in
.agents/skills/agent-upkeep/SKILL.md: replace testing with authoring-tests at
lines 53 and 236, typescript with authoring-typescript at lines 105 and 237,
code-review with audit-code at lines 167 and 238, and accessibility with
audit-accessibility at line 239. The anchor .agents/skills/audit-code/SKILL.md
lines 2-6 and sibling .agents/skills/authoring-tests/SKILL.md lines 2-6 require
no direct changes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 8035479e-715b-437e-b0e8-04b1f804a3f5
📒 Files selected for processing (18)
.agents/skills/agent-availability-report/SKILL.md.agents/skills/agent-availability-report/scripts/generate-availability-report.js.agents/skills/agent-debug-ci/SKILL.md.agents/skills/agent-upkeep/SKILL.md.agents/skills/agent-upkeep/scripts/select-task.js.agents/skills/audit-accessibility/SKILL.md.agents/skills/audit-ci/SKILL.md.agents/skills/audit-ci/references/optimization-playbook.md.agents/skills/audit-code/SKILL.md.agents/skills/authoring-components/SKILL.md.agents/skills/authoring-documentation/SKILL.md.agents/skills/authoring-examples/SKILL.md.agents/skills/authoring-patterns/SKILL.md.agents/skills/authoring-tests/SKILL.md.agents/skills/authoring-typescript/SKILL.md.agents/skills/guidance-api-design/SKILL.md.agents/skills/guidance-build-system/SKILL.md.github/workflows/ci.yml
| for (const [file, rules] of Object.entries(data)) { | ||
| if (!rules || typeof rules !== 'object') continue; | ||
| for (const [rule, entry] of Object.entries(rules)) { | ||
| const count = entry?.count ?? 0; | ||
| if (count < 1) continue; | ||
| total += count; | ||
| candidates.push({ suppressionsFile, dir, file: path.resolve(dir, file), rule, count }); | ||
| } |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Reject suppression targets outside the repository root.
file comes from eslint-suppressions.json. Line 227 resolves it without a root-boundary check. A ../../ or absolute key can make the selector emit a target outside the checkout and direct the upkeep agent to modify it.
Fail closed when path.relative(root, resolvedFile) escapes root.
Proposed fix
for (const [rule, entry] of Object.entries(rules)) {
const count = entry?.count ?? 0;
if (count < 1) continue;
+ const resolvedFile = path.resolve(dir, file);
+ const relativeFile = path.relative(root, resolvedFile);
+ if (
+ relativeFile === '..' ||
+ relativeFile.startsWith(`..${path.sep}`) ||
+ path.isAbsolute(relativeFile)
+ ) {
+ fail(`suppression target escapes repository root: ${file}`);
+ }
total += count;
- candidates.push({ suppressionsFile, dir, file: path.resolve(dir, file), rule, count });
+ candidates.push({ suppressionsFile, dir, file: resolvedFile, rule, count });
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| for (const [file, rules] of Object.entries(data)) { | |
| if (!rules || typeof rules !== 'object') continue; | |
| for (const [rule, entry] of Object.entries(rules)) { | |
| const count = entry?.count ?? 0; | |
| if (count < 1) continue; | |
| total += count; | |
| candidates.push({ suppressionsFile, dir, file: path.resolve(dir, file), rule, count }); | |
| } | |
| for (const [file, rules] of Object.entries(data)) { | |
| if (!rules || typeof rules !== 'object') continue; | |
| for (const [rule, entry] of Object.entries(rules)) { | |
| const count = entry?.count ?? 0; | |
| if (count < 1) continue; | |
| const resolvedFile = path.resolve(dir, file); | |
| const relativeFile = path.relative(root, resolvedFile); | |
| if ( | |
| relativeFile === '..' || | |
| relativeFile.startsWith(`..${path.sep}`) || | |
| path.isAbsolute(relativeFile) | |
| ) { | |
| fail(`suppression target escapes repository root: ${file}`); | |
| } | |
| total += count; | |
| candidates.push({ suppressionsFile, dir, file: resolvedFile, rule, count }); | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/agent-upkeep/scripts/select-task.js around lines 221 - 228,
Update the suppression candidate construction in the Object.entries(data) loop
to resolve each file and reject it when path.relative(root, resolvedFile)
indicates it escapes the repository root, including absolute or parent-traversal
keys. Only add candidates for root-contained paths; preserve the existing count
filtering and candidate fields for valid files.
| upkeep/<task>/<short-hyphenated-descriptor> | ||
| ``` | ||
|
|
||
| The `upkeep/` prefix is load-bearing. The next run lists unmerged `upkeep/*` branches on the remote to detect work in flight, so a branch named anything else defeats the one-at-a-time guardrail. The rest of the name is for humans; make it describe the target. |
There was a problem hiding this comment.
