chore: sync app-skills - #28
Open
oomol-bot wants to merge 1 commit into
Open
Conversation
Contributor
Summary by CodeRabbit
WalkthroughAdded standardized Possibly related PRs
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 9
🧹 Nitpick comments (1)
app-skills/oo-sorftime/SKILL.md (1)
39-67: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winAdd confirmation for credit-consuming actions.
The action catalog states that several untagged reads consume 1, 2, 5, or 10 Sorftime requests. The safety section still says untagged actions are safe to run directly. Require confirmation for high-cost actions, or state clearly that these reads spend the user's Sorftime credits.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@app-skills/oo-sorftime/SKILL.md` around lines 39 - 67, Update the Safety section and action catalog guidance to explicitly acknowledge that untagged read actions may consume Sorftime credits. Require user confirmation before running credit-consuming reads, with confirmation covering the expected request cost, while keeping non-consuming reads such as get_request_usage safe to run directly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@app-skills/oo-aerisweather/SKILL.md`:
- Around line 29-32: Replace the inline single-quoted JSON payload example with
the documented shell-safe `@path/to/file.json` transport, or add explicit
safe-quoting guidance that prevents shell interpretation. Apply this change at
app-skills/oo-aerisweather/SKILL.md:29-32, app-skills/oo-amilia/SKILL.md:29-32,
app-skills/oo-appcircle/SKILL.md:29-32,
app-skills/oo-castingwords/SKILL.md:29-32,
app-skills/oo-monica-crm/SKILL.md:29-32, app-skills/oo-mx/SKILL.md:29-32,
app-skills/oo-passcreator/SKILL.md:29-32,
app-skills/oo-productlane/SKILL.md:29-32, app-skills/oo-quintadb/SKILL.md:29-32,
and app-skills/oo-reversecontact/SKILL.md:29-32.
- Line 18: The shared setup fallback condition must also recognize CLI-not-found
failures. Update the instruction at app-skills/oo-aerisweather/SKILL.md:18-18
and the corresponding instructions at app-skills/oo-amilia/SKILL.md:18-18,
app-skills/oo-appcircle/SKILL.md:18-18,
app-skills/oo-castingwords/SKILL.md:18-18,
app-skills/oo-monica-crm/SKILL.md:18-18, app-skills/oo-mx/SKILL.md:18-18,
app-skills/oo-passcreator/SKILL.md:18-18,
app-skills/oo-productlane/SKILL.md:18-18, app-skills/oo-quintadb/SKILL.md:18-18,
and app-skills/oo-reversecontact/SKILL.md:18-18 to include “oo: command not
found” alongside auth or connection errors, while preserving the existing setup
guidance.
In `@app-skills/oo-govee/SKILL.md`:
- Line 39: Mark the source definitions for control_capability,
attach_project_document, detach_project_document, restore_user, and
resend_subscriber_confirmation with the appropriate write or side-effect
confirmation metadata, using [write] where specified and the supported marker
for the Mailcoach action. Regenerate the generated skill files so
app-skills/oo-govee/SKILL.md:39, app-skills/oo-faktoora/SKILL.md:39-42,
app-skills/oo-instabot/SKILL.md:44, and app-skills/oo-mailcoach/SKILL.md:47
reflect the updated metadata.
In `@app-skills/oo-home-assistant/SKILL.md`:
- Line 41: Mark the mutating execute_script catalog entry in
app-skills/oo-home-assistant/SKILL.md at lines 41-41 with [write]. In
app-skills/oo-minimax/SKILL.md at lines 41-47, mark download_video,
image_to_video, and text_to_video with [write], while leaving
query_video_generation untagged.
In `@app-skills/oo-jumpseller/SKILL.md`:
- Line 44: Remove the [write] annotation from the get_order tool definition so
it is classified as read-only, then regenerate SKILL.md to reflect the updated
source metadata.
In `@app-skills/oo-monica-crm/SKILL.md`:
- Line 45: Update the update_note action classification in SKILL.md from [write]
to [destructive], reflecting that replacing a Monica note by ID can overwrite
existing content.
In `@app-skills/oo-more-trees/SKILL.md`:
- Line 42: Update the plant_trees entry in the skill metadata to include the
[write] tag, while preserving its existing description and behavior details.
In `@app-skills/oo-sif/SKILL.md`:
- Around line 41-56: Correct the safety rules across all affected catalogs: in
app-skills/oo-sif/SKILL.md lines 41-56, require user confirmation before running
any listed action that consumes Sif points; in
app-skills/oo-zip-archive-api/SKILL.md lines 39-46, classify compress_files as a
non-read operation and apply the appropriate confirmation requirement; in
app-skills/oo-zylvie/SKILL.md lines 45-56, tag redeem_license_key and
refund_license_key with [write] so the existing write-confirmation rule applies.
In `@app-skills/oo-zip-archive-api/SKILL.md`:
- Around line 39-46: Update the compress_files action documentation to classify
archive creation as a write operation, using the existing [write] marker or an
equivalent explicit confirmation rule. Ensure the Safety section requires
confirming the exact payload and effect before running compress_files, while
preserving the existing extract_archive guidance.
---
Nitpick comments:
In `@app-skills/oo-sorftime/SKILL.md`:
- Around line 39-67: Update the Safety section and action catalog guidance to
explicitly acknowledge that untagged read actions may consume Sorftime credits.
Require user confirmation before running credit-consuming reads, with
confirmation covering the expected request cost, while keeping non-consuming
reads such as get_request_usage safe to run directly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 029285e3-7683-48c1-b3fa-26ad3c043280
📒 Files selected for processing (46)
app-skills/oo-aerisweather/SKILL.mdapp-skills/oo-amilia/SKILL.mdapp-skills/oo-appcircle/SKILL.mdapp-skills/oo-castingwords/SKILL.mdapp-skills/oo-chat-api-for-whatsapp/SKILL.mdapp-skills/oo-cisco-meraki/SKILL.mdapp-skills/oo-clickhelp/SKILL.mdapp-skills/oo-cloudflare-mcp/SKILL.mdapp-skills/oo-dialmycalls/SKILL.mdapp-skills/oo-doppler-marketing-automation/SKILL.mdapp-skills/oo-drimify/SKILL.mdapp-skills/oo-elasticemail/SKILL.mdapp-skills/oo-eversign/SKILL.mdapp-skills/oo-faktoora/SKILL.mdapp-skills/oo-github/SKILL.mdapp-skills/oo-govee/SKILL.mdapp-skills/oo-helium10/SKILL.mdapp-skills/oo-helpdesk/SKILL.mdapp-skills/oo-home-assistant/SKILL.mdapp-skills/oo-insites/SKILL.mdapp-skills/oo-instabot/SKILL.mdapp-skills/oo-jumpseller/SKILL.mdapp-skills/oo-kadoa/SKILL.mdapp-skills/oo-krispcall/SKILL.mdapp-skills/oo-leadboxer/SKILL.mdapp-skills/oo-leadiq/SKILL.mdapp-skills/oo-line/SKILL.mdapp-skills/oo-mailcoach/SKILL.mdapp-skills/oo-mailsoftly/SKILL.mdapp-skills/oo-minimax/SKILL.mdapp-skills/oo-monica-crm/SKILL.mdapp-skills/oo-more-trees/SKILL.mdapp-skills/oo-mx-toolbox/SKILL.mdapp-skills/oo-mx/SKILL.mdapp-skills/oo-passcreator/SKILL.mdapp-skills/oo-payrexx/SKILL.mdapp-skills/oo-productlane/SKILL.mdapp-skills/oo-quintadb/SKILL.mdapp-skills/oo-reversecontact/SKILL.mdapp-skills/oo-sif/SKILL.mdapp-skills/oo-sorftime/SKILL.mdapp-skills/oo-splunk-http-event-collector/SKILL.mdapp-skills/oo-the-official-board/SKILL.mdapp-skills/oo-vida/SKILL.mdapp-skills/oo-zip-archive-api/SKILL.mdapp-skills/oo-zylvie/SKILL.md
Comment on lines
+29
to
+32
| oo connector run "aerisweather" --action "<action_name>" --data '<json>' --json | ||
| ``` | ||
|
|
||
| - `--data` takes a JSON object string or `@path/to/file.json`; omit it to send `{}`. |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Prevent shell interpretation of connector payloads.
The shared example interpolates JSON inside single quotes. Any payload string containing ' can terminate the argument. User-controlled values can then break command execution or inject shell syntax. Prefer the documented @path/to/file.json form, or add explicit shell-safe quoting instructions.
app-skills/oo-aerisweather/SKILL.md#L29-L32: use a shell-safe payload transport.app-skills/oo-amilia/SKILL.md#L29-L32: use a shell-safe payload transport.app-skills/oo-appcircle/SKILL.md#L29-L32: use a shell-safe payload transport.app-skills/oo-castingwords/SKILL.md#L29-L32: use a shell-safe payload transport.app-skills/oo-monica-crm/SKILL.md#L29-L32: use a shell-safe payload transport.app-skills/oo-mx/SKILL.md#L29-L32: use a shell-safe payload transport.app-skills/oo-passcreator/SKILL.md#L29-L32: use a shell-safe payload transport.app-skills/oo-productlane/SKILL.md#L29-L32: use a shell-safe payload transport.app-skills/oo-quintadb/SKILL.md#L29-L32: use a shell-safe payload transport.app-skills/oo-reversecontact/SKILL.md#L29-L32: use a shell-safe payload transport.
