Add opt-in CodeRabbit onboarding skill suite - #36
Conversation
Route create, update, and validation requests through the official CLI so every host shares one guided implementation. Document the new config skill across supported distribution surfaces without duplicating YAML logic.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Enterprise Run ID: 📒 Files selected for processing (7)
Included review availability: Your plan provides up to 100 included reviews per hour; 98 remain after this review. 📜 Recent review details🧰 Additional context used📓 Path-based instructions (2)Keep public installation commands, release status, and source-of-truth claims accurate and mutually consistent.⚙️ CodeRabbit configuration file Files:
Keep skill Markdown focused on domain context, routing, and workflow framing.⚙️ CodeRabbit configuration file Files:
🪛 SkillSpector (2.9.5)solutions/config/SKILL.md[warning] 83: [RA2] Session Persistence: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction. Remediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent. (Rogue Agent (RA2)) 🔇 Additional comments (8)
📝 WalkthroughWalkthroughThe PR adds ChangesSolutions onboarding suite
Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: ⚪ Minimal · up to This adds opt-in onboarding guidance without changing default skill installs or release bundles. The documented workflows require approval for changes and preserve unsupported CLI capabilities as explicit handoffs, leaving no actionable merge blocker. Sequence Diagram(s)sequenceDiagram
participant Repository
participant onboard
participant CodeRabbitCLI
participant config_connect as config/connect
Repository->>onboard: provide repository and provider context
onboard->>CodeRabbitCLI: run preflight and inspect readiness
onboard->>config_connect: route configuration or connection work
config_connect->>CodeRabbitCLI: validate approved changes and report results
Suggested reviewers: Poem
Caution Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional.
❌ Failed checks (1 error)
✅ Passed checks (5 passed)
Full details: Agent Guidance StructureExplanation The PR adds three skills, so the no-change exemption does not apply. Each new Resolution Quote the metadata value as
✨ Finishing Touches📝 Generate docstrings
✨ Simplify code
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@README.md`:
- Around line 157-159: Remove the configuration skill’s claims about guided
create and update flows from README.md lines 157-159, retaining only supported
CLI validation behavior. Keep the configuration skill excluded from the Live
entry in DISTRIBUTION_CHANNELS.md line 11; no change is required there if it is
already absent.
In `@skills/config/SKILL.md`:
- Around line 20-47: Update skills/config/SKILL.md lines 20-47 and README.md
lines 207-223 to align configuration routing with the documented CLI: use
`coderabbit config validate [file]` for validation, and remove the undocumented
`config --validate`, interactive create/update flow, and configuration
`--generate` claims. Preserve guidance to report CLI diagnostics and avoid
direct YAML edits or fallback workflows.
- Line 3: Remove the portable “/config” trigger from the description in
skills/config/SKILL.md. Update README.md lines 25-28 to document only supported
host-specific invocation forms, including the namespaced Claude Code command and
Antigravity form; state that Gemini CLI activates the skill automatically
through activate_skill.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 0bffc7ce-a704-4000-9087-b8204f6412ed
📒 Files selected for processing (9)
.claude-plugin/plugin.json.cursor-plugin/plugin.jsonCHANGELOG.mdDISTRIBUTION_CHANNELS.mdREADME.mdgemini-extension.jsonplugin.jsonskills/config/SKILL.mdskills/config/agents/openai.yaml
📜 Review details
🧰 Additional context used
📓 Path-based instructions (4)
{gemini-extension.json,plugin.json}
⚙️ CodeRabbit configuration file
{gemini-extension.json,plugin.json}: Verify manifest paths, metadata, and packaged components against the repository tree.
Files:
plugin.jsongemini-extension.json
skills/**/SKILL.md
⚙️ CodeRabbit configuration file
skills/**/SKILL.md: Keep skill Markdown focused on domain context, routing, and workflow framing.
Put repeatable deterministic operations in referenced scripts or tools when practical.
Use focused references for details that are only needed in some workflows.
Flag ambiguous or conflicting guidance.
Keep guidance portable across declared agents unless it is explicitly scoped.
Verify CLI commands and options against current public documentation.
Check the Agent Skills specification, the AGENTS.md open format, and the
current public documentation for every declared host agent.
Files:
skills/config/SKILL.md
{.claude-plugin,.cursor-plugin}/**/*.json
⚙️ CodeRabbit configuration file
{.claude-plugin,.cursor-plugin}/**/*.json: Verify manifest paths, versions, metadata, and packaged components against the repository tree.