Should we soften the: "Branches must use topic/ prefix" guidance in the root AGENTS.md or clarify here this overrides it? I feel like the argument here implies that, but wonder if it should be explicit.
40f9f03 to
e2c17ad
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 18 out of 18 changed files in this pull request and generated no new comments.
Suppressed comments (4)
.agents/skills/agent-upkeep/SKILL.md:105
- This link references
/.agents/skills/typescript/SKILL.md, but that skill file does not exist after the skill rename work in this PR. Update the link to the current TypeScript skill so the guidance remains reachable.
Most rules that start in the off list address type safety, so mode B often requires TypeScript work. When the rule is one of the `no-unsafe-*` family, `no-non-null-assertion`, `no-unnecessary-type-assertion`, or `no-redundant-type-constituents`, read the [typescript skill](/.agents/skills/typescript/SKILL.md) first and prefer, in this order:
.agents/skills/agent-upkeep/SKILL.md:167
- This self-review step links to
/.agents/skills/code-review/SKILL.md, but the code review skill was renamed toaudit-codein this PR and the old path does not exist. Update the link so the referenced guidance is accessible.
Then self-review with the [code-review skill](/.agents/skills/code-review/SKILL.md) and fix anything it flags.
.agents/skills/agent-upkeep/SKILL.md:239
- These reference links still point at pre-rename skill paths (
testing,typescript,code-review,accessibility), which do not exist in this branch. Updating them avoids dead links and keeps the references aligned with the current skill names.
- [Testing](/.agents/skills/testing/SKILL.md)
- [TypeScript](/.agents/skills/typescript/SKILL.md)
- [Code Review](/.agents/skills/code-review/SKILL.md)
- [Accessibility](/.agents/skills/accessibility/SKILL.md)
.agents/skills/agent-upkeep/SKILL.md:53
- This link points to
/.agents/skills/testing/SKILL.md, but that skill file does not exist in this branch (skills have been renamed toauthoring-tests, etc.). The link will be dead for readers and for any tooling that expects the path to resolve.
This issue also appears in the following locations of the same file:
- line 105
- line 167
- line 236
- Read the [testing skill](/.agents/skills/testing/SKILL.md) and follow its guidance before writing any test.
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
.agents/skills/audit-accessibility/SKILL.md (1)
41-41: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winMake disabled-state coverage conditional.
Not every component supports disabled behavior. Require disabled-state coverage only when the component supports it. Require coverage for every supported status and size variant.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.agents/skills/audit-accessibility/SKILL.md at line 41, Update the accessibility audit requirements in the visual-variants testing guidance so disabled-state coverage is required only for components that support disabled behavior, while coverage remains mandatory for every supported status and size variant.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/skills/agent-upkeep/SKILL.md:
- Around line 157-163: Update the Mode A verification instructions to run lint
from every supplied packages[].workingDirectory after all changes, rather than
only from the target project directory. Run tests and type checks from the
project containing the hand-fixed source file, preserving the existing commands
and sequencing after the final change.
- Around line 79-88: Update the ESLint workflow instructions around the
selector-provided packages command to require a dry-run or equivalent inspection
of autofixes before applying --fix. Proceed only when all resulting changes fit
the one-file and diff-size constraints; otherwise restore the working tree and
skip that rule, preserving the existing suppressions workflow for permitted
fixes.