Safer command example
-oo connector run "aerisweather" --action "<action_name>" --data '<json>' --json
+oo connector run "aerisweather" --action "<action_name>" --data `@path/to/file.json` --json📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| oo connector run "aerisweather" --action "<action_name>" --data '<json>' --json | |
| ``` | |
| - `--data` takes a JSON object string or `@path/to/file.json`; omit it to send `{}`. | |
| oo connector run "aerisweather" --action "<action_name>" --data `@path/to/file.json` --json |
📍 Affects 10 files
app-skills/oo-aerisweather/SKILL.md#L29-L32(this comment)app-skills/oo-amilia/SKILL.md#L29-L32app-skills/oo-appcircle/SKILL.md#L29-L32app-skills/oo-castingwords/SKILL.md#L29-L32app-skills/oo-monica-crm/SKILL.md#L29-L32app-skills/oo-mx/SKILL.md#L29-L32app-skills/oo-passcreator/SKILL.md#L29-L32app-skills/oo-productlane/SKILL.md#L29-L32app-skills/oo-quintadb/SKILL.md#L29-L32app-skills/oo-reversecontact/SKILL.md#L29-L32
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@app-skills/oo-aerisweather/SKILL.md` around lines 29 - 32, Replace the inline
single-quoted JSON payload example with the documented shell-safe
`@path/to/file.json` transport, or add explicit safe-quoting guidance that
prevents shell interpretation. Apply this change at
app-skills/oo-aerisweather/SKILL.md:29-32, app-skills/oo-amilia/SKILL.md:29-32,
app-skills/oo-appcircle/SKILL.md:29-32,
app-skills/oo-castingwords/SKILL.md:29-32,
app-skills/oo-monica-crm/SKILL.md:29-32, app-skills/oo-mx/SKILL.md:29-32,
app-skills/oo-passcreator/SKILL.md:29-32,
app-skills/oo-productlane/SKILL.md:29-32, app-skills/oo-quintadb/SKILL.md:29-32,
and app-skills/oo-reversecontact/SKILL.md:29-32.
|
|
||
| ## Available actions | ||
|
|
||
| - `control_capability` — Send one documented Govee capability value to a device, such as power, brightness, color, mode, or temperature. |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Align action safety metadata with actual side effects.
These actions are not safe reads, but their current metadata allows direct execution without confirmation.
app-skills/oo-govee/SKILL.md#L39-L39: add[write]tocontrol_capability.app-skills/oo-faktoora/SKILL.md#L39-L42: add[write]toattach_project_documentanddetach_project_document.app-skills/oo-instabot/SKILL.md#L44-L44: add[write]torestore_user.app-skills/oo-mailcoach/SKILL.md#L47-L47: add the supported write or side-effect confirmation marker toresend_subscriber_confirmation.
Update the source definitions and regenerate the generated skill files.
📍 Affects 4 files
app-skills/oo-govee/SKILL.md#L39-L39(this comment)app-skills/oo-faktoora/SKILL.md#L39-L42app-skills/oo-instabot/SKILL.md#L44-L44app-skills/oo-mailcoach/SKILL.md#L47-L47
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@app-skills/oo-govee/SKILL.md` at line 39, Mark the source definitions for
control_capability, attach_project_document, detach_project_document,
restore_user, and resend_subscriber_confirmation with the appropriate write or
side-effect confirmation metadata, using [write] where specified and the
supported marker for the Mailcoach action. Regenerate the generated skill files
so app-skills/oo-govee/SKILL.md:39, app-skills/oo-faktoora/SKILL.md:39-42,
app-skills/oo-instabot/SKILL.md:44, and app-skills/oo-mailcoach/SKILL.md:47
reflect the updated metadata.
| ## Available actions | ||
|
|
||
| - `call_service` — Call a Home Assistant service to control entities, such as light.turn_on or switch.turn_off. | ||
| - `execute_script` — Run a Home Assistant script sequence containing service calls, delays, and conditions. |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Mark all state-changing actions with [write].
Both catalogs add mutating actions without the marker required by their safety sections. Untagged actions can then run without confirmation.
app-skills/oo-home-assistant/SKILL.md#L41-L41: markexecute_scriptas[write].app-skills/oo-minimax/SKILL.md#L41-L47: markdownload_video,image_to_video, andtext_to_videoas[write]; keepquery_video_generationuntagged.
📍 Affects 2 files
app-skills/oo-home-assistant/SKILL.md#L41-L41(this comment)app-skills/oo-minimax/SKILL.md#L41-L47
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@app-skills/oo-home-assistant/SKILL.md` at line 41, Mark the mutating
execute_script catalog entry in app-skills/oo-home-assistant/SKILL.md at lines
41-41 with [write]. In app-skills/oo-minimax/SKILL.md at lines 41-47, mark
download_video, image_to_video, and text_to_video with [write], while leaving
query_video_generation untagged.
| - `create_product` — Create a product in Jumpseller. [write] | ||
| - `get_category` — Retrieve a single category from Jumpseller. | ||
| - `get_customer` — Retrieve a single customer from Jumpseller. | ||
| - `get_order` — Retrieve a single order from Jumpseller. [write] |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Remove the [write] tag from get_order.
get_order only retrieves an order. The current tag makes the safety rules require confirmation for a read action. Remove [write] in the source definition and regenerate this file.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@app-skills/oo-jumpseller/SKILL.md` at line 44, Remove the [write] annotation
from the get_order tool definition so it is classified as read-only, then
regenerate SKILL.md to reflect the updated source metadata.
| - `get_note` — Get a Monica note by ID. | ||
| - `list_contacts` — List or search contacts in the authenticated Monica account. | ||
| - `list_notes` — List notes in the Monica account or for one contact. | ||
| - `update_note` — Replace a Monica note by ID. [write] |
Contributor
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Classify update_note as an overwrite operation.
The action is documented as replacing a note. That can overwrite existing content. Mark it [destructive], or verify that the connector performs a non-destructive merge instead.
Proposed tag change
-- `update_note` — Replace a Monica note by ID. [write]
+- `update_note` — Replace a Monica note by ID. [destructive]📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| - `update_note` — Replace a Monica note by ID. [write] | |
| - `update_note` — Replace a Monica note by ID. [destructive] |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@app-skills/oo-monica-crm/SKILL.md` at line 45, Update the update_note action
classification in SKILL.md from [write] to [destructive], reflecting that
replacing a Monica note by ID can overwrite existing content.
| - `get_account` — Get account identity, planting credit balance, and forest identifiers for the connected More Trees account. | ||
| - `get_forest` — Get More Trees forest branding and cumulative planting and carbon statistics. | ||
| - `list_projects` — List active More Trees planting projects and the tree species available within each project. | ||
| - `plant_trees` — Plant trees for the connected More Trees account or gift trees to recipients, with optional non-persistent test mode. |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Mark plant_trees as a write action.
plant_trees plants trees or gifts trees to recipients. It changes the connected account's state and may consume planting credits. Because the action is untagged, the Safety section classifies it as safe to run without confirmation. Add the [write] tag.
Proposed metadata fix
-- `plant_trees` — Plant trees for the connected More Trees account or gift trees to recipients, with optional non-persistent test mode.
+- `plant_trees` — Plant trees for the connected More Trees account or gift trees to recipients, with optional non-persistent test mode. [write]📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| - `plant_trees` — Plant trees for the connected More Trees account or gift trees to recipients, with optional non-persistent test mode. | |
| - `plant_trees` — Plant trees for the connected More Trees account or gift trees to recipients, with optional non-persistent test mode. [write] |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@app-skills/oo-more-trees/SKILL.md` at line 42, Update the plant_trees entry
in the skill metadata to include the [write] tag, while preserving its existing
description and behavior details.
