chore(ci): agent ci skills and nightly build - #201
Conversation
github-actions
Bot
added
scope(ci)
github_actions
📝 WalkthroughWalkthroughThe PR renames existing agent skills, adds CI failure investigation and upkeep workflows, implements deterministic upkeep task selection, and schedules daily CI runs. ChangesSkill naming and guidance
Scheduled CI debugging
Deterministic upkeep selection
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant select-task.js
participant Git remote
participant Repository filesystem
select-task.js->>Git remote: Check remote upkeep branches
Git remote-->>select-task.js: Return branch status
select-task.js->>Repository filesystem: Discover eligible task candidates
Repository filesystem-->>select-task.js: Return candidate metadata
select-task.js-->>select-task.js: Rank and emit one task
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/skills/agent-debug-ci/SKILL.md:
- Around line 65-79: Update the `pnpm run ci:reset` instruction in the debugging
workflow to invoke the command through `mise exec`, consistent with the other
repository toolchain commands. Preserve the existing guidance to use it only
when stale generated output or cache state is indicated.
- Around line 87-88: Update the workflow guidance in the relevant debugging
instructions so agents explicitly fetch or refresh origin/main before verifying
the failure or creating a fix branch, then base all investigation on that
updated reference.
In @.agents/skills/agent-upkeep/scripts/select-task.js:
- Around line 109-114: Update inFlightBranches so any failure from the git fetch
refresh is propagated or causes a non-zero exit instead of being swallowed. Only
perform the upkeep branch selection after the remote branch list has been
refreshed successfully; preserve the existing branch detection behavior on
successful fetches.
- Around line 260-270: Update the test-discovery regex in the source-scanning
logic to match only it.skip, it.todo, it.fails, test.skip, test.todo, and
test.fails calls. Exclude describe and all other suite-level modifiers while
preserving the existing candidate construction, title extraction, and
visual-baseline weighting behavior.
In @.agents/skills/agent-upkeep/SKILL.md:
- Line 12: Update the pull-request contract in the agent-upkeep skill to allow
an authenticated GitHub integration/tool for creating draft pull requests and
applying the required upkeep label; alternatively, explicitly change the
workflow to stop after pushing the branch and remove any requirements that
cannot be fulfilled with git-only tooling.
- Around line 29-47: Ensure coverage task selection uses fresh coverage data:
update .agents/skills/agent-upkeep/SKILL.md lines 29-47 to make coverage
generation or freshness validation occur before selection, and update
.agents/skills/agent-upkeep/scripts/select-task.js lines 174-188 to generate or
validate fresh coverage before ranking candidates, emitting no coverage task
when freshness cannot be established.
- Around line 67-90: Make Mode A actionable by requiring selector-provided
package targets and invocation context instead of emitting only the shared
ESLint config. Update .agents/skills/agent-upkeep/SKILL.md lines 67-90 to
instruct agents to use only the affected packages, working directories, and
suppression-file locations supplied by the selector. Update
.agents/skills/agent-upkeep/scripts/select-task.js lines 318-326 to discover and
emit that complete package-specific context, including each workingDirectory and
suppressionsFile; no direct change is needed elsewhere.
In @.github/workflows/ci.yml:
- Around line 8-10: Update the scheduled workflow cron expression under schedule
to run at an off-hour minute, such as 01:17 America/Chicago, instead of exactly
01:00. Preserve the existing daily cadence and timezone.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: ca576ddf-97f4-4bcf-ae83-98826b951ebf
📒 Files selected for processing (6)
.agents/skills/agent-availability-report/SKILL.md.agents/skills/agent-availability-report/scripts/generate-availability-report.js.agents/skills/agent-debug-ci/SKILL.md.agents/skills/agent-upkeep/SKILL.md.agents/skills/agent-upkeep/scripts/select-task.js.github/workflows/ci.yml
| Run the selection script first. Always. Treat it as the source of truth for what to work on: | ||
|
|
||
| ```shell | ||
| node .agents/skills/agent-upkeep/scripts/select-task.js | ||
| ``` | ||
|
|
||
| The script is authoritative for: | ||
|
|
||
| - task type rotation and priority order | ||
| - in-flight detection, read from unmerged `upkeep/*` branches on the remote | ||
| - the list of lint rules that are currently off and their difficulty ranking | ||
| - candidate discovery and ranking for every task | ||
| - the guardrail values echoed back to you | ||
|
|
||
| Every task in the rotation can fall through when it has no work, so the script always emits a concrete `target` or exits non-zero. The script has no third outcome. | ||
|
|
||
| Do not restate the script's lists in this file and do not second-guess the selection. If the script needs to change, change the script. | ||
|
|
||
| The script prints a JSON object. Read `task`, `target`, and `rationale`, then follow the matching section below. If it exits non-zero, stop and report the reason without opening a pull request. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
Coverage selection can be based on stale reports. The skill requires running the selector first, while the selector ranks whatever coverage JSON already exists; the later “generate fresh coverage first” instruction is therefore unreachable before target selection.
.agents/skills/agent-upkeep/SKILL.md#L29-L47: revise the order so coverage is generated before coverage candidate selection, or make freshness an explicit prerequisite..agents/skills/agent-upkeep/scripts/select-task.js#L174-L188: generate or validate fresh coverage before ranking candidates; otherwise do not emit a coverage task.
