{
  "markdown": "# Gomboc ORL Community Skills\n\nA Claude Code plugin for scanning, fixing, and creating ORL (Open Remediation Language) rules across Infrastructure as Code, containers, orchestration, and application code. Supports Terraform, HCL/Terragrunt, CloudFormation (YAML + JSON), Bicep, Dockerfile, Kubernetes, and Python.\n\n**Contributor guide:** see [AGENT_DEV.md](./AGENT_DEV.md) for the `gomboc_community_*` skill architecture (flow / task / cap / know), registration, and maintenance conventions.\n\n## Prerequisites\n\n- [Claude Code](https://claude.com/claude-code) CLI installed\n- [Docker](https://docs.docker.com/get-docker/) installed and running\n- ORL Docker image: `docker pull gombocai/orl` ([Docker Hub](https://hub.docker.com/r/gombocai/orl))\n- A Gomboc Personal Access Token (PAT) for pushing rules (optional)\n\n## ORL via Docker\n\nAll ORL commands run via the `gombocai/orl` Docker image. The current directory is mounted into the container at `/workspace`:\n\n```bash\ndocker run -v \"${PWD}:/workspace\" gombocai/orl <command>\n```\n\nExamples:\n\n```bash\ndocker run -v \"${PWD}:/workspace\" gombocai/orl test .\ndocker run -v \"${PWD}:/workspace\" gombocai/orl walk workspace --language terraform ./workspace\ndocker run -v \"${PWD}:/workspace\" gombocai/orl remediate -d --language terraform -r . ./workspace\n```\n\nTo push rules, set `GOMBOC_PAT` and map it for `orl` (see `gomboc_community_know_orl_runtime_resolution`):\n\n```bash\ndocker run -v \"${PWD}:/workspace\" -e RULE_SERVICE_TOKEN=\"${GOMBOC_PAT}\" gombocai/orl rules push .\n```\n\n## Installation\n\n### From the marketplace\n\n```bash\nclaude plugin marketplace add Gomboc-AI/gomboc-community-skills\nclaude plugin install gomboc-community@gomboc-community-marketplace\n```\n\n### From local path\n\n```bash\nclaude plugin install /path/to/community-skills\n```\n\n## Commands\n\n### `/fix` — Scan and Fix Code\n\nScan source code for security anti-patterns and compliance gaps using the ORL classification policy corpus, then apply fixes — using existing rules or generating new ones on the fly. Optionally save fixes as reusable rules.\n\n```\n/gomboc-community:fix main.tf — check encryption\n/gomboc-community:fix ./infrastructure/ — security review\n/gomboc-community:fix Dockerfile\n/gomboc-community:fix k8s/ — least privilege\n/gomboc-community:fix src/api/ — prevent code injection\n/gomboc-community:fix . — CIS compliance check\n```\n\n**Workflow:** `gomboc_community_flow_fix` → diagnose → apply fixes → optionally enrich / release\n\n### `/create-rule` — Create a Rule from Scratch\n\nDefine a security or compliance policy and build a complete ORL rule package with tests.\n\n```\n/gomboc-community:create-rule Ensure all AWS S3 buckets have server-side encryption enabled using Terraform\n/gomboc-community:create-rule Ensure Dockerfiles use pinned image digests instead of mutable tags\n/gomboc-community:create-rule Ensure Kubernetes Deployments set runAsNonRoot in securityContext\n```\n\n**Workflow:** `gomboc_community_flow_create_rule` → plan → build → review → enrich → optionally release\n\n### `/convert-sentinel` — Convert Sentinel to ORL\n\nConvert a HashiCorp Sentinel policy into one or more tested ORL rules.\n\n**Workflow:** `gomboc_community_flow_convert_sentinel`\n\n### `/verify-mcp` — Verify Hosted Gomboc MCP\n\nConfirm the hosted Gomboc MCP server is configured and working (server ready + `get_channels` smoke call).\n\n```\n/gomboc-community:verify-mcp\n```\n\n**Skill:** `gomboc_community_know_gomboc_mcp` — setup, prefer-MCP vs Docker/`orl` fallback, soft capability map.\n\n## Skills\n\nSkills use the layered `gomboc_community_*` naming (flow / task / cap / know). See [AGENT_DEV.md](./AGENT_DEV.md).