Comment on lines
+41
to
+56
| - `market_discover_competitors` — Analyze and filter a keyword's Top-100 competitor pool by price, review threshold, sales, and competitive posture. Costs 3 Sif points. | ||
| - `market_get_asin_aba_footprint` — Reverse-map an ASIN to search terms where it occupies an ABA Top-3 position. Costs 2 Sif points. | ||
| - `market_get_asin_keyword_signals` — Analyze an ASIN's keyword traffic contribution, organic and paid dependence, rank stability, and health signals. Costs 3 Sif points. | ||
| - `market_get_asin_profile` — Get product-positioning profiles such as price, rating, reviews, BSR, brand, listing age, variants, and dimensions for up to 20 ASINs. Costs 2 Sif points per input ASIN. | ||
| - `market_get_keyword_competition` — Analyze a keyword's traffic-share leaders, ABA Top-3 concentration, market accessibility, and optional ASIN competitive position. Costs 2 Sif points. | ||
| - `market_get_keyword_demand` — Diagnose demand lifecycle and seasonal timing for up to 20 keywords. Costs 2 Sif points. | ||
| - `market_get_keyword_history` — Get raw historical ABA search volume, rank, and Top-3 click and conversion concentration for up to 10 keywords. Costs 1 Sif point. | ||
| - `market_get_keyword_root_competitors` — Discover the leading ASIN competitors across a keyword root using ABA buyer click behavior. Costs 2 Sif points. | ||
| - `market_get_keyword_root_trend` — Compare exact-keyword demand with aggregate keyword-root demand to assess market size and demand concentration. Costs 3 Sif points. | ||
| - `market_screen_keyword_opportunities` — Rank keyword-root variants by demand and click-concentration opportunity signals. Costs 3 Sif points. | ||
|
|
||
| ## Safety | ||
|
|
||
| - Untagged actions are reads (get / list / search) — safe to run directly. | ||
| - **Actions tagged `[write]` change Sif state — confirm the exact payload and effect with the user before running.** | ||
| - **Actions tagged `[destructive]` remove or overwrite data — always confirm the target and get explicit approval first.** |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Correct the safety classification for non-read actions.
The catalogs contain untagged actions that consume points, create artifacts, or mutate license state. The generic rule incorrectly permits these actions to run without confirmation.
app-skills/oo-sif/SKILL.md#L41-L56: require confirmation before running actions that consume Sif points.app-skills/oo-zip-archive-api/SKILL.md#L39-L46: classifycompress_filesas a non-read operation and apply the appropriate confirmation rule.app-skills/oo-zylvie/SKILL.md#L45-L56: add[write]toredeem_license_keyandrefund_license_key.
📍 Affects 3 files
app-skills/oo-sif/SKILL.md#L41-L56(this comment)app-skills/oo-zip-archive-api/SKILL.md#L39-L46app-skills/oo-zylvie/SKILL.md#L45-L56
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@app-skills/oo-sif/SKILL.md` around lines 41 - 56, Correct the safety rules
across all affected catalogs: in app-skills/oo-sif/SKILL.md lines 41-56, require
user confirmation before running any listed action that consumes Sif points; in
app-skills/oo-zip-archive-api/SKILL.md lines 39-46, classify compress_files as a
non-read operation and apply the appropriate confirmation requirement; in
app-skills/oo-zylvie/SKILL.md lines 45-56, tag redeem_license_key and
refund_license_key with [write] so the existing write-confirmation rule applies.
Comment on lines
+39
to
+46
| - `compress_files` — Compress one or more publicly accessible files into a ZIP archive and return a transit download URL. | ||
| - `extract_archive` — Extract a publicly accessible archive and return each extracted file through transit storage. [write] | ||
|
|
||
| ## Safety | ||
|
|
||
| - Untagged actions are reads (get / list / search) — safe to run directly. | ||
| - **Actions tagged `[write]` change Zip Archive API state — confirm the exact payload and effect with the user before running.** | ||
| - **Actions tagged `[destructive]` remove or overwrite data — always confirm the target and get explicit approval first.** |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Do not classify compress_files as a read.
compress_files creates a ZIP archive and returns a transit download URL, but it has no write marker while the safety section says that untagged actions are reads. Mark the action as a write, or add an explicit confirmation rule for archive creation.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@app-skills/oo-zip-archive-api/SKILL.md` around lines 39 - 46, Update the
compress_files action documentation to classify archive creation as a write
operation, using the existing [write] marker or an equivalent explicit
confirmation rule. Ensure the Safety section requires confirming the exact
payload and effect before running compress_files, while preserving the existing
extract_archive guidance.
oomol-bot
force-pushed
the
bot/sync-app-skills
branch
from
August 3, 2026 15:55
409e338 to
e76e43d
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@app-skills/oo-faktoora/SKILL.md`:
- Around line 40-46: Update the action descriptions for attach_project_document
and detach_project_document in the Faktoora skill so both include the [write]
safety tag, matching the existing create_project and update_project conventions
while leaving read and destructive classifications unchanged.
In `@app-skills/oo-gitea/SKILL.md`:
- Around line 69-70: Mark dismiss_pull_request_review and fork_repository in
app-skills/oo-gitea/SKILL.md lines 69-70, request_pull_request_reviewers in
app-skills/oo-gitea/SKILL.md line 117, control_capability in
app-skills/oo-govee/SKILL.md line 40, execute_script in
app-skills/oo-home-assistant/SKILL.md line 45, and
resend_subscriber_confirmation in app-skills/oo-mailcoach/SKILL.md line 48 with
the [write] marker. Update their source definitions and regenerate the generated
skill files.
In `@app-skills/oo-minimax/SKILL.md`:
- Line 45: Add the appropriate safety tags to the source action definitions and
regenerate the skills: mark image_to_video and text_to_video in
app-skills/oo-minimax/SKILL.md at lines 45-45 and 51-51 as [write], mark
forget_memory in app-skills/oo-supermemory/SKILL.md at line 42-42 as [write]
unless it cannot be restored, in which case use [destructive], and mark
log_analysis in app-skills/oo-wandb/SKILL.md at line 54-54 as [write].
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 87c81b9c-1fa9-486a-ba2f-0d4734bbb2af
📒 Files selected for processing (60)
app-skills/oo-aerisweather/SKILL.mdapp-skills/oo-amilia/SKILL.mdapp-skills/oo-appcircle/SKILL.mdapp-skills/oo-captainbi/SKILL.mdapp-skills/oo-castingwords/SKILL.mdapp-skills/oo-chat-api-for-whatsapp/SKILL.mdapp-skills/oo-cisco-meraki/SKILL.mdapp-skills/oo-clickhelp/SKILL.mdapp-skills/oo-cloudflare-mcp/SKILL.mdapp-skills/oo-confluent/SKILL.mdapp-skills/oo-dialmycalls/SKILL.mdapp-skills/oo-doppler-marketing-automation/SKILL.mdapp-skills/oo-drimify/SKILL.mdapp-skills/oo-elasticemail/SKILL.mdapp-skills/oo-eversign/SKILL.mdapp-skills/oo-faktoora/SKILL.mdapp-skills/oo-feishu-app-bot/SKILL.mdapp-skills/oo-feishu/SKILL.mdapp-skills/oo-generic-imap/SKILL.mdapp-skills/oo-gitea/SKILL.mdapp-skills/oo-github/SKILL.mdapp-skills/oo-govee/SKILL.mdapp-skills/oo-grafana/SKILL.mdapp-skills/oo-groqcloud/SKILL.mdapp-skills/oo-helium10/SKILL.mdapp-skills/oo-helpdesk/SKILL.mdapp-skills/oo-home-assistant/SKILL.mdapp-skills/oo-infolobby/SKILL.mdapp-skills/oo-insites/SKILL.mdapp-skills/oo-instabot/SKILL.mdapp-skills/oo-jumpseller/SKILL.mdapp-skills/oo-junglescout/SKILL.mdapp-skills/oo-kadoa/SKILL.mdapp-skills/oo-krispcall/SKILL.mdapp-skills/oo-leadboxer/SKILL.mdapp-skills/oo-leadiq/SKILL.mdapp-skills/oo-line/SKILL.mdapp-skills/oo-mailcoach/SKILL.mdapp-skills/oo-mailsoftly/SKILL.mdapp-skills/oo-minimax/SKILL.mdapp-skills/oo-monica-crm/SKILL.mdapp-skills/oo-more-trees/SKILL.mdapp-skills/oo-mx-toolbox/SKILL.mdapp-skills/oo-mx/SKILL.mdapp-skills/oo-passcreator/SKILL.mdapp-skills/oo-payrexx/SKILL.mdapp-skills/oo-productlane/SKILL.mdapp-skills/oo-quintadb/SKILL.mdapp-skills/oo-reversecontact/SKILL.mdapp-skills/oo-sellerspace/SKILL.mdapp-skills/oo-sif/SKILL.mdapp-skills/oo-sorftime/SKILL.mdapp-skills/oo-splunk-http-event-collector/SKILL.mdapp-skills/oo-supermemory/SKILL.mdapp-skills/oo-the-official-board/SKILL.mdapp-skills/oo-vida/SKILL.mdapp-skills/oo-wandb/SKILL.mdapp-skills/oo-zip-archive-api/SKILL.mdapp-skills/oo-zlibrary/SKILL.mdapp-skills/oo-zylvie/SKILL.md
🚧 Files skipped from review as they are similar to previous changes (39)
- app-skills/oo-instabot/SKILL.md
- app-skills/oo-clickhelp/SKILL.md
- app-skills/oo-quintadb/SKILL.md
- app-skills/oo-aerisweather/SKILL.md
- app-skills/oo-drimify/SKILL.md
- app-skills/oo-dialmycalls/SKILL.md
- app-skills/oo-helium10/SKILL.md
- app-skills/oo-appcircle/SKILL.md
- app-skills/oo-the-official-board/SKILL.md
- app-skills/oo-vida/SKILL.md
- app-skills/oo-eversign/SKILL.md
- app-skills/oo-zip-archive-api/SKILL.md
- app-skills/oo-reversecontact/SKILL.md
- app-skills/oo-more-trees/SKILL.md
- app-skills/oo-splunk-http-event-collector/SKILL.md
- app-skills/oo-doppler-marketing-automation/SKILL.md
- app-skills/oo-cloudflare-mcp/SKILL.md
- app-skills/oo-cisco-meraki/SKILL.md
- app-skills/oo-monica-crm/SKILL.md
- app-skills/oo-mailsoftly/SKILL.md
- app-skills/oo-sif/SKILL.md
- app-skills/oo-mx-toolbox/SKILL.md
- app-skills/oo-sorftime/SKILL.md
- app-skills/oo-krispcall/SKILL.md
- app-skills/oo-amilia/SKILL.md
- app-skills/oo-mx/SKILL.md
- app-skills/oo-castingwords/SKILL.md
- app-skills/oo-zylvie/SKILL.md
- app-skills/oo-jumpseller/SKILL.md
- app-skills/oo-kadoa/SKILL.md
- app-skills/oo-github/SKILL.md
- app-skills/oo-passcreator/SKILL.md
- app-skills/oo-leadiq/SKILL.md
- app-skills/oo-chat-api-for-whatsapp/SKILL.md
- app-skills/oo-line/SKILL.md
- app-skills/oo-leadboxer/SKILL.md
- app-skills/oo-helpdesk/SKILL.md
- app-skills/oo-elasticemail/SKILL.md
- app-skills/oo-payrexx/SKILL.md
Comment on lines
+40
to
+46
| - `attach_project_document` — Attach one Faktoora document to an empty project. | ||
| - `create_project` — Create a Faktoora project. [write] | ||
| - `delete_project` — Permanently delete a Faktoora project without deleting its attached document. [destructive] | ||
| - `detach_project_document` — Detach one Faktoora document from a project. | ||
| - `get_project` — Retrieve a Faktoora project by UUID. | ||
| - `list_projects` — List Faktoora projects with pagination, filtering, and sorting. | ||
| - `update_project` — Partially update a Faktoora project. [write] |
Contributor
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Tag all state-changing Faktoora actions as [write].