🧰 Tools
🪛 SkillSpector (2.4.4)
[warning] 55: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 107: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 169: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 238: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 239: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 240: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 241: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 177: [MP2] Context Window Stuffing: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Remediation: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
(Memory Poisoning (MP2))
[error] 63: [P2] Hidden Instructions: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Remediation: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
(Prompt Injection (P2))
📍 Affects 2 files
.agents/skills/agent-upkeep/SKILL.md#L29-L47(this comment).agents/skills/agent-upkeep/scripts/select-task.js#L174-L188
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/agent-upkeep/SKILL.md around lines 29 - 47, Ensure coverage
task selection uses fresh coverage data: update
.agents/skills/agent-upkeep/SKILL.md lines 29-47 to make coverage generation or
freshness validation occur before selection, and update
.agents/skills/agent-upkeep/scripts/select-task.js lines 174-188 to generate or
validate fresh coverage before ranking candidates, emitting no coverage task
when freshness cannot be established.
b9a7e1c to
f225bf5
Compare
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/skills/agent-debug-ci/SKILL.md:
- Around line 31-37: Update the documented gh run view --log-failed command to
include the resolved attempt number when inspecting rerun workflows. Use the
attempt value returned by the preceding run metadata query, while preserving the
existing run identifier and failed-log behavior.
- Around line 69-75: Update the scheduled CI reproduction guidance in the skill
to run both commands with PAGES_BASE_URL="/elements/": pnpm run ci followed by
projects/internals/ci/cache-validate.js ci only after the first succeeds.
Preserve the existing isolation and environment-matching guidance while
documenting the complete command sequence.
In @.agents/skills/agent-upkeep/scripts/select-task.js:
- Around line 315-325: Preserve Mode B suppression-file context by updating
suppressionCandidates output handling in select-task.js
(.agents/skills/agent-upkeep/scripts/select-task.js:315-325) to emit
suppressionsFile relative to workingDirectory or as an absolute path. Update the
Mode B pruning commands in .agents/skills/agent-upkeep/SKILL.md:67-70 and
:94-101 to pass this value to --prune-suppressions using
--suppressions-location.
In @.agents/skills/agent-upkeep/SKILL.md:
- Line 120: Add the `text` language identifier to the fenced Markdown blocks at
the referenced locations in `SKILL.md`, including the block around line 120 and
the additional blocks around lines 190 and 205, while preserving their contents.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: fd2a9709-e599-4fa4-9efd-d741c185d2dd
📒 Files selected for processing (6)
.agents/skills/agent-availability-report/SKILL.md.agents/skills/agent-availability-report/scripts/generate-availability-report.js.agents/skills/agent-debug-ci/SKILL.md.agents/skills/agent-upkeep/SKILL.md.agents/skills/agent-upkeep/scripts/select-task.js.github/workflows/ci.yml
| Useful commands include: | ||
|
|
||
| ```shell | ||
| gh run view <run-id> \ | ||
| --json databaseId,attempt,event,headBranch,headSha,status,conclusion,url,workflowName,jobs | ||
| gh run view <run-id> --log-failed | ||
| ``` |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/sh
set -eu
printf '%s\n' '--- .agents/skills/agent-debug-ci/SKILL.md ---'
nl -ba .agents/skills/agent-debug-ci/SKILL.md | sed -n '1,110p'
printf '%s\n' '--- gh run view references ---'
rg -n -C 4 -- '--attempt|--log-failed|gh run view' .agents .github 2>/dev/null || trueRepository: NVIDIA/elements
Length of output: 1082
🌐 Web query:
GitHub CLI gh run view --attempt --log-failed official manual
💡 Result:
The gh run view command in the GitHub CLI is used to display a summary or logs of a specific workflow run [1][2]. Regarding the flags you mentioned: --attempt : This flag allows you to specify the attempt number of the workflow run you wish to view [1][3]. It defaults to 0 (typically representing the latest attempt) [1]. This is useful for accessing logs or summaries of previous run attempts that are no longer the most recent [4]. --log-failed: This flag is used to view the logs specifically for any failed steps within a workflow run or a specific job [1][5]. Common usage examples include: View a specific run attempt: gh run view --attempt View failed logs for a run: gh run view --log-failed View failed logs for a specific job: gh run view --job --log-failed You can combine these with other flags like --job to narrow your focus to a specific part of the workflow, or --exit-status to have the command return a non-zero exit code if the run failed, which is useful for automation and CI/CD pipelines [1][2][5].
Citations:
- 1: https://cli.github.com/manual/gh_run_view
- 2: https://github.com/github/docs/blob/main/content/actions/how-tos/monitor-workflows/view-workflow-run-history.md
- 3: https://manpages.ubuntu.com/manpages/stonking/man1/gh-run-view.1.html
- 4:
gh run view --attemptcli/cli#6088 - 5: https://manpages.debian.org/bookworm/gh/gh-run-view.1.en.html
🏁 Script executed:
#!/bin/sh
set -eu
nl -ba .agents/skills/agent-debug-ci/SKILL.md | sed -n '1,110p'
rg -n -C 4 -- '--attempt|--log-failed|gh run view' .agents .github 2>/dev/null || trueRepository: NVIDIA/elements
Length of output: 1004
Pass the resolved attempt to --log-failed.