---
Duplicate comments:
In @.agents/skills/audit-accessibility/SKILL.md:
- Line 41: Update the accessibility audit requirements in the visual-variants
testing guidance so disabled-state coverage is required only for components that
support disabled behavior, while coverage remains mandatory for every supported
status and size variant.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 7b777e06-879d-4bf1-9315-4ee04f68b7b0
📒 Files selected for processing (18)
.agents/skills/agent-availability-report/SKILL.md.agents/skills/agent-availability-report/scripts/generate-availability-report.js.agents/skills/agent-debug-ci/SKILL.md.agents/skills/agent-upkeep/SKILL.md.agents/skills/agent-upkeep/scripts/select-task.js.agents/skills/audit-accessibility/SKILL.md.agents/skills/audit-ci/SKILL.md.agents/skills/audit-ci/references/optimization-playbook.md.agents/skills/audit-code/SKILL.md.agents/skills/authoring-components/SKILL.md.agents/skills/authoring-documentation/SKILL.md.agents/skills/authoring-examples/SKILL.md.agents/skills/authoring-patterns/SKILL.md.agents/skills/authoring-tests/SKILL.md.agents/skills/authoring-typescript/SKILL.md.agents/skills/guidance-api-design/SKILL.md.agents/skills/guidance-build-system/SKILL.md.github/workflows/ci.yml
| Before opening the pull request, from the target project directory: | ||
|
|
||
| ```shell | ||
| mise exec -- pnpm run lint | ||
| mise exec -- pnpm run test | ||
| mise exec -- pnpm run test:types | ||
| ``` |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Validate all Mode A package changes.
For Mode A, the selector emits projects/internals/eslint/src/configs/typescript.js as target. The verification commands therefore run in projects/internals. Step 79 can change lint results in every selector-provided package, and Step 87 can change a source file in another project.
Run lint in every supplied packages[].workingDirectory after the final change. Run tests and type checks in the project that contains the hand-fixed source file.
🧰 Tools
🪛 SkillSpector (2.5.1)
[warning] 53: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 105: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 167: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 236: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 237: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 238: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 239: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[error] 61: [P2] Hidden Instructions: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Remediation: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
(Prompt Injection (P2))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/agent-upkeep/SKILL.md around lines 157 - 163, Update the Mode
A verification instructions to run lint from every supplied
packages[].workingDirectory after all changes, rather than only from the target
project directory. Run tests and type checks from the project containing the
hand-fixed source file, preserving the existing commands and sequencing after
the final change.
Signed-off-by: Cory Rylan <crylan@nvidia.com>
e2c17ad to
63b397c
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 19 out of 19 changed files in this pull request and generated no new comments.
Suppressed comments (4)
.agents/skills/agent-upkeep/scripts/select-task.js:144
disabledRules()assumes the closing pattern\n },exists after the marker. If it doesn't,source.indexOf(...)returns-1and the slice can accidentally scan the rest of the file, changing selection behavior silently. Fail fast when the end-of-block sentinel cannot be found.
const start = source.indexOf(DISABLED_MARKER);
if (start === -1) fail(`marker comment "${DISABLED_MARKER}" not found in ${ESLINT_CONFIG}`);
const block = source.slice(start, source.indexOf('\n },', start));
const found = [...block.matchAll(/'([^']+)':\s*'off'/g)].map(m => m[1]);
.agents/skills/agent-upkeep/scripts/select-task.js:218
coverageCandidates()guardsm.linesbut then unconditionally readsm.branches.pct. If an entry is missingbranches(or it’s null), the selector will crash instead of falling through to the next task.
if (file === 'total' || !m.lines) continue;
const uncovered = m.lines.total - m.lines.covered;
const below = m.lines.pct < GUARDRAILS.coverageThreshold || m.branches.pct < GUARDRAILS.coverageThreshold;
if (!below || uncovered < 1 || uncovered > GUARDRAILS.maxUncoveredLines) continue;
candidates.push({ project, file, uncovered, lines: m.lines.pct, branches: m.branches.pct });
.agents/skills/agent-upkeep/scripts/select-task.js:326
- When
--task=is provided with an unexpected value, the script currently falls through and fails with a generic "no eligible task found" message. Validating the forced task up-front makes failures more actionable and avoids confusion during manual runs.
const day = Math.floor((Date.now() - Date.UTC(new Date().getUTCFullYear(), 0, 0)) / 86400000);
const offset = day % TASK_ROTATION.length;
const rotated = forcedTask ? [forcedTask] : [...TASK_ROTATION.slice(offset), ...TASK_ROTATION.slice(0, offset)];
.github/workflows/ci.yml:10
- The new nightly schedule is annotated as "11:07 PM America/Chicago", but scheduled workflows are typically evaluated in UTC (see
.github/workflows/stale.ymlwhich uses onlycron). Iftimezone:is ignored or not supported by Actions, this will actually run at 23:07 UTC, not 23:07 Central. Consider removingtimezone:and either (a) documenting the UTC time accurately or (b) adjusting the cron to the intended UTC offset (noting DST tradeoffs).
schedule:
- cron: '7 23 * * *' # 11:07 PM America/Chicago
timezone: America/Chicago
There was a problem hiding this comment.