attach_project_document and detach_project_document modify Faktoora state, but neither action has a safety tag. The safety section therefore classifies them as reads and permits execution without user confirmation.
Proposed fix
- - `attach_project_document` — Attach one Faktoora document to an empty project.
+ - `attach_project_document` — Attach one Faktoora document to an empty project. [write]
...
- - `detach_project_document` — Detach one Faktoora document from a project.
+ - `detach_project_document` — Detach one Faktoora document from a project. [write]📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| - `attach_project_document` — Attach one Faktoora document to an empty project. | |
| - `create_project` — Create a Faktoora project. [write] | |
| - `delete_project` — Permanently delete a Faktoora project without deleting its attached document. [destructive] | |
| - `detach_project_document` — Detach one Faktoora document from a project. | |
| - `get_project` — Retrieve a Faktoora project by UUID. | |
| - `list_projects` — List Faktoora projects with pagination, filtering, and sorting. | |
| - `update_project` — Partially update a Faktoora project. [write] | |
| - `attach_project_document` — Attach one Faktoora document to an empty project. [write] | |
| - `create_project` — Create a Faktoora project. [write] | |
| - `delete_project` — Permanently delete a Faktoora project without deleting its attached document. [destructive] | |
| - `detach_project_document` — Detach one Faktoora document from a project. [write] | |
| - `get_project` — Retrieve a Faktoora project by UUID. | |
| - `list_projects` — List Faktoora projects with pagination, filtering, and sorting. | |
| - `update_project` — Partially update a Faktoora project. [write] |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@app-skills/oo-faktoora/SKILL.md` around lines 40 - 46, Update the action
descriptions for attach_project_document and detach_project_document in the
Faktoora skill so both include the [write] safety tag, matching the existing
create_project and update_project conventions while leaving read and destructive
classifications unchanged.
Comment on lines
+69
to
+70
| - `dismiss_pull_request_review` — Dismiss a review on a Gitea pull request. | ||
| - `fork_repository` — Fork a Gitea repository to the authenticated user or an organization. |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Mark every listed state-changing action with [write].
The safety sections allow untagged actions to run directly. These entries perform state-changing or external side-effecting operations without the required confirmation marker.
app-skills/oo-gitea/SKILL.md#L69-L70: add[write]todismiss_pull_request_reviewandfork_repository.app-skills/oo-gitea/SKILL.md#L117-L117: add[write]torequest_pull_request_reviewers.app-skills/oo-govee/SKILL.md#L40-L40: add[write]tocontrol_capability.app-skills/oo-home-assistant/SKILL.md#L45-L45: add[write]toexecute_script.app-skills/oo-mailcoach/SKILL.md#L48-L48: add[write]toresend_subscriber_confirmation.
Update the source definitions and regenerate the generated skill files.
📍 Affects 4 files
app-skills/oo-gitea/SKILL.md#L69-L70(this comment)app-skills/oo-gitea/SKILL.md#L117-L117app-skills/oo-govee/SKILL.md#L40-L40app-skills/oo-home-assistant/SKILL.md#L45-L45app-skills/oo-mailcoach/SKILL.md#L48-L48
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@app-skills/oo-gitea/SKILL.md` around lines 69 - 70, Mark
dismiss_pull_request_review and fork_repository in app-skills/oo-gitea/SKILL.md
lines 69-70, request_pull_request_reviewers in app-skills/oo-gitea/SKILL.md line
117, control_capability in app-skills/oo-govee/SKILL.md line 40, execute_script
in app-skills/oo-home-assistant/SKILL.md line 45, and
resend_subscriber_confirmation in app-skills/oo-mailcoach/SKILL.md line 48 with
the [write] marker. Update their source definitions and regenerate the generated
skill files.
| - `delete_video_generation_v2` — Delete a MiniMax H3 video generation task. [destructive] | ||
| - `download_video` — Download a generated MiniMax video and store it in connector transit storage. | ||
| - `estimate_input_tokens` — Estimate MiniMax response input tokens without invoking the model. | ||
| - `image_to_video` — Create a MiniMax asynchronous image-to-video task from a public URL or data URI first frame. |
Contributor
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Fix missing safety tags in the generated action catalogs.
These actions mutate provider-side state but remain untagged, so the shared Safety rule classifies them as safe reads. Fix the source definitions and regenerate the skills.
app-skills/oo-minimax/SKILL.md#L45-L45: add[write]toimage_to_video.app-skills/oo-minimax/SKILL.md#L51-L51: add[write]totext_to_video.app-skills/oo-supermemory/SKILL.md#L42-L42: add[write]toforget_memory, or[destructive]if it cannot be restored.app-skills/oo-wandb/SKILL.md#L54-L54: add[write]tolog_analysis.
📍 Affects 3 files
app-skills/oo-minimax/SKILL.md#L45-L45(this comment)app-skills/oo-minimax/SKILL.md#L51-L51app-skills/oo-supermemory/SKILL.md#L42-L42app-skills/oo-wandb/SKILL.md#L54-L54
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@app-skills/oo-minimax/SKILL.md` at line 45, Add the appropriate safety tags
to the source action definitions and regenerate the skills: mark image_to_video
and text_to_video in app-skills/oo-minimax/SKILL.md at lines 45-45 and 51-51 as
[write], mark forget_memory in app-skills/oo-supermemory/SKILL.md at line 42-42
as [write] unless it cannot be restored, in which case use [destructive], and
mark log_analysis in app-skills/oo-wandb/SKILL.md at line 54-54 as [write].
oomol-bot
force-pushed
the
bot/sync-app-skills
branch
from
August 4, 2026 15:50
e76e43d to
1e4358d
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
♻️ Duplicate comments (1)
app-skills/oo-faktoora/SKILL.md (1)
40-43: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winAdd safety tags to every state-changing action.
Both catalogs classify untagged actions as reads. This allows state changes to run without the required user confirmation.
app-skills/oo-faktoora/SKILL.md#L40-L43: Add[write]toattach_project_documentanddetach_project_document.app-skills/oo-home-assistant/SKILL.md#L40-L46: Add[write]tocall_service,execute_script, andfire_event.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@app-skills/oo-faktoora/SKILL.md` around lines 40 - 43, Add the [write] safety tag to the state-changing actions attach_project_document and detach_project_document in app-skills/oo-faktoora/SKILL.md lines 40-43, and to call_service, execute_script, and fire_event in app-skills/oo-home-assistant/SKILL.md lines 40-46. Leave existing tags unchanged so all state-changing actions require confirmation.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@app-skills/oo-junglescout/SKILL.md`:
- Line 3: Update the skill descriptions to accurately reflect the available
actions in the respective catalogs. In app-skills/oo-junglescout/SKILL.md at
line 3, remove the claims about "creating and updating data" from the
description, leaving only the read/search capabilities that are actually
supported by the catalog. Apply the same fix to app-skills/oo-printify/SKILL.md
at line 3, removing create/update capability claims and keeping the description
aligned with the actual read/search actions available in that skill's catalog.