If the run was rerun, the command can inspect the latest attempt instead of the triggering attempt.
Proposed fix
-gh run view <run-id> --log-failed
+gh run view <run-id> --attempt <attempt> --log-failed📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| Useful commands include: | |
| ```shell | |
| gh run view <run-id> \ | |
| --json databaseId,attempt,event,headBranch,headSha,status,conclusion,url,workflowName,jobs | |
| gh run view <run-id> --log-failed | |
| ``` | |
| Useful commands include: | |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/agent-debug-ci/SKILL.md around lines 31 - 37, Update the
documented gh run view --log-failed command to include the resolved attempt
number when inspecting rerun workflows. Use the attempt value returned by the
preceding run metadata query, while preserving the existing run identifier and
failed-log behavior.
| - For standard CI failures, isolate the failing project or test before running | ||
| `mise exec -- pnpm run ci`. | ||
| - For Lighthouse failures, isolate the reported suite before running | ||
| `mise exec -- pnpm run lighthouse`. | ||
| - Read `projects/<name>/DEVELOPMENT.md` before using project-specific scripts. | ||
| - Match workflow environment variables, browser setup, shard, and concurrency | ||
| when they can affect the result. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- workflow files and relevant commands ---'
git ls-files '.github/workflows' '.agents/skills/agent-debug-ci/SKILL.md' 'package.json' 'projects/internals/ci/cache-validate.js'
printf '%s\n' '--- workflow context ---'
sed -n '1,80p' .github/workflows/ci.yml
printf '%s\n' '--- skill context ---'
sed -n '50,90p' .agents/skills/agent-debug-ci/SKILL.md
printf '%s\n' '--- package scripts and cache validator references ---'
rg -n -C 4 '"(ci|lighthouse)"|cache-validate|PAGES_BASE_URL' package.json projects/internals/ci .github/workflowsRepository: NVIDIA/elements
Length of output: 15284
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- cache validator implementation ---'
sed -n '1,100p' projects/internals/ci/cache-validate.js
printf '%s\n' '--- read-only workflow invariant check ---'
python3 - <<'PY'
from pathlib import Path
import re
workflow = Path(".github/workflows/ci.yml").read_text()
skill = Path(".agents/skills/agent-debug-ci/SKILL.md").read_text()
run = re.search(r"run:\s*(PAGES_BASE_URL=.*?node \./projects/internals/ci/cache-validate\.js ci)", workflow)
assert run, "The CI workflow does not contain the expected combined command"
command = run.group(1)
assert "PAGES_BASE_URL=\"/elements/\" pnpm run ci" in command
assert "PAGES_BASE_URL=\"/elements/\" node ./projects/internals/ci/cache-validate.js ci" in command
assert "&&" in command
validator = Path("projects/internals/ci/cache-validate.js").read_text()
assert "process.env.PAGES_BASE_URL" in validator
assert "pnpm run ${task}" in validator
assert "mise exec -- pnpm run ci" in skill
assert "cache-validate.js ci" not in skill
print("workflow command:", command)
print("skill documents the primary CI command but not cache validation: yes")
print("cache validator forwards PAGES_BASE_URL and reruns the requested task: yes")
PYRepository: NVIDIA/elements
Length of output: 2546
Reproduce the complete scheduled ci job.
When reproducing a scheduled CI failure, run both workflow commands with PAGES_BASE_URL="/elements/":
PAGES_BASE_URL="/elements/" pnpm run ci &&
PAGES_BASE_URL="/elements/" node ./projects/internals/ci/cache-validate.js ciThe skill currently documents only the first command.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/agent-debug-ci/SKILL.md around lines 69 - 75, Update the
scheduled CI reproduction guidance in the skill to run both commands with
PAGES_BASE_URL="/elements/": pnpm run ci followed by
projects/internals/ci/cache-validate.js ci only after the first succeeds.
Preserve the existing isolation and environment-matching guidance while
documenting the complete command sequence.