Actionable comments posted: 4
♻️ Duplicate comments (2)
.agents/skills/agent-debug-ci/SKILL.md (2)
93-94: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winFetch
origin/mainbefore using it as the baseline.The skill requires the current
origin/main, but it does not refresh the remote-tracking branch. A stale reference can cause verification against old code and produce an incorrect fix. Fetchorigin/mainbefore verifying the failure or creating the fix branch.Proposed fix
+Before this step, run `git fetch --prune origin main`. + 1. Base the fix on current `origin/main`; first verify that the failure still exists there.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.agents/skills/agent-debug-ci/SKILL.md around lines 93 - 94, Update the baseline workflow in the skill instructions to fetch the latest origin/main before verifying the failure or creating the fix branch. Preserve the requirement to verify the failure against current origin/main after refreshing the remote-tracking reference.
33-36: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winPass the resolved attempt to both
gh run viewcommands.Line 17 resolves
attempt, but Lines 34-36 omit--attempt <attempt>. After a rerun, the agent can inspect a different attempt than the triggering event. Add the attempt selector to the metadata and failed-log commands. GitHub CLI documents--attemptas the workflow-run attempt selector. (cli.github.com)Proposed fix
gh run view <run-id> \ + --attempt <attempt> \ --json databaseId,attempt,event,headBranch,headSha,status,conclusion,url,workflowName,jobs -gh run view <run-id> --log-failed +gh run view <run-id> --attempt <attempt> --log-failed🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.agents/skills/agent-debug-ci/SKILL.md around lines 33 - 36, Update both `gh run view` commands in the CI debugging instructions to include the resolved `--attempt <attempt>` selector, ensuring metadata and failed logs are retrieved from the triggering workflow-run attempt.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/skills/agent-debug-ci/SKILL.md:
- Around line 26-27: Update the ci:reset procedure in the agent-debug-ci
instructions to run git clean -ndX before cleanup, review every listed ignored
path, and confirm each is disposable. Preserve unrelated ignored work by using
targeted cleanup rather than blindly invoking the clean step, while retaining
the existing worktree-status check.
In @.agents/skills/agent-upkeep/scripts/select-task.js:
- Around line 115-120: Update the ref-enumeration error handling in the
task-selection flow around git and refs so a failed git for-each-ref call exits
with a non-zero result instead of returning an empty branch list. Ensure
selection stops immediately and cannot proceed when remote upkeep branches
cannot be listed.
In @.agents/skills/agent-upkeep/SKILL.md:
- Around line 56-61: Update the upkeep workflow instructions to require
rerunning `mise exec -- pnpm run test:coverage` after editing tests, so
`coverage-summary.json` reflects the changes. In the completion guidance,
require comparing the refreshed coverage with the recorded baseline before
declaring the task complete.
In @.agents/skills/audit-code/SKILL.md:
- Around line 26-28: Update the guideline map in the audit skill documentation
to include Markdown files, mapping *.md changes to the authoring-documentation
SKILL.md guidance so Vale and project terminology rules are applied.
---
Duplicate comments:
In @.agents/skills/agent-debug-ci/SKILL.md:
- Around line 93-94: Update the baseline workflow in the skill instructions to
fetch the latest origin/main before verifying the failure or creating the fix
branch. Preserve the requirement to verify the failure against current
origin/main after refreshing the remote-tracking reference.