In `@app-skills/oo-komari/SKILL.md`:
- Around line 63-95: Remove [write] from read-only get_* and list_* actions in
app-skills/oo-komari/SKILL.md lines 63-95, while adding separate handling for
responses containing secrets or other sensitive data. Also remove [write] from
get_share_of_voice in app-skills/oo-junglescout/SKILL.md line 44 and get_order
in app-skills/oo-printify/SKILL.md line 39.
- Line 99: Update the action declaration for record_visitor_event in the Komari
skill documentation to include the [write] tag, so its audit-record creation is
classified as a write action requiring confirmation.
---
Duplicate comments:
In `@app-skills/oo-faktoora/SKILL.md`:
- Around line 40-43: Add the [write] safety tag to the state-changing actions
attach_project_document and detach_project_document in
app-skills/oo-faktoora/SKILL.md lines 40-43, and to call_service,
execute_script, and fire_event in app-skills/oo-home-assistant/SKILL.md lines
40-46. Leave existing tags unchanged so all state-changing actions require
confirmation.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 6c546aa8-ae4e-40f7-8f3b-3990f3b7f83a
📒 Files selected for processing (75)
app-skills/oo-17track/SKILL.mdapp-skills/oo-aerisweather/SKILL.mdapp-skills/oo-alt-text-generator-ai/SKILL.mdapp-skills/oo-amilia/SKILL.mdapp-skills/oo-appcircle/SKILL.mdapp-skills/oo-avochato/SKILL.mdapp-skills/oo-captainbi/SKILL.mdapp-skills/oo-castingwords/SKILL.mdapp-skills/oo-chat-api-for-whatsapp/SKILL.mdapp-skills/oo-cisco-meraki/SKILL.mdapp-skills/oo-clickhelp/SKILL.mdapp-skills/oo-cloudflare-mcp/SKILL.mdapp-skills/oo-confluent/SKILL.mdapp-skills/oo-dialmycalls/SKILL.mdapp-skills/oo-diffy/SKILL.mdapp-skills/oo-doppler-marketing-automation/SKILL.mdapp-skills/oo-drimify/SKILL.mdapp-skills/oo-elasticemail/SKILL.mdapp-skills/oo-eversign/SKILL.mdapp-skills/oo-faktoora/SKILL.mdapp-skills/oo-feishu-app-bot/SKILL.mdapp-skills/oo-feishu/SKILL.mdapp-skills/oo-generic-imap/SKILL.mdapp-skills/oo-gitea/SKILL.mdapp-skills/oo-github/SKILL.mdapp-skills/oo-govee/SKILL.mdapp-skills/oo-grafana/SKILL.mdapp-skills/oo-groqcloud/SKILL.mdapp-skills/oo-helium10/SKILL.mdapp-skills/oo-helpdesk/SKILL.mdapp-skills/oo-home-assistant/SKILL.mdapp-skills/oo-infolobby/SKILL.mdapp-skills/oo-insites/SKILL.mdapp-skills/oo-instabot/SKILL.mdapp-skills/oo-jumpseller/SKILL.mdapp-skills/oo-junglescout/SKILL.mdapp-skills/oo-kadoa/SKILL.mdapp-skills/oo-komari/SKILL.mdapp-skills/oo-krispcall/SKILL.mdapp-skills/oo-leadboxer/SKILL.mdapp-skills/oo-leadiq/SKILL.mdapp-skills/oo-lightspeed-vt/SKILL.mdapp-skills/oo-line/SKILL.mdapp-skills/oo-mailcoach/SKILL.mdapp-skills/oo-mailsoftly/SKILL.mdapp-skills/oo-minimax/SKILL.mdapp-skills/oo-monica-crm/SKILL.mdapp-skills/oo-more-trees/SKILL.mdapp-skills/oo-mx-toolbox/SKILL.mdapp-skills/oo-mx/SKILL.mdapp-skills/oo-onlyoffice-docspace/SKILL.mdapp-skills/oo-passcreator/SKILL.mdapp-skills/oo-payrexx/SKILL.mdapp-skills/oo-phonely/SKILL.mdapp-skills/oo-printify/SKILL.mdapp-skills/oo-productlane/SKILL.mdapp-skills/oo-quintadb/SKILL.mdapp-skills/oo-reversecontact/SKILL.mdapp-skills/oo-sellerspace/SKILL.mdapp-skills/oo-sendlane/SKILL.mdapp-skills/oo-sif/SKILL.mdapp-skills/oo-slack/SKILL.mdapp-skills/oo-social-fetch/SKILL.mdapp-skills/oo-sorftime/SKILL.mdapp-skills/oo-splunk-http-event-collector/SKILL.mdapp-skills/oo-supermemory/SKILL.mdapp-skills/oo-teable/SKILL.mdapp-skills/oo-the-official-board/SKILL.mdapp-skills/oo-timelinesai/SKILL.mdapp-skills/oo-vida/SKILL.mdapp-skills/oo-wandb/SKILL.mdapp-skills/oo-workast/SKILL.mdapp-skills/oo-zip-archive-api/SKILL.mdapp-skills/oo-zlibrary/SKILL.mdapp-skills/oo-zylvie/SKILL.md
🚧 Files skipped from review as they are similar to previous changes (55)
- app-skills/oo-dialmycalls/SKILL.md
- app-skills/oo-aerisweather/SKILL.md
- app-skills/oo-clickhelp/SKILL.md
- app-skills/oo-govee/SKILL.md
- app-skills/oo-doppler-marketing-automation/SKILL.md
- app-skills/oo-generic-imap/SKILL.md
- app-skills/oo-amilia/SKILL.md
- app-skills/oo-appcircle/SKILL.md
- app-skills/oo-mailcoach/SKILL.md
- app-skills/oo-jumpseller/SKILL.md
- app-skills/oo-elasticemail/SKILL.md
- app-skills/oo-zip-archive-api/SKILL.md
- app-skills/oo-krispcall/SKILL.md
- app-skills/oo-vida/SKILL.md
- app-skills/oo-kadoa/SKILL.md
- app-skills/oo-reversecontact/SKILL.md
- app-skills/oo-helpdesk/SKILL.md
- app-skills/oo-monica-crm/SKILL.md
- app-skills/oo-zlibrary/SKILL.md
- app-skills/oo-castingwords/SKILL.md
- app-skills/oo-sorftime/SKILL.md
- app-skills/oo-drimify/SKILL.md
- app-skills/oo-more-trees/SKILL.md
- app-skills/oo-mx/SKILL.md
- app-skills/oo-feishu-app-bot/SKILL.md
- app-skills/oo-the-official-board/SKILL.md
- app-skills/oo-wandb/SKILL.md
- app-skills/oo-quintadb/SKILL.md
- app-skills/oo-chat-api-for-whatsapp/SKILL.md
- app-skills/oo-instabot/SKILL.md
- app-skills/oo-eversign/SKILL.md
- app-skills/oo-leadboxer/SKILL.md
- app-skills/oo-productlane/SKILL.md
- app-skills/oo-passcreator/SKILL.md
- app-skills/oo-payrexx/SKILL.md
- app-skills/oo-confluent/SKILL.md
- app-skills/oo-zylvie/SKILL.md
- app-skills/oo-line/SKILL.md
- app-skills/oo-infolobby/SKILL.md
- app-skills/oo-sif/SKILL.md
- app-skills/oo-helium10/SKILL.md
- app-skills/oo-mailsoftly/SKILL.md
- app-skills/oo-sellerspace/SKILL.md
- app-skills/oo-feishu/SKILL.md
- app-skills/oo-cloudflare-mcp/SKILL.md
- app-skills/oo-leadiq/SKILL.md
- app-skills/oo-minimax/SKILL.md
- app-skills/oo-cisco-meraki/SKILL.md
- app-skills/oo-supermemory/SKILL.md
- app-skills/oo-mx-toolbox/SKILL.md
- app-skills/oo-github/SKILL.md
- app-skills/oo-gitea/SKILL.md
- app-skills/oo-groqcloud/SKILL.md
- app-skills/oo-splunk-http-event-collector/SKILL.md
- app-skills/oo-grafana/SKILL.md
| @@ -0,0 +1,83 @@ | |||
| --- | |||
| name: oo-junglescout | |||
| description: "Jungle Scout (junglescout.com). Use this skill for ANY Jungle Scout request — reading, creating, and updating data. Whenever a task involves Jungle Scout, use this skill instead of calling the API directly." | |||
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Align the skill descriptions with the available actions.
Both descriptions promise create and update operations, but their catalogs expose only read or search operations. A create or update request can therefore route to a skill with no matching action. Either add the missing actions or describe these skills as read/search skills.
app-skills/oo-junglescout/SKILL.md#L3-L3: Remove the create/update capability claim or add matching actions.app-skills/oo-printify/SKILL.md#L3-L3: Remove the create/update capability claim or add matching actions.