| const { candidates, total } = await suppressionCandidates(root); | ||
| const [burndown] = candidates; | ||
| if (burndown) { | ||
| return emit({ | ||
| task, | ||
| mode: 'B', | ||
| rule: burndown.rule, | ||
| target: path.relative(root, burndown.file), | ||
| suppressionsFile: path.relative(root, burndown.suppressionsFile), | ||
| workingDirectory: path.relative(root, burndown.dir) || '.', | ||
| remainingSuppressions: total, |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- lint command locations ---'
fd -HI -t f '^package\.json$' projects -x jq -r '
(.wireit // {})
| to_entries[]
| select(.key == "lint" or (.key | startswith("lint:")))
| select((.value.command // "") | test("(^|\\s)eslint(\\s|$)"))
| "\(input_filename)\t\(.value.command)"
'
printf '%s\n' '--- suppression files ---'
fd -HI -t f '^eslint-suppressions\.json$' . | sortRepository: NVIDIA/elements
Length of output: 25608
🏁 Script executed:
set -euo pipefail
printf '%s\n' '--- selector structure ---'
sed -n '1,380p' .agents/skills/agent-upkeep/scripts/select-task.js
printf '%s\n' '--- upkeep instructions ---'
sed -n '1,130p' .agents/skills/agent-upkeep/SKILL.md
printf '%s\n' '--- suppression-related references ---'
rg -n --hidden -S 'suppressionsFile|suppressions-location|prune-suppressions|suppressionCandidates|workingDirectory' \
.agents package.json pnpm-workspace.yaml projects 2>/dev/null | head -300
printf '%s\n' '--- package and suppression files ---'
git ls-files '*package.json' '*eslint-suppressions.json' | head -300Repository: NVIDIA/elements
Length of output: 26443
🏁 Script executed:
set -euo pipefail
python3 - <<'PY'
import json
from pathlib import Path
import re
for p in sorted(Path("projects").rglob("package.json")):
data = json.loads(p.read_text())
for name, cfg in (data.get("wireit") or {}).items():
command = cfg.get("command") if isinstance(cfg, dict) else None
if name == "lint" or name.startswith("lint:"):
if isinstance(command, str) and re.search(r"(?:^|\s)eslint(?:\s|$)", command):
m = re.search(r'''(?:^|\s)--suppressions-location(?:=|\s+)(?:"([^"]+)"|'([^']+)'|(\S+))''', command)
print(f"{p}\t{name}\t{command}\tlocation={next((x for x in m.groups() if x is not None), 'eslint-suppressions.json') if m else 'eslint-suppressions.json'}")
print("--- suppression files on disk ---")
for p in sorted(Path(".").rglob("eslint-suppressions.json")):
if not any(part in {".git", "node_modules", "dist", "build", "coverage"} for part in p.parts):
print(p)
PY
printf '%s\n' '--- exact relevant lines ---'
cat -n .agents/skills/agent-upkeep/scripts/select-task.js | sed -n '208,232p;310,330p'
cat -n .agents/skills/agent-upkeep/SKILL.md | sed -n '64,104p'
printf '%s\n' '--- path resolution probe ---'
python3 - <<'PY'
from pathlib import Path
root = Path("/repo")
working = root / "projects" / "core"
repo_relative = Path("projects/core/eslint-suppressions.json")
package_relative = Path("eslint-suppressions.json")
print("Mode B emitted path:", repo_relative)
print("Mode B resolved from workingDirectory:", working / repo_relative)
print("Mode B intended file:", root / repo_relative)
print("Mode A default resolved from workingDirectory:", working / package_relative)
PYRepository: NVIDIA/elements
Length of output: 13234
Preserve Mode B suppression-file context.
select-task.js emits suppressionsFile relative to the repository root, but SKILL.md runs pruning from workingDirectory. A nested Mode B task therefore resolves the path incorrectly. Emit the path relative to workingDirectory or as an absolute path, and pass it to --prune-suppressions with --suppressions-location.
📍 Affects 2 files
.agents/skills/agent-upkeep/scripts/select-task.js#L315-L325(this comment).agents/skills/agent-upkeep/SKILL.md#L67-L70.agents/skills/agent-upkeep/SKILL.md#L94-L101
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/agent-upkeep/scripts/select-task.js around lines 315 - 325,
Preserve Mode B suppression-file context by updating suppressionCandidates
output handling in select-task.js
(.agents/skills/agent-upkeep/scripts/select-task.js:315-325) to emit
suppressionsFile relative to workingDirectory or as an absolute path. Update the
Mode B pruning commands in .agents/skills/agent-upkeep/SKILL.md:67-70 and
:94-101 to pass this value to --prune-suppressions using
--suppressions-location.
|
|
||
| Once you fix a suppressed violation, ESLint exits **non-zero** with: | ||
|
|
||
| ``` |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Add language identifiers to fenced blocks.
markdownlint-cli2 reports MD040 for these blocks. Mark them as text.
Proposed fix
- ```
+ ```textAlso applies to: 190-190, 205-205
🧰 Tools
🪛 markdownlint-cli2 (0.23.1)
[warning] 120-120: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🪛 SkillSpector (2.4.4)
[warning] 53: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 105: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 167: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 236: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 237: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 238: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 239: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 175: [MP2] Context Window Stuffing: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Remediation: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
(Memory Poisoning (MP2))
[error] 61: [P2] Hidden Instructions: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Remediation: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
(Prompt Injection (P2))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/agent-upkeep/SKILL.md at line 120, Add the `text` language
identifier to the fenced Markdown blocks at the referenced locations in
`SKILL.md`, including the block around line 120 and the additional blocks around
lines 190 and 205, while preserving their contents.
Source: Linters/SAST tools
Signed-off-by: Cory Rylan <crylan@nvidia.com>
f225bf5 to
40f9f03
Compare
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/skills/agent-availability-report/SKILL.md:
- Line 2: Update renamed skill references in
.agents/skills/agent-upkeep/SKILL.md to use authoring-tests,
authoring-typescript, audit-code, and audit-accessibility instead of the old
identifiers. Align the metadata in .agents/skills/guidance-build-system/SKILL.md
(line 2) with name: guidance-build. The other cited metadata
sites—.agents/skills/agent-availability-report/SKILL.md (line 2),
.agents/skills/audit-accessibility/SKILL.md (line 2),
.agents/skills/audit-ci/SKILL.md (line 2),
.agents/skills/authoring-typescript/SKILL.md (line 2), and
.agents/skills/guidance-api-design/SKILL.md (line 2)—require no direct changes.