- Around line 33-36: Update both `gh run view` commands in the CI debugging
instructions to include the resolved `--attempt <attempt>` selector, ensuring
metadata and failed logs are retrieved from the triggering workflow-run attempt.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: d88f8df3-3055-4d15-8e26-86dc92daf3f0
📒 Files selected for processing (19)
.agents/skills/agent-availability-report/SKILL.md.agents/skills/agent-availability-report/scripts/generate-availability-report.js.agents/skills/agent-debug-ci/SKILL.md.agents/skills/agent-upkeep/SKILL.md.agents/skills/agent-upkeep/scripts/select-task.js.agents/skills/audit-accessibility/SKILL.md.agents/skills/audit-ci/SKILL.md.agents/skills/audit-ci/references/optimization-playbook.md.agents/skills/audit-code/SKILL.md.agents/skills/authoring-components/SKILL.md.agents/skills/authoring-documentation/SKILL.md.agents/skills/authoring-examples/SKILL.md.agents/skills/authoring-patterns/SKILL.md.agents/skills/authoring-tests/SKILL.md.agents/skills/authoring-typescript/SKILL.md.agents/skills/guidance-api-design/SKILL.md.agents/skills/guidance-build-system/SKILL.md.github/workflows/ci.ymlAGENTS.md
| 4. Run `git status --short --branch` before changing branches or files. Preserve | ||
| unrelated worktree changes and never reset them. |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- relevant files ---'
git ls-files .agents/skills/agent-debug-ci/SKILL.md package.json
printf '%s\n' '--- SKILL.md excerpt ---'
nl -ba .agents/skills/agent-debug-ci/SKILL.md | sed -n '1,110p'
printf '%s\n' '--- package.json scripts excerpt ---'
nl -ba package.json | sed -n '1,45p'
printf '%s\n' '--- ci:reset references ---'
rg -n -C 3 'ci:reset|git clean|status --short' --glob '!node_modules' .
printf '%s\n' '--- git clean dry-run output ---'
git clean -ndXRepository: NVIDIA/elements
Length of output: 7973
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- SKILL.md lines 1-100 ---'
sed -n '1,100p' .agents/skills/agent-debug-ci/SKILL.md | cat -n
printf '%s\n' '--- package.json lines 15-30 ---'
sed -n '15,30p' package.json | cat -n
printf '%s\n' '--- nearby references around lines 80-90 ---'
sed -n '75,92p' .agents/skills/agent-debug-ci/SKILL.md | cat -n
printf '%s\n' '--- ignore rules relevant to dry-run paths ---'
git check-ignore -v .codex/agents .wireit node_modules projects/monaco/src/vendor projects/themes/dist 2>/dev/null || trueRepository: NVIDIA/elements
Length of output: 7495
Protect unrelated ignored files before ci:reset.
ci:reset invokes git clean -dfX through clean, and git status --short --branch does not list ignored paths. Before running ci:reset, execute git clean -ndX and confirm that every listed path is disposable. Preserve unrelated ignored work with targeted cleanup.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/agent-debug-ci/SKILL.md around lines 26 - 27, Update the
ci:reset procedure in the agent-debug-ci instructions to run git clean -ndX
before cleanup, review every listed ignored path, and confirm each is
disposable. Preserve unrelated ignored work by using targeted cleanup rather
than blindly invoking the clean step, while retaining the existing
worktree-status check.
| let refs = ''; | ||
| try { | ||
| refs = await git(['for-each-ref', '--format=%(refname:short) %(objectname)', 'refs/remotes/origin/upkeep/']); | ||
| } catch { | ||
| return []; | ||
| } |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Fail closed when remote upkeep branches cannot be listed.
A git for-each-ref failure returns []. The selector then treats the remote as having no upkeep/* branches and can start concurrent upkeep work.
If ref enumeration fails, stop with a non-zero result. Do not continue task selection.
Proposed fix
- let refs = '';
+ let refs;
try {
refs = await git(['for-each-ref', '--format=%(refname:short) %(objectname)', 'refs/remotes/origin/upkeep/']);
} catch {
- return [];
+ fail('could not verify whether an upkeep branch already exists on the remote');
}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/agent-upkeep/scripts/select-task.js around lines 115 - 120,
Update the ref-enumeration error handling in the task-selection flow around git
and refs so a failed git for-each-ref call exits with a non-zero result instead
of returning an empty branch list. Ensure selection stops immediately and cannot
proceed when remote upkeep branches cannot be listed.
| - Regenerate the selected project's coverage before editing to record the baseline: `cd <project> && mise exec -- pnpm run test:coverage`. | ||
| - The script picks the file with the smallest number of uncovered lines, because that yields the smallest pull request. Trust it. | ||
| - Add tests to the existing `*.test.ts` beside the source file. Do not create a new test file unless none exists. | ||
| - Cover real behavior through the public component surface. Do not test private fields, do not call `#private` methods reflectively, and do not add tests that only exist to move the number. | ||
| - If the uncovered lines are unreachable or defensive, the correct change may be to delete the dead branch rather than test it. Prefer deletion when the branch is genuinely unreachable, and say so in the pull request body. | ||
| - **Done when**: the target file's line and branch coverage both increase, no other file's coverage decreases, and `pnpm run test` passes. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Regenerate coverage after editing the test.