📍 Affects 2 files
app-skills/oo-junglescout/SKILL.md#L3-L3(this comment)app-skills/oo-printify/SKILL.md#L3-L3
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@app-skills/oo-junglescout/SKILL.md` at line 3, Update the skill descriptions
to accurately reflect the available actions in the respective catalogs. In
app-skills/oo-junglescout/SKILL.md at line 3, remove the claims about "creating
and updating data" from the description, leaving only the read/search
capabilities that are actually supported by the catalog. Apply the same fix to
app-skills/oo-printify/SKILL.md at line 3, removing create/update capability
claims and keeping the description aligned with the actual read/search actions
available in that skill's catalog.
Comment on lines
+63
to
+95
| - `get_client` — Get one client without returning its enrollment token. [write] | ||
| - `get_client_task_result` — Get one client's result for an execution task. [write] | ||
| - `get_client_token` — Get a client enrollment token. Treat the response as a secret. [write] | ||
| - `get_clipboard` — Get one clipboard entry. [write] | ||
| - `get_current_user` — Get the current Komari user or guest identity. | ||
| - `get_database_size` — Inspect main and monitoring database storage. [write] | ||
| - `get_execution_task` — Get one remote execution task and its results. [write] | ||
| - `get_load_history` — Get persisted resource metrics for a node. | ||
| - `get_message_sender_provider` — Get one message-sender configuration or list available templates. The result may contain secrets. [write] | ||
| - `get_metric_migration_status` — Get metric-store migration progress. [write] | ||
| - `get_oidc_provider` — Get one OIDC configuration or list templates. The result may contain client secrets. [write] | ||
| - `get_ping_history` — Get ping records by node, task, or both. | ||
| - `get_ping_metric_stats` — Get aggregate latency, loss, percentile, and standard-deviation statistics. | ||
| - `get_public_settings` — Get settings that Komari exposes to its public frontend. | ||
| - `get_recent_metrics` — Get the short in-memory window of recent reports for a node. | ||
| - `get_settings` — Get all Komari settings. The result can contain secrets and database DSNs. [write] | ||
| - `get_terminal_settings` — Get xterm.js terminal appearance settings. [write] | ||
| - `get_version` — Get the Komari server version and build hash. | ||
| - `list_audit_logs` — List paged audit logs. [write] | ||
| - `list_client_execution_tasks` — List execution tasks assigned to a client. [write] | ||
| - `list_clients` — List all clients without returning enrollment tokens. [write] | ||
| - `list_clipboard` — List clipboard entries. [write] | ||
| - `list_execution_tasks` — List remote execution tasks and their results, which may contain command output. [write] | ||
| - `list_load_notifications` — List load notification rules. [write] | ||
| - `list_metric_definitions` — List all metric definitions and retention policies. [write] | ||
| - `list_nodes` — List visible Komari nodes without client tokens or private address fields. | ||
| - `list_offline_notifications` — List offline notification rules. [write] | ||
| - `list_ping_tasks` — List all ping tasks including targets. [write] | ||
| - `list_public_metric_definitions` — List public metric definitions and retention policies. | ||
| - `list_public_ping_tasks` — List ping tasks using the public response shape. | ||
| - `list_sessions` — List login sessions using stable identifiers while redacting session tokens and IP addresses. [write] | ||
| - `list_task_results` — List all client results for an execution task. [write] | ||
| - `list_traffic_report_notifications` — List traffic-report rules. [write] |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Use [write] only for state-changing actions.
These actions are described as reads, but [write] makes the safety section require confirmation as if they mutate state. Remove the tag from read-only actions. If sensitive reads need confirmation, document a separate sensitive-read rule instead of misclassifying them as writes.
app-skills/oo-komari/SKILL.md#L63-L95: Remove[write]from the describedget_*andlist_*read actions; add separate handling for secret-bearing responses.app-skills/oo-junglescout/SKILL.md#L44-L44: Remove[write]fromget_share_of_voice.app-skills/oo-printify/SKILL.md#L39-L39: Remove[write]fromget_order.
📍 Affects 3 files
app-skills/oo-komari/SKILL.md#L63-L95(this comment)app-skills/oo-junglescout/SKILL.md#L44-L44app-skills/oo-printify/SKILL.md#L39-L39
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@app-skills/oo-komari/SKILL.md` around lines 63 - 95, Remove [write] from
read-only get_* and list_* actions in app-skills/oo-komari/SKILL.md lines 63-95,
while adding separate handling for responses containing secrets or other
sensitive data. Also remove [write] from get_share_of_voice in
app-skills/oo-junglescout/SKILL.md line 44 and get_order in
app-skills/oo-printify/SKILL.md line 39.
| - `order_clients` — Set client display weights using a UUID-to-weight map. [write] | ||
| - `order_ping_tasks` — Set ping-task weights using an ID-to-weight map. [write] | ||
| - `query_metrics` — Query metric time-series points with filters, aggregation, and downsampling. | ||
| - `record_visitor_event` — Record a bounded visitor audit event in Komari. |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Mark record_visitor_event as a write action.
record_visitor_event creates a Komari audit record, but it has no [write] tag. The safety rule therefore treats it as a safe read and permits execution without confirmation. Add [write] to this action.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@app-skills/oo-komari/SKILL.md` at line 99, Update the action declaration for
record_visitor_event in the Komari skill documentation to include the [write]
tag, so its audit-record creation is classified as a write action requiring
confirmation.
oomol-bot
force-pushed
the
bot/sync-app-skills
branch
from
August 8, 2026 15:09
1e4358d to
e7f2cbb
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@app-skills/oo-avochato/SKILL.md`:
- Line 4: Reconcile the allowed-tools front matter in
app-skills/oo-avochato/SKILL.md at line 4 and app-skills/oo-teable/SKILL.md at
line 4 with their documented first-time setup installers, or explicitly state
that those installers must run outside the skill; do not grant arbitrary shell
access solely to support fetching and executing installer scripts.
In `@app-skills/oo-elasticsearch/SKILL.md`:
- Around line 40-60: Protect the mutating Elasticsearch actions by adding
[write] to bulk_index_documents, index_document, and reindex in
app-skills/oo-elasticsearch/SKILL.md lines 40-60. In
app-skills/oo-dumplingai/SKILL.md lines 44-50, require confirmation for run or
split its read and write capabilities into separately tagged actions so write
operations are not treated as safe reads.
In `@app-skills/oo-lingxing-mcp/SKILL.md`:
- Around line 39-46: Align action safety metadata with documented side effects:
in app-skills/oo-lingxing-mcp/SKILL.md lines 39-46, require confirmation based
on discovered annotations before call_tool invokes create/update operations; in
app-skills/oo-lingxing/SKILL.md line 3, either document the promised
create/update actions or make the description read-only; in
app-skills/oo-lingxing/SKILL.md line 60, remove [write] from list_order_profit
if it only reads report rows, otherwise document its state-changing behavior and
confirmation requirement; in app-skills/oo-linkfox/SKILL.md lines 45-49, mark
get_amazon_ads_report and get_amazon_store_report as write-like or revise their
descriptions if report generation is read-only.