In @.agents/skills/agent-upkeep/scripts/select-task.js:
- Around line 271-280: Restrict automatic bug candidates in
.agents/skills/agent-upkeep/scripts/select-task.js lines 271-280 to it.skip and
test.skip, unless the emitted kind includes distinct executable steps for other
kinds. Update .agents/skills/agent-upkeep/SKILL.md lines 134-146 with separate
validation procedures before permitting .todo or .fails tasks; ensure .todo and
.fails are not treated like unskippable tests.
- Around line 221-228: Update the suppression candidate construction in the
Object.entries(data) loop to resolve each file and reject it when
path.relative(root, resolvedFile) indicates it escapes the repository root,
including absolute or parent-traversal keys. Only add candidates for
root-contained paths; preserve the existing count filtering and candidate fields
for valid files.
In @.agents/skills/agent-upkeep/SKILL.md:
- Around line 17-18: Update the scope rules in the Mode A guidance to explicitly
allow editing the shared ESLint config under projects/internals/ and
selector-provided generated suppression files in other projects, while requiring
hand-fixed source changes to remain within one project. Preserve the existing
four-file and 150-line diff cap.
In @.agents/skills/audit-accessibility/SKILL.md:
- Line 41: Update the visual-variant testing guidance in the accessibility skill
to require status and size coverage for all applicable components, while making
disabled-state tests conditional on whether the component supports disabled
behavior.
In @.agents/skills/audit-code/SKILL.md:
- Around line 2-6: Update all renamed skill references in
.agents/skills/agent-upkeep/SKILL.md: replace testing with authoring-tests at
lines 53 and 236, typescript with authoring-typescript at lines 105 and 237,
code-review with audit-code at lines 167 and 238, and accessibility with
audit-accessibility at line 239. The anchor .agents/skills/audit-code/SKILL.md
lines 2-6 and sibling .agents/skills/authoring-tests/SKILL.md lines 2-6 require
no direct changes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 8035479e-715b-437e-b0e8-04b1f804a3f5
📒 Files selected for processing (18)
.agents/skills/agent-availability-report/SKILL.md.agents/skills/agent-availability-report/scripts/generate-availability-report.js.agents/skills/agent-debug-ci/SKILL.md.agents/skills/agent-upkeep/SKILL.md.agents/skills/agent-upkeep/scripts/select-task.js.agents/skills/audit-accessibility/SKILL.md.agents/skills/audit-ci/SKILL.md.agents/skills/audit-ci/references/optimization-playbook.md.agents/skills/audit-code/SKILL.md.agents/skills/authoring-components/SKILL.md.agents/skills/authoring-documentation/SKILL.md.agents/skills/authoring-examples/SKILL.md.agents/skills/authoring-patterns/SKILL.md.agents/skills/authoring-tests/SKILL.md.agents/skills/authoring-typescript/SKILL.md.agents/skills/guidance-api-design/SKILL.md.agents/skills/guidance-build-system/SKILL.md.github/workflows/ci.yml
| @@ -1,9 +1,9 @@ | |||
| --- | |||
| name: availability-report | |||
| name: agent-availability-report | |||
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
git diff --unified=0 -- '.agents/skills/*/SKILL.md' | rg '^[+-]name:'
rg -nP --hidden --glob '!.git/**' --glob '!node_modules/**' \
'(?<![\w-])(?:availability-report|agent-availability-report|accessibility|audit-accessibility|profile-ci|audit-ci|api-design|guidance-api-design|build-system|guidance-build(?:-system)?|authoring-typescript)(?![\w-])' .
python3 - <<'PY'
from pathlib import Path
for skill_file in Path(".agents/skills").glob("*/SKILL.md"):
name = next(
(line.split(":", 1)[1].strip()
for line in skill_file.read_text().splitlines()
if line.startswith("name:")),
None,
)
if name and name != skill_file.parent.name:
print(f"{skill_file}: name={name!r}, directory={skill_file.parent.name!r}")
PYRepository: NVIDIA/elements
Length of output: 153
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- changed skill metadata ---'
git diff --unified=3 -- .agents/skills/*/SKILL.md | sed -n '/^diff --git/,$p' | rg -n '^(diff --git|@@|[-+]name:)' || true
printf '%s\n' '--- target metadata and directories ---'
for f in \
.agents/skills/agent-availability-report/SKILL.md \
.agents/skills/audit-accessibility/SKILL.md \
.agents/skills/audit-ci/SKILL.md \
.agents/skills/authoring-typescript/SKILL.md \
.agents/skills/guidance-api-design/SKILL.md \
.agents/skills/guidance-build-system/SKILL.md
do
if test -f "$f"; then
printf '\n%s\n' "$f"
sed -n '1,8p' "$f"
else
printf '\nMISSING %s\n' "$f"
fi
done
printf '%s\n' '--- all skill metadata mismatches ---'
python3 - <<'PY'
from pathlib import Path
for skill_file in sorted(Path(".agents/skills").glob("*/SKILL.md")):
name = next(
(line.split(":", 1)[1].strip()
for line in skill_file.read_text().splitlines()