Files:
.cursor-plugin/plugin.json.claude-plugin/plugin.json
{README.md,CHANGELOG.md,DISTRIBUTION_CHANNELS.md}
⚙️ CodeRabbit configuration file
{README.md,CHANGELOG.md,DISTRIBUTION_CHANNELS.md}: Keep public installation commands, release status, and source-of-truth claims accurate and mutually consistent.
Files:
CHANGELOG.mdREADME.mdDISTRIBUTION_CHANNELS.md
🪛 LanguageTool
skills/config/SKILL.md
[style] ~26-~26: It’s more common nowadays to write this noun as one word.
Context: ...t config --validate ``` When the user names a file, pass that exact path as one arg...
(RECOMMENDED_COMPOUNDS)
[style] ~53-~53: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ..., YAML mutation logic, or validation. - Never invoke PR comment commands as a substit...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
🪛 SkillSpector (2.5.1)
skills/config/SKILL.md
[warning] 46: [EA2] Autonomous Decision Making: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Remediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
(Excessive Agency (EA2))
🔇 Additional comments (6)
skills/config/SKILL.md (2)
13-18: 🩺 Stability & AvailabilityAlign prerequisites with the existing CLI contract.
These checks prove only that the binary runs and that help output exists. They do not prove authentication or the minimum supported CLI version. The current CLI exposes
auth statusanddoctorchecks for these concerns. (docs.coderabbit.ai)Reuse the prerequisite gate from
skills/code-review/SKILL.md, or document and test why configuration operations do not require it.#!/usr/bin/env bash set -euo pipefail rg -n -C 8 'auth|version|minimum|doctor' \ skills/code-review/SKILL.md skills/config/SKILL.md
6-8: LGTM!Also applies to: 10-12, 40-41, 49-54
skills/config/agents/openai.yaml (1)
1-4: LGTM!.claude-plugin/plugin.json (1)
4-4: 🗄️ Data Integrity & IntegrationVerify the packaging contract for the new skill across all manifests.
The changed descriptions do not prove that
skills/config/SKILL.mdis packaged or that existing installations receive the updated component set.
.claude-plugin/plugin.json#L4-L4: verify root-levelskills/packaging and explicit-version cache invalidation..cursor-plugin/plugin.json#L5-L5: verify root-level skill packaging and update behavior.gemini-extension.json#L4-L4: verify extension skill inclusion and version/update behavior.plugin.json#L3-L3: verify Antigravity skill inclusion and update behavior.#!/usr/bin/env bash set -euo pipefail python - <<'PY' import json from pathlib import Path manifests = [ Path(".claude-plugin/plugin.json"), Path(".cursor-plugin/plugin.json"), Path("gemini-extension.json"), Path("plugin.json"), ] assert Path("skills/config/SKILL.md").is_file() for manifest in manifests: data = json.loads(manifest.read_text()) print(manifest, "name=", data.get("name"), "version=", data.get("version")) print("description=", data.get("description")) PY for manifest in \ .claude-plugin/plugin.json \ .cursor-plugin/plugin.json \ gemini-extension.json \ plugin.json do printf '\n%s\n' "$manifest" rg -n '"(version|skills|components|include|path)"' "$manifest" || true doneExpected: every manifest either packages the repository-root
skills/directory or explicitly listsskills/config, and any explicit version/update cache is refreshed for this component addition.As per path instructions: Verify manifest paths, versions, metadata, and packaged components against the repository tree.
README.md (1)
8-10: LGTM!Also applies to: 146-147
CHANGELOG.md (1)
9-11: LGTM!
nehal-a2z
changed the title
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@DISTRIBUTION_CHANNELS.md`:
- Around line 11-12: Exclude skills/config/ from the live Skills package by
adding the repository’s supported Skills CLI exclusion configuration, or
explicitly scope the live package listing to omit it. Ensure discovery of
SKILL.md files cannot include the in-development configuration skill while
preserving all other live skills.
In `@skills/config/SKILL.md`:
- Around line 22-36: Align the configuration documentation with the released CLI
by removing or redesigning the unsupported Detailed workflow and all references
to undocumented commands, flags, and JSON fields. Update skills/config/SKILL.md
at lines 22-36, 49-57, 64-83, and 92-98, plus
skills/config/references/detailed-discovery.md lines 65-78; retain only the
documented `cr config validate [file]` workflow unless acceptance tests
establish the newer contract.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 13f076c2-2ba3-438d-8785-d1087280f2b0
📒 Files selected for processing (6)
CHANGELOG.mdDISTRIBUTION_CHANNELS.mdREADME.mdskills/config/SKILL.mdskills/config/agents/openai.yamlskills/config/references/detailed-discovery.md
📜 Review details
🧰 Additional context used
📓 Path-based instructions (2)
{README.md,CHANGELOG.md,DISTRIBUTION_CHANNELS.md}
⚙️ CodeRabbit configuration file
{README.md,CHANGELOG.md,DISTRIBUTION_CHANNELS.md}: Keep public installation commands, release status, and source-of-truth claims accurate and mutually consistent.