In `@app-skills/oo-referralhero/SKILL.md`:
- Line 48: Update the track_conversion entry in the ReferralHero skill
documentation to mark it as [write], then validate its payload and behavior
using the referralhero connector schema action before syncing.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: b8fc14c9-f073-4d2f-b25e-71fa99f7096e
📒 Files selected for processing (43)
app-skills/oo-17track/SKILL.mdapp-skills/oo-alt-text-generator-ai/SKILL.mdapp-skills/oo-avochato/SKILL.mdapp-skills/oo-baidu-netdisk/SKILL.mdapp-skills/oo-diffy/SKILL.mdapp-skills/oo-dumplingai/SKILL.mdapp-skills/oo-elasticsearch/SKILL.mdapp-skills/oo-formstack-documents/SKILL.mdapp-skills/oo-fusion-api/SKILL.mdapp-skills/oo-gatherup/SKILL.mdapp-skills/oo-komari/SKILL.mdapp-skills/oo-lightspeed-vt/SKILL.mdapp-skills/oo-lingxing-mcp/SKILL.mdapp-skills/oo-lingxing/SKILL.mdapp-skills/oo-linkfox/SKILL.mdapp-skills/oo-magileads/SKILL.mdapp-skills/oo-megaventory/SKILL.mdapp-skills/oo-microsoft-todo/SKILL.mdapp-skills/oo-monday/SKILL.mdapp-skills/oo-mux/SKILL.mdapp-skills/oo-neetodesk/SKILL.mdapp-skills/oo-onlyoffice-docspace/SKILL.mdapp-skills/oo-phonely/SKILL.mdapp-skills/oo-printify/SKILL.mdapp-skills/oo-processplan/SKILL.mdapp-skills/oo-profileapi/SKILL.mdapp-skills/oo-referralhero/SKILL.mdapp-skills/oo-referralrock/SKILL.mdapp-skills/oo-ringba/SKILL.mdapp-skills/oo-sendlane/SKILL.mdapp-skills/oo-slickdeals/SKILL.mdapp-skills/oo-social-fetch/SKILL.mdapp-skills/oo-teable/SKILL.mdapp-skills/oo-ticket-source/SKILL.mdapp-skills/oo-ticktick/SKILL.mdapp-skills/oo-timebuzzer/SKILL.mdapp-skills/oo-timelinesai/SKILL.mdapp-skills/oo-trawlingweb/SKILL.mdapp-skills/oo-typebot/SKILL.mdapp-skills/oo-whatsable/SKILL.mdapp-skills/oo-workast/SKILL.mdapp-skills/oo-workiz/SKILL.mdapp-skills/oo-wp-maps/SKILL.md
🚧 Files skipped from review as they are similar to previous changes (11)
- app-skills/oo-alt-text-generator-ai/SKILL.md
- app-skills/oo-printify/SKILL.md
- app-skills/oo-17track/SKILL.md
- app-skills/oo-workast/SKILL.md
- app-skills/oo-lightspeed-vt/SKILL.md
- app-skills/oo-social-fetch/SKILL.md
- app-skills/oo-sendlane/SKILL.md
- app-skills/oo-phonely/SKILL.md
- app-skills/oo-timelinesai/SKILL.md
- app-skills/oo-diffy/SKILL.md
- app-skills/oo-komari/SKILL.md
| --- | ||
| name: oo-avochato | ||
| description: "Avochato (avochato.com). Use this skill for ANY Avochato request — reading, creating, and updating data. Whenever a task involves Avochato, use this skill instead of calling the API directly." | ||
| allowed-tools: [Bash(oo *)] |
Contributor
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== matching SKILL files =="
git ls-files | grep -E '(^|/)SKILL\.md$' | sed -n '1,120p'
echo
echo "== target file snippets with line numbers =="
for f in app-skills/oo-avochato/SKILL.md app-skills/oo-teable/SKILL.md; do
if [ -f "$f" ]; then
echo "--- $f ($(wc -l < "$f") lines) ---"
sed -n '1,90p' "$f" | nl -ba
else
echo "MISSING $f"
fi
done
echo
echo "== searches for Bash allowlist patterns and installer tool uses =="
rg -n "allowed-tools:|Bash\\(oo \\*\\)|curl|irm|Invoke-WebRequest|wget" app-skills/oo-avochato/SKILL.md app-skills/oo-teable/SKILL.md || trueRepository: oomol-lab/skills
Length of output: 4278
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== target file snippets with line numbers =="
for f in app-skills/oo-avochato/SKILL.md app-skills/oo-teable/SKILL.md; do
if [ -f "$f" ]; then
echo "--- $f ($(wc -l "$f" | sed 's/ //g') lines) ---"
awk '{printf "%5d:%s\n", NR, $0}' "$f" | sed -n '1,120p'
else
echo "MISSING $f"
fi
done
echo
echo "== searches for Bash allowlist patterns and installer tool uses =="
rg -n "allowed-tools:|Bash\\(oo \\*\\)|curl|irm|Invoke-WebRequest|wget" app-skills/oo-avochato/SKILL.md app-skills/oo-teable/SKILL.md || true
echo
echo "== deterministic Bash pattern match for documented commands =="
python3 - <<'PY'
import re, pathlib
pattern = re.compile(r'^Bash\((.*)\)$')
p = re.compile(r'^(.*)?oo\*(.*)?$')
for f in ["app-skills/oo-avochato/SKILL.md", "app-skills/oo-teable/SKILL.md"]:
s = pathlib.Path(f).read_text().splitlines()
allow = s[0].split("allowed-tools:", 1)[1].strip().rstrip("]")
m = pattern.match(allow)
print(f==f, "file", f, "line1", s[0], "matcher=", allow if not m else m.group(1))
for i, line in enumerate(s, 1):
if not line or line[0] in "- >": continue
if p.search(line):
print(f, i, line)
PYRepository: oomol-lab/skills
Length of output: 10551
Require access for the documented missing-CLI installer commands.
The First-time setup instructions run curl ... | bash and PowerShell irm ... | iex, but allowed-tools: [Bash(oo *)] limits shell access to oo commands. If the allowlist is enforced, oo: command not found will not be recoverable through the skill.
- Reconcile the allowlist with the documented bootstrap commands, or state that the installer must run outside the skill.
- Do not rely on arbitrary shell access for fetching and executing installer scripts.
📍 Affects 2 files
app-skills/oo-avochato/SKILL.md#L4-L4(this comment)app-skills/oo-teable/SKILL.md#L4-L4
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@app-skills/oo-avochato/SKILL.md` at line 4, Reconcile the allowed-tools front
matter in app-skills/oo-avochato/SKILL.md at line 4 and
app-skills/oo-teable/SKILL.md at line 4 with their documented first-time setup
installers, or explicitly state that those installers must run outside the
skill; do not grant arbitrary shell access solely to support fetching and
executing installer scripts.
Comment on lines
+40
to
+60
| - `bulk_index_documents` — Apply many Elasticsearch document writes in one bulk request. Each operation names its own index, and per-operation failures are reported in the response instead of failing the whole request. | ||
| - `count_documents` — Count Elasticsearch documents matching a query without returning any hits, which is cheaper than a search when only the size of a result set matters. | ||
| - `create_index` — Create one Elasticsearch index with explicit mappings, settings, and aliases. [write] | ||
| - `delete_by_query` — Delete Elasticsearch documents matching a query. This destroys data and cannot be undone, so a bounded maxDocs and at least one of query, termFilters, rangeFilters, or timeFilter are required, the index name must be exact, and _all is rejected. That makes it impossible to empty an entire index by accident. The action waits for the deletion to finish, and a large maxDocs can outlast that wait: a timeout does not cancel the deletion, which keeps running on the cluster with no task id to poll, so a retry after a timeout deletes a further batch. [destructive] | ||
| - `delete_document` — Delete one Elasticsearch document by id. A missing document returns a not_found result instead of raising an error. [destructive] | ||
| - `delete_index` — Permanently delete one or more Elasticsearch indices by exact name. This destroys data and cannot be undone, so wildcards, comma-separated lists, and _all are rejected, and expectedCount must equal the number of names supplied. [destructive] | ||
| - `get_cluster_health` — Get detailed Elasticsearch cluster health including shard counts and an optional per-index breakdown. | ||
| - `get_cluster_nodes` — List Elasticsearch cluster nodes with uptime, heap, disk, and role information. Node uptime is what makes the cumulative counters from get_index_stats interpretable. | ||
| - `get_document` — Get one Elasticsearch document by id. A missing document returns found as false instead of raising an error. | ||
| - `get_index_schema` — Get mappings, settings, aliases, and field statistics for one Elasticsearch index. | ||
| - `get_index_stats` — Get document, store, search, get, and indexing statistics for Elasticsearch indices. Counters such as searchQueryTotal are cumulative since each node started rather than a time window, so compare them against the node uptime in counterWindow before concluding that a zero means the index is never queried. | ||
| - `get_task` — Get the state and progress of one Elasticsearch task, such as a reindex started by the reindex action. | ||
| - `index_document` — Index or replace one document in an Elasticsearch index. Supplying documentId replaces that document, while omitting it lets Elasticsearch generate an id. | ||
| - `list_aliases` — List Elasticsearch aliases and the indices behind them, optionally filtered by alias or index pattern. | ||
| - `list_indices` — List Elasticsearch indices visible to the connected user. | ||
| - `list_shards` — List Elasticsearch shard placement, state, and size, optionally limited to an index pattern or a shard state. | ||
| - `ping_cluster` — Check whether the Elasticsearch cluster is reachable and return its health status. | ||
| - `query_index` — Search an Elasticsearch index with text queries, filters, pagination, and sorting. | ||
| - `query_index` — Search an Elasticsearch index with text queries, filters, pagination, sorting, and aggregations. | ||
| - `reindex` — Start an Elasticsearch reindex from one index to another and return a task id to poll with get_task. The copy runs in the background, so this action returns before the data has moved. | ||
| - `update_aliases` — Atomically add or remove Elasticsearch alias assignments in a single request, which is how an alias is switched between indices without downtime. This action cannot delete an index; use delete_index for that. [write] | ||
| - `update_index_mappings` — Add or update field mappings on an existing Elasticsearch index. Existing field types cannot be changed in place, so incompatible changes require a new index and a reindex. [write] |
Contributor
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Protect every potentially mutating action with the confirmation rule.
Both skill files leave actions untagged even though those actions can cause external side effects or consume paid credits. The generic safety rule then treats them as safe reads.
app-skills/oo-elasticsearch/SKILL.md#L40-L60: Add[write]tobulk_index_documents,index_document, andreindex.app-skills/oo-dumplingai/SKILL.md#L44-L50: Require confirmation forrun, or split its read and write capabilities into separately tagged actions.
🧰 Tools
🪛 LanguageTool
[style] ~43-~43: ‘by accident’ might be wordy. Consider a shorter alternative.