if line.startswith("name:")),
None,
)
if name is not None:
print(f"{skill_file}: name={name!r}, directory={skill_file.parent.name!r}, "
f"match={name == skill_file.parent.name}")
PY
printf '%s\n' '--- references to old and new identifiers ---'
rg -n --hidden --glob '!.git/**' --glob '!node_modules/**' \
-e 'availability-report' \
-e 'agent-availability-report' \
-e 'accessibility' \
-e 'audit-accessibility' \
-e 'profile-ci' \
-e 'audit-ci' \
-e 'api-design' \
-e 'guidance-api-design' \
-e 'build-system' \
-e 'guidance-build' \
-e 'authoring-typescript' \
. || trueRepository: NVIDIA/elements
Length of output: 50371
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- repository state ---'
git status --short
git diff --stat HEAD^ HEAD -- .agents/skills 2>/dev/null || true
git diff --name-status HEAD^ HEAD -- .agents/skills 2>/dev/null || true
printf '%s\n' '--- previous and current skill directories ---'
printf '%s\n' 'HEAD^:'
git ls-tree -d --name-only HEAD^ .agents/skills/* 2>/dev/null || true
printf '%s\n' 'HEAD:'
git ls-tree -d --name-only HEAD .agents/skills/* 2>/dev/null || true
printf '%s\n' '--- exact skill-link references under agent configuration ---'
rg -n --hidden --glob '!.git/**' --glob '!node_modules/**' \
'(/|`)(availability-report|agent-availability-report|accessibility|audit-accessibility|profile-ci|audit-ci|api-design|guidance-api-design|build-system|guidance-build|guidance-build-system|authoring-typescript)(/SKILL\.md|`|[[:space:])])' \
.agents AGENTS.md 2>/dev/null || true
printf '%s\n' '--- all SKILL.md links under the repository ---'
rg -n --hidden --glob '!.git/**' --glob '!node_modules/**' \
'/\.agents/skills/[^ )>`\"]+/SKILL\.md|\.agents/skills/[^ )>`\"]+/SKILL\.md' \
. 2>/dev/null | head -200 || true
printf '%s\n' '--- context for the known old accessibility link ---'
sed -n '225,248p' .agents/skills/agent-upkeep/SKILL.mdRepository: NVIDIA/elements
Length of output: 7023
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
import re
renames = {
"availability-report": "agent-availability-report",
"accessibility": "audit-accessibility",
"profile-ci": "audit-ci",
"code-review": "audit-code",
"component-creation": "authoring-components",
"documentation": "authoring-documentation",
"examples": "authoring-examples",
"pattern-creation": "authoring-patterns",
"testing": "authoring-tests",
"typescript": "authoring-typescript",
"api-design": "guidance-api-design",
"build-system": "guidance-build",
}
pattern = re.compile(r"(?<![\w-])(?:"
+ "|".join(map(re.escape, renames))
+ r")(?![\w-])")
print("--- old skill identifiers outside renamed paths ---")
for path in sorted(Path(".").rglob("*")):
if not path.is_file() or ".git" in path.parts or "node_modules" in path.parts:
continue
try:
text = path.read_text()
except (UnicodeDecodeError, OSError):
continue
matches = [(i, line) for i, line in enumerate(text.splitlines(), 1)
if pattern.search(line)]
if matches:
print(path)
for line_no, line in matches:
print(f" {line_no}: {line}")
print("--- current skill inventory ---")
for path in sorted(Path(".agents/skills").glob("*/SKILL.md")):
name = next((line.split(":", 1)[1].strip()
for line in path.read_text().splitlines()
if line.startswith("name:")), None)
print(f"{path.parent.name}: {name}")
PY
printf '%s\n' '--- all changed skill-document references ---'
git diff HEAD^ HEAD -- .agents/skills/agent-upkeep/SKILL.md \
.agents/skills/agent-availability-report/SKILL.md \
.agents/skills/audit-accessibility/SKILL.md \
.agents/skills/audit-ci/SKILL.md \
.agents/skills/authoring-typescript/SKILL.md \
.agents/skills/guidance-api-design/SKILL.md \
.agents/skills/guidance-build-system/SKILL.md |
rg -n '^[+-].*(skills/|name:|availability-report|accessibility|profile-ci|code-review|testing|typescript|api-design|build-system)' || trueRepository: NVIDIA/elements
Length of output: 50372
🏁 Script executed:
#!/bin/bash
set -euo pipefail
log=/tmp/coderabbit-shell-logs/shell-output-LVZtbN
printf '%s\n' '--- section markers ---'
rg -n -- '--- old skill identifiers|--- current skill inventory|--- all changed skill-document references' "$log" || true
printf '%s\n' '--- relevant old skill path references ---'
rg -n --glob '!*.map' \
'\.agents/skills/(availability-report|accessibility|profile-ci|code-review|component-creation|documentation|examples|pattern-creation|testing|typescript|api-design|build-system)/SKILL\.md' \
"$log" | head -100 || true
printf '%s\n' '--- changed skill-document reference output ---'
line=$(rg -n -- '--- all changed skill-document references' "$log" | head -1 | cut -d: -f1 || true)
if test -n "${line:-}"; then
sed -n "${line},$((line+120))p" "$log"
fiRepository: NVIDIA/elements
Length of output: 6574
Update renamed skill references and align build skill metadata.