The baseline command writes coverage-summary.json before the test change. The edited test then makes that report stale. coverageIsFresh() rejects the project on the next selection run.
Run mise exec -- pnpm run test:coverage after the change. Compare the new result with the baseline before declaring the task complete.
Proposed fix
- Add tests to the existing `*.test.ts` beside the source file. Do not create a new test file unless none exists.
+- After editing, run `mise exec -- pnpm run test:coverage` again. Compare the result with the baseline and keep the refreshed report for the next selection run.
- Cover real behavior through the public component surface. Do not test private fields, do not call `#private` methods reflectively, and do not add tests that only exist to move the number.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - Regenerate the selected project's coverage before editing to record the baseline: `cd <project> && mise exec -- pnpm run test:coverage`. | |
| - The script picks the file with the smallest number of uncovered lines, because that yields the smallest pull request. Trust it. | |
| - Add tests to the existing `*.test.ts` beside the source file. Do not create a new test file unless none exists. | |
| - Cover real behavior through the public component surface. Do not test private fields, do not call `#private` methods reflectively, and do not add tests that only exist to move the number. | |
| - If the uncovered lines are unreachable or defensive, the correct change may be to delete the dead branch rather than test it. Prefer deletion when the branch is genuinely unreachable, and say so in the pull request body. | |
| - **Done when**: the target file's line and branch coverage both increase, no other file's coverage decreases, and `pnpm run test` passes. | |
| - Regenerate the selected project's coverage before editing to record the baseline: `cd <project> && mise exec -- pnpm run test:coverage`. | |
| - The script picks the file with the smallest number of uncovered lines, because that yields the smallest pull request. Trust it. | |
| - Add tests to the existing `*.test.ts` beside the source file. Do not create a new test file unless none exists. | |
| - After editing, run `mise exec -- pnpm run test:coverage` again. Compare the result with the baseline and keep the refreshed report for the next selection run. | |
| - Cover real behavior through the public component surface. Do not test private fields, do not call `#private` methods reflectively, and do not add tests that only exist to move the number. | |
| - If the uncovered lines are unreachable or defensive, the correct change may be to delete the dead branch rather than test it. Prefer deletion when the branch is genuinely unreachable, and say so in the pull request body. | |
| - **Done when**: the target file's line and branch coverage both increase, no other file's coverage decreases, and `pnpm run test` passes. |
🧰 Tools
🪛 SkillSpector (2.5.1)
[warning] 55: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 115: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 184: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 253: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 254: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 255: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 256: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[error] 63: [P2] Hidden Instructions: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Remediation: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
(Prompt Injection (P2))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/agent-upkeep/SKILL.md around lines 56 - 61, Update the upkeep
workflow instructions to require rerunning `mise exec -- pnpm run test:coverage`
after editing tests, so `coverage-summary.json` reflects the changes. In the
completion guidance, require comparing the refreshed coverage with the recorded
baseline before declaring the task complete.
| ## Guideline Context | ||
|
|
||
| Review the relevant guideline for the files being changed (not all guidelines). Match by file type: | ||
| Review the relevant guideline for each changed file type (not all guidelines): |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Add Markdown to the guideline map.
The new instruction requires guidance for each changed file type, but the map omits *.md. Add an entry for .agents/skills/authoring-documentation/SKILL.md so reviewers apply the Vale and terminology rules to Markdown changes.
Proposed addition
Review the relevant guideline for each changed file type (not all guidelines):
+- `*.md` → read `.agents/skills/authoring-documentation/SKILL.md`As per coding guidelines, technical Markdown documentation must follow the repository's Vale configuration and project-specific terminology rules.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ## Guideline Context | |
| Review the relevant guideline for the files being changed (not all guidelines). Match by file type: | |
| Review the relevant guideline for each changed file type (not all guidelines): | |
| ## Guideline Context | |
| Review the relevant guideline for each changed file type (not all guidelines): | |
| - `*.md` → read `.agents/skills/authoring-documentation/SKILL.md` |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/audit-code/SKILL.md around lines 26 - 28, Update the
guideline map in the audit skill documentation to include Markdown files,
mapping *.md changes to the authoring-documentation SKILL.md guidance so Vale
and project terminology rules are applied.
Source: Coding guidelines
Summary by CodeRabbit
New Features
Improvements