\n\n### Flows\n\n| Skill | Description |\n|-------|-------------|\n| `gomboc_community_flow_fix` | `/fix` orchestrator — diagnose → apply → optional save |\n| `gomboc_community_flow_create_rule` | `/create-rule` orchestrator — plan → build → review → enrich → release |\n| `gomboc_community_flow_diagnose` | Classification-driven analyzer and rule-coverage report |\n| `gomboc_community_flow_apply_fix` | Apply via existing rule or generate a new one |\n| `gomboc_community_flow_build_rule` | Create workspace, write ORL rule, test |\n| `gomboc_community_flow_review_rule` | Pre-release compliance fix and report |\n| `gomboc_community_flow_convert_sentinel` | Sentinel → ORL conversion pipeline |\n\n### Tasks\n\n| Skill | Description |\n|-------|-------------|\n| `gomboc_community_task_orl_planner` | Plan requirements, remediability, and test cases |\n| `gomboc_community_task_enrich_rule` | Add community metadata for publishing |\n| `gomboc_community_task_release_rule` | Validate and push to the Rules Service |\n| `gomboc_community_task_resolve_existing_rules` | Local-first → cache → MCP lookup → `orl rules pull` |\n| `gomboc_community_task_setup_rule_workspace` | Create package dirs and fixtures |\n| `gomboc_community_task_write_orl_rule` | Author `.orl` and `test.orl` |\n| `gomboc_community_task_run_orl_test_loop` | Test and iterate until pass |\n\n### Caps\n\n| Skill | Description |\n|-------|-------------|\n| `gomboc_community_cap_run_orl_test` | `orl test .` via Docker |\n| `gomboc_community_cap_orl_remediate` | `orl remediate` (dry-run default) |\n| `gomboc_community_cap_orl_walk` | `orl walk` AST explore |\n| `gomboc_community_cap_orl_rules_pull` | `orl rules pull` (`--search` / `--channel`) |\n| `gomboc_community_cap_orl_rules_push` | `orl rules push` |\n\n### Know\n\n| Skill | Description |\n|-------|-------------|\n| `gomboc_community_know_gomboc_mcp` | Hosted MCP setup, prefer-MCP vs Docker/`orl`, soft tool map |\n| `gomboc_community_know_orl_runtime_resolution` | Docker `gombocai/orl` invocation |\n| `gomboc_community_know_language_guidance` | Per-language authoring notes |\n| `gomboc_community_know_sentinel_conversion` | Sentinel vs ORL paradigm |\n| `gomboc_community_know_release_checklist` | Release-readiness criteria |\n\n## Supported Languages\n\n| Language | ORL Language ID | Use Case |\n|----------|----------------|----------|\n| Terraform | `terraform` | AWS, Azure, GCP infrastructure |\n| HCL | `hcl` | Terragrunt, Packer, Consul, Vault configs |\n| CloudFormation YAML | `cloudformation-yaml` | AWS infrastructure (YAML format) |\n| CloudFormation JSON | `cloudformation-json` | AWS infrastructure (JSON format) |\n| Bicep | `bicep` | Azure infrastructure |\n| Dockerfile | `docker` | Container image definitions |\n| Kubernetes | `kubernetes` | K8s manifests (Deployments, Pods, Services, etc.) |\n| Python | `python` | Application code, AWS CDK, Pulumi, SDK usage |\n\n## Classification-Driven Analysis\n\nThe `/fix` command uses the ORL classification policy corpus (`/orl-rules/final/classifications/policies/`) as its knowledge base. Each classification YAML defines:\n\n- What security or compliance policy to enforce\n- Which languages and resource types it applies to\n- Impact and risk scores for prioritization\n- Compliance framework mappings (CIS, NIST CSF, PCI-DSS, AWS Well-Architected, etc.)\n\nAdding new classification YAMLs automatically extends what `/fix` can detect — no plugin changes needed.\n\n## Publishing Rules\n\nTo push rules to your Gomboc Community Edition account:\n\n1. Set your Personal Access Token: `export GOMBOC_PAT=your-pat-here`\n2. Run `/gomboc-community:create-rule` (or release after `/fix` save) so **`gomboc_community_task_release_rule`** runs\n\n## Rule Package Structure\n\nEach rule is a self-contained directory:\n\n```\nmy-rule/\n├── my-rule.orl            # Main rule file\n├── test.orl               # Test definition\n├── workspace/             # Source files with violations\n└── workspace_expected/    # Source files after remediation\n```\n\n## License\n\nMIT\n",
  "bytes": 7602,
  "sha": "1ce72ac329590e80fbea6d88d27fab07c6e31da6694415ddb926482a7fb127a6",
  "repo_slug": "gomboc-ai/gomboc-community-skills",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_gomboc_ai_gomboc_community_skills_2f7cfc8b/readme"
}