Context: ... it impossible to empty an entire index by accident. The action waits for the deletion to f...
(EN_WORDINESS_PREMIUM_BY_ACCIDENT)
📍 Affects 2 files
app-skills/oo-elasticsearch/SKILL.md#L40-L60(this comment)app-skills/oo-dumplingai/SKILL.md#L44-L50
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@app-skills/oo-elasticsearch/SKILL.md` around lines 40 - 60, Protect the
mutating Elasticsearch actions by adding [write] to bulk_index_documents,
index_document, and reindex in app-skills/oo-elasticsearch/SKILL.md lines 40-60.
In app-skills/oo-dumplingai/SKILL.md lines 44-50, require confirmation for run
or split its read and write capabilities into separately tagged actions so write
operations are not treated as safe reads.
Comment on lines
+39
to
+46
| - `call_tool` — Call a current Lingxing ERP MCP tool with JSON arguments. Discover the tool first and confirm the user's intent because some Lingxing tools create or update ERP data. | ||
| - `list_tools` — Discover the current Lingxing ERP MCP tools, behavior annotations, and live input schemas before choosing a tool to call. | ||
|
|
||
| ## Safety | ||
|
|
||
| - Untagged actions are reads (get / list / search) — safe to run directly. | ||
| - **Actions tagged `[write]` change Lingxing MCP state — confirm the exact payload and effect with the user before running.** | ||
| - **Actions tagged `[destructive]` remove or overwrite data — always confirm the target and get explicit approval first.** |
Contributor
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Align action safety metadata with the documented side effects.
The generic rule allows untagged actions to run directly. Several documented actions can create, update, refresh, or resume remote work. Require confirmation for those operations, and remove incorrect [write] tags from read-only actions.
app-skills/oo-lingxing-mcp/SKILL.md#L39-L46:call_toolcan create or update ERP data. Require confirmation from the discovered tool annotations before invoking it.app-skills/oo-lingxing/SKILL.md#L3-L3: Either add the promised create/update actions or change the description to read-only behavior.app-skills/oo-lingxing/SKILL.md#L60-L60: Remove[write]fromlist_order_profitif it only lists report rows. If it starts a state-changing report job, update its description and confirmation guidance.app-skills/oo-linkfox/SKILL.md#L45-L49: Markget_amazon_ads_reportandget_amazon_store_reportas write-like operations, or revise their descriptions if report creation does not change state.
📍 Affects 3 files
app-skills/oo-lingxing-mcp/SKILL.md#L39-L46(this comment)app-skills/oo-lingxing/SKILL.md#L3-L3app-skills/oo-lingxing/SKILL.md#L60-L60app-skills/oo-linkfox/SKILL.md#L45-L49
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@app-skills/oo-lingxing-mcp/SKILL.md` around lines 39 - 46, Align action
safety metadata with documented side effects: in
app-skills/oo-lingxing-mcp/SKILL.md lines 39-46, require confirmation based on
discovered annotations before call_tool invokes create/update operations; in
app-skills/oo-lingxing/SKILL.md line 3, either document the promised
create/update actions or make the description read-only; in
app-skills/oo-lingxing/SKILL.md line 60, remove [write] from list_order_profit
if it only reads report rows, otherwise document its state-changing behavior and
confirmation requirement; in app-skills/oo-linkfox/SKILL.md lines 45-49, mark
get_amazon_ads_report and get_amazon_store_report as write-like or revise their
descriptions if report generation is read-only.
| - `list_lists` — List active ReferralHero referral campaigns in the connected account. | ||
| - `list_rewards` — List the rewards configured for a ReferralHero campaign. | ||
| - `list_subscribers` — List subscribers in a ReferralHero campaign with pagination and optional sorting. | ||
| - `track_conversion` — Track the second conversion event for a two-step or three-step referral campaign. |
Contributor
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files | rg '(^|/)SKILL\.md$|app-skills/oo-referralhero|referralhero' || true
echo "== current file snippet =="
if [ -f app-skills/oo-referralhero/SKILL.md ]; then
nl -ba app-skills/oo-referralhero/SKILL.md | sed -n '1,120p'
else
echo "missing app-skills/oo-referralhero/SKILL.md"
fi
echo "== search generic safety/write tag references =="
rg -n "\[write\]|generic safety|confirmation|track_conversion|referralhero|connector schema" -S . --glob '!node_modules' --glob '!dist' --glob '!build' | head -200Repository: oomol-lab/skills
Length of output: 42395
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== referralhero SKILL =="
head -n 140 app-skills/oo-referralhero/SKILL.md
echo "== write-tagged similar referral actions in repo =="
rg -n "track_conversion|\\[write\\]|referralhero|referral rock|reward|reward" app-skills -S
echo "== safety/config mentions =="
rg -n "generic|safety|confirmation|\\[write\\]|without confirmation|confirm before" . \
--glob '!node_modules' --glob '!dist' --glob '!build' --glob '!*.lock' | head -250Repository: oomol-lab/skills
Length of output: 50373
🌐 Web query:
ReferralHero API track_conversion rewards referral campaign
💡 Result:
To track a conversion and manage rewards in ReferralHero, you primarily use the track_referral_conversion_event endpoint for REST API integrations or corresponding methods in the JavaScript/Mobile SDKs [1][2][3]. Tracking a Referral Conversion The track_referral_conversion_event endpoint (POST https://app.referralhero.com/api/v2/lists/:uuid/subscribers/track_referral_conversion_event) is designed for campaigns configured with multi-step goals (tracking two or three events) [1][2]. When this event is triggered, the system checks for the referral's unique identifier and updates their status accordingly (e.g., to "Confirmed" or "Unconfirmed" depending on the campaign setup) [1][2]. Key operational details: - If a referred user is already present as "Pending," this call updates their status [1][2]. - If the referrer is provided in the API parameters and the user is not yet in the system, a new referral can be created [1][2]. - Required data typically includes the unique identifier (email, phone number, or crypto wallet address) of the person who converted [1][4]. Rewarding Referrers Rewards are managed based on the campaign goals and rules set in your ReferralHero dashboard [5][6]. - Automatic Rewards: If your campaign is set to "Conversion Event" and "Transaction-Based Rewards" are enabled, ReferralHero can automatically reward advocates when their referrals complete a transaction [5]. Transaction data can be sent via the REST API, JavaScript API, or Stripe integration [5]. - Configuration: You can define reward values as a fixed amount, a percentage of the transaction, or a value passed directly through the API [5]. - Manual Rewards: For rewards not tied to system rules, you can use the Trigger Manual Rewards API endpoint to grant one-off rewards to specific subscribers [6]. Implementation Notes - Always authenticate API calls using a Bearer token or X-API-Key in the request headers [7]. - For client-side tracking, use the appropriate JavaScript or Mobile SDK methods such as RH.trackReferral or RH.organicTrackReferral to ensure both referred and non-referred users are tracked correctly [4][8][9]. - Perform sensitive operations (like accessing your API token) in backend code rather than client-side code [7].
Citations:
- 1: https://support.referralhero.com/integrate/rest-api/endpoint-reference-v1.md
- 2: https://support.referralhero.com/integrate/rest-api/endpoints-reference
- 3: https://support.referralhero.com/integrate/mobile-sdks/react-native/public-methods.md
- 4: https://support.referralhero.com/integrate/javascript-web-api/track-multi-step-conversion-events
- 5: https://support.referralhero.com/campaign-builder/rewards/transactions
- 6: https://support.referralhero.com/campaign-builder/rewards/reward-types
- 7: https://support.referralhero.com/integrate/rest-api
- 8: https://berylsystems.gitbook.io/referral-hero-documentation/integrations/javascript-web-api/track-multi-step-conversion-events
- 9: https://support.referralhero.com/integrate/reactjs.md
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== app-skills/oo-referralhero/SKILL.md header and actions =="
sed -n '1,90p' app-skills/oo-referralhero/SKILL.md
echo "== exact track_conversion references in repository =="
rg -n "\btrack_conversion\b|trackReferral|confirmation|confirm" . \
--glob '!node_modules' --glob '!dist' --glob '!build' --glob '!*.lock' | grep -v 'github/codeql' | head -120
echo "== repo files for write safety handling =="
rg -n "without confirmation|Actions tagged \\[write\\]|\\[write\\]|confirm before|confirm exact payload" $PWD \
--glob '!node_modules' --glob '!dist' --glob '!build' --glob '!*.lock' | head -120Repository: oomol-lab/skills
Length of output: 23762
Mark track_conversion as [write].
track_conversion changes ReferralHero subscriber status and can trigger conversion/reward state, so record it with [write] and verify the payload/behavior with oo connector schema "referralhero" --action "track_conversion" before syncing.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@app-skills/oo-referralhero/SKILL.md` at line 48, Update the track_conversion
entry in the ReferralHero skill documentation to mark it as [write], then
validate its payload and behavior using the referralhero connector schema action
before syncing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated sync of generated connector skills into
app-skills/.Generated automatically; do not edit by hand.
Source commit: caf952849ef4f39ba0537112e68679abf01f97ae