- In
.agents/skills/agent-upkeep/SKILL.md, replacetesting,typescript,code-review, andaccessibilitylinks withauthoring-tests,authoring-typescript,audit-code, andaudit-accessibility. - Align
.agents/skills/guidance-build-system/SKILL.mdwith itsname: guidance-buildidentifier.
📍 Affects 6 files
.agents/skills/agent-availability-report/SKILL.md#L2-L2(this comment).agents/skills/audit-accessibility/SKILL.md#L2-L2.agents/skills/audit-ci/SKILL.md#L2-L2.agents/skills/authoring-typescript/SKILL.md#L2-L2.agents/skills/guidance-api-design/SKILL.md#L2-L2.agents/skills/guidance-build-system/SKILL.md#L2-L2
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/agent-availability-report/SKILL.md at line 2, Update renamed
skill references in .agents/skills/agent-upkeep/SKILL.md to use authoring-tests,
authoring-typescript, audit-code, and audit-accessibility instead of the old
identifiers. Align the metadata in .agents/skills/guidance-build-system/SKILL.md
(line 2) with name: guidance-build. The other cited metadata
sites—.agents/skills/agent-availability-report/SKILL.md (line 2),
.agents/skills/audit-accessibility/SKILL.md (line 2),
.agents/skills/audit-ci/SKILL.md (line 2),
.agents/skills/authoring-typescript/SKILL.md (line 2), and
.agents/skills/guidance-api-design/SKILL.md (line 2)—require no direct changes.
| for (const [file, rules] of Object.entries(data)) { | ||
| if (!rules || typeof rules !== 'object') continue; | ||
| for (const [rule, entry] of Object.entries(rules)) { | ||
| const count = entry?.count ?? 0; | ||
| if (count < 1) continue; | ||
| total += count; | ||
| candidates.push({ suppressionsFile, dir, file: path.resolve(dir, file), rule, count }); | ||
| } |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Reject suppression targets outside the repository root.
file comes from eslint-suppressions.json. Line 227 resolves it without a root-boundary check. A ../../ or absolute key can make the selector emit a target outside the checkout and direct the upkeep agent to modify it.
Fail closed when path.relative(root, resolvedFile) escapes root.
Proposed fix
for (const [rule, entry] of Object.entries(rules)) {
const count = entry?.count ?? 0;
if (count < 1) continue;
+ const resolvedFile = path.resolve(dir, file);
+ const relativeFile = path.relative(root, resolvedFile);
+ if (
+ relativeFile === '..' ||
+ relativeFile.startsWith(`..${path.sep}`) ||
+ path.isAbsolute(relativeFile)
+ ) {
+ fail(`suppression target escapes repository root: ${file}`);
+ }
total += count;
- candidates.push({ suppressionsFile, dir, file: path.resolve(dir, file), rule, count });
+ candidates.push({ suppressionsFile, dir, file: resolvedFile, rule, count });
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| for (const [file, rules] of Object.entries(data)) { | |
| if (!rules || typeof rules !== 'object') continue; | |
| for (const [rule, entry] of Object.entries(rules)) { | |
| const count = entry?.count ?? 0; | |
| if (count < 1) continue; | |
| total += count; | |
| candidates.push({ suppressionsFile, dir, file: path.resolve(dir, file), rule, count }); | |
| } | |
| for (const [file, rules] of Object.entries(data)) { | |
| if (!rules || typeof rules !== 'object') continue; | |
| for (const [rule, entry] of Object.entries(rules)) { | |
| const count = entry?.count ?? 0; | |
| if (count < 1) continue; | |
| const resolvedFile = path.resolve(dir, file); | |
| const relativeFile = path.relative(root, resolvedFile); | |
| if ( | |
| relativeFile === '..' || | |
| relativeFile.startsWith(`..${path.sep}`) || | |
| path.isAbsolute(relativeFile) | |
| ) { | |
| fail(`suppression target escapes repository root: ${file}`); | |
| } | |
| total += count; | |
| candidates.push({ suppressionsFile, dir, file: resolvedFile, rule, count }); | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/agent-upkeep/scripts/select-task.js around lines 221 - 228,
Update the suppression candidate construction in the Object.entries(data) loop
to resolve each file and reject it when path.relative(root, resolvedFile)
indicates it escapes the repository root, including absolute or parent-traversal
keys. Only add candidates for root-contained paths; preserve the existing count
filtering and candidate fields for valid files.
| source.split('\n').forEach((line, index) => { | ||
| const match = /\b(?:it|test)\.(skip|todo|fails)\s*\(\s*(['"`])(.+?)\2/.exec(line); | ||
| if (!match) return; | ||
| candidates.push({ | ||
| file, | ||
| line: index + 1, | ||
| kind: match[1], | ||
| title: match[3], | ||
| // Visual baselines are off limits for this agent, so rank those last. | ||
| weight: file.includes('.test.visual.') ? 1 : 0 |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Select only test kinds that the bug procedure can execute.
The selector emits .skip, .todo, and .fails candidates. The procedure only works for .skip: a .todo has no test body to unskip, and a .fails test already runs with inverse pass/fail semantics.
.agents/skills/agent-upkeep/scripts/select-task.js#L271-L280: restrict automatic bug candidates toit.skipandtest.skip, or emit the candidate kind with separate required steps..agents/skills/agent-upkeep/SKILL.md#L134-L146: add separate validation procedures before permitting.todoor.failstasks.