Files:
CHANGELOG.mdDISTRIBUTION_CHANNELS.mdREADME.md
skills/**/SKILL.md
⚙️ CodeRabbit configuration file
skills/**/SKILL.md: Keep skill Markdown focused on domain context, routing, and workflow framing.
Put repeatable deterministic operations in referenced scripts or tools when practical.
Use focused references for details that are only needed in some workflows.
Flag ambiguous or conflicting guidance.
Keep guidance portable across declared agents unless it is explicitly scoped.
Verify CLI commands and options against current public documentation.
Check the Agent Skills specification, the AGENTS.md open format, and the
current public documentation for every declared host agent.
Files:
skills/config/SKILL.md
🪛 LanguageTool
README.md
[style] ~157-~157: Consider using a different verb for a more formal wording.
Context: ...dings grouped by severity 4. Optionally fix issues and re-review Configuration req...
(FIX_RESOLVE)
🔇 Additional comments (7)
README.md (3)
8-10: Keep the draft configuration workflow out of active README instructions.These lines present guided configuration as available. Lines 209-214 correctly mark
configas release-gated, andDISTRIBUTION_CHANNELS.mdLines 11-12 mark it as not user-facing. The README therefore gives conflicting release guidance. The current official CLI reference documentscr config validatebut does not documentconfig --generate. (docs.coderabbit.ai)Remove the active Quickstart and Usage triggers, or label all configuration instructions as unreleased until the required CLI commands are available.
As per path instructions, keep public installation guidance and release status mutually consistent.
Also applies to: 25-29, 159-160
Source: Path instructions
152-158: LGTM!
209-229: LGTM!CHANGELOG.md (1)
9-11: LGTM!skills/config/SKILL.md (1)
3-15: LGTM!Also applies to: 17-20, 38-45, 59-63, 100-113
skills/config/agents/openai.yaml (1)
1-4: LGTM!skills/config/references/detailed-discovery.md (1)
1-63: LGTM!
nehal-a2z
changed the title
1 participant
Summary
Adds a solutions-assisted CodeRabbit onboarding suite:
/onboard— evidence-backed readiness, exact admin handoffs, and optional first-review proof./config— Standard CLI setup or a patient Detailed proposal through CLI inspect, validation, dry-run, base-hash checking, and apply./connect— permission-aware Jira/Linear, MCP, linked-repository, and reporting setup without handling credentials or pretending YAML proves connection health.All three skills are thin skins over the CodeRabbit CLI and backend. They do not create pull requests, edit YAML directly, copy schema/default logic, mutate dashboard state without approval, or invent remote state the product cannot verify.
Assisted distribution boundary
These are intentionally not part of the default skill package:
solutions/, outside the conventionalskills/package root used bynpx skills, native plugins, andcoderabbit skillsrelease extraction./solutions/ export-ignoreexcludes them from tagged release archives.skills/bundle remains exactlyautofixandcode-review.An intentional assisted engagement can install one from its exact tree URL and exact skill name; the commands live only in the maintainer-facing distribution inventory.
Safety contract
Unknownand becomes an explicit human handoff./configlets the central-aware guided CLI create a first sparse file before Detailed mode proposes broader changes./connectdistinguishes live connection state from repository usage settings./onboardnever creates a synthetic change, branch, commit, or pull request to prove setup.References
Current acceptance (2026-09-07)
Earlier validation
quick_validate.py solutions/onboard— PASS.quick_validate.py solutions/config— PASS.quick_validate.py solutions/connect— PASS.jq empty .claude-plugin/plugin.json .cursor-plugin/plugin.json gemini-extension.json plugin.json— PASS.coderabbit config validate .coderabbit.yaml— PASS against the current official schema.git diff --check— PASS.npx --yes skills add . --list— PASS; lists onlyautofixandcode-review./configinstall — PASS;SKILL.md, OpenAI metadata, and Detailed reference copied.skills/autofixandskills/code-review, with nosolutions/entries./onboardand/connectproduced honest handoffs under no-write/no-auth constraints, and/configrefused to bypass an older CLI missing the required protocol.Release state
Keep this PR draft until the required guided configuration CLI is in an official release. The suite remains unbundled even after merge and is shared only by exact path for intentional assisted use.
Summary by CodeRabbit
New Features
/onboard,/config, and/connectskills for setup readiness, configuration management, and context integrations.Release Improvements