🧰 Tools
🪛 OpenGrep (1.26.0)
[ERROR] 272-272: Dynamic command passed to child_process.exec/execSync. Use child_process.execFile or spawn with an argument array instead.
(coderabbit.command-injection.exec-js)
📍 Affects 2 files
.agents/skills/agent-upkeep/scripts/select-task.js#L271-L280(this comment).agents/skills/agent-upkeep/SKILL.md#L134-L146
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/agent-upkeep/scripts/select-task.js around lines 271 - 280,
Restrict automatic bug candidates in
.agents/skills/agent-upkeep/scripts/select-task.js lines 271-280 to it.skip and
test.skip, unless the emitted kind includes distinct executable steps for other
kinds. Update .agents/skills/agent-upkeep/SKILL.md lines 134-146 with separate
validation procedures before permitting .todo or .fails tasks; ensure .todo and
.fails are not treated like unskippable tests.
| 2. **One file, or one tightly coupled module.** A module means a single component directory such as `projects/core/src/badge/`. Never span projects. | ||
| 3. **Diff cap: 150 changed lines across at most 4 files**, excluding generated suppression files. If your change exceeds this cap, shrink the scope or stop. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Make Mode A an explicit exception to the project-scope constraint.
Mode A edits the shared config under projects/internals/ and can generate suppression files for packages in other projects. This cannot comply with “Never span projects.”
Add a Mode A exception for the shared ESLint config and selector-provided generated suppression files. Keep the hand-fixed source file limited to one project.
Also applies to: 65-90
🧰 Tools
🪛 SkillSpector (2.4.4)
[warning] 53: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 105: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 167: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 236: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 237: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 238: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 239: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 175: [MP2] Context Window Stuffing: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Remediation: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
(Memory Poisoning (MP2))
[error] 61: [P2] Hidden Instructions: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Remediation: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
(Prompt Injection (P2))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/agent-upkeep/SKILL.md around lines 17 - 18, Update the scope
rules in the Mode A guidance to explicitly allow editing the shared ESLint
config under projects/internals/ and selector-provided generated suppression
files in other projects, while requiring hand-fixed source changes to remain
within one project. Preserve the existing four-file and 150-line diff cap.
|
|
||
| - Imports `runAxe` from `@internals/testing/axe` | ||
| - Tests all visual variants (status, size, disabled states) | ||
| - Tests all visual variants, including status, size, and the `disabled` state |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Make disabled-state coverage conditional.
Not every component supports a disabled state. Require tests for all supported visual variants, with disabled coverage when applicable.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/audit-accessibility/SKILL.md at line 41, Update the
visual-variant testing guidance in the accessibility skill to require status and
size coverage for all applicable components, while making disabled-state tests
conditional on whether the component supports disabled behavior.
| name: audit-code | ||
| description: Comprehensive code review process for Elements monorepo changes. Provides structured feedback on type safety, testing, documentation, and adherence to project guidelines. Use this skill whenever the user asks you to review code, check staged changes, look at a diff, give feedback before committing, review a PR or merge request, or assess code quality. Trigger on phrases like "review these changes," "check this code," "give feedback," "look at the staged files," "review this PR," or "before committing." | ||
| --- | ||
|
|
||
| # Code Review | ||
| # Audit Code |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
rg -n 'code-review|/testing/SKILL\.md|audit-code|authoring-tests' .agentsRepository: NVIDIA/elements
Length of output: 755
🏁 Script executed:
printf '%s\n' '--- skill files ---'
git ls-files '.agents/skills/*/SKILL.md' | sort
printf '%s\n' '--- downstream references ---'
sed -n '40,60p;155,175p;228,242p' .agents/skills/agent-upkeep/SKILL.md
printf '%s\n' '--- all relevant references ---'
rg -n --hidden -g '!node_modules' 'code-review|/testing/SKILL\.md|audit-code|authoring-tests' .agents
printf '%s\n' '--- legacy target existence ---'
for f in .agents/skills/code-review/SKILL.md .agents/skills/testing/SKILL.md .agents/skills/audit-code/SKILL.md .agents/skills/authoring-tests/SKILL.md; do
if [ -e "$f" ]; then printf 'exists %s\n' "$f"; else printf 'missing %s\n' "$f"; fi
doneRepository: NVIDIA/elements
Length of output: 5142
🏁 Script executed:
python3 - <<'PY'
import re
from pathlib import Path
source = Path(".agents/skills/agent-upkeep/SKILL.md")
text = source.read_text()
for line_no, line in enumerate(text.splitlines(), 1):
for target in re.findall(r'\]\((/\.agents/skills/[^)]+)\)', line):
relative = target.removeprefix("/")
exists = Path(relative).exists()
print(f"{line_no}: {'exists' if exists else 'missing'} {target}")
PYRepository: NVIDIA/elements
Length of output: 494
Update all renamed skill references in .agents/skills/agent-upkeep/SKILL.md.
Replace the missing paths:
/testing/SKILL.md→/authoring-tests/SKILL.mdat lines 53 and 236./typescript/SKILL.md→/authoring-typescript/SKILL.mdat lines 105 and 237./code-review/SKILL.md→/audit-code/SKILL.mdat lines 167 and 238./accessibility/SKILL.md→/audit-accessibility/SKILL.mdat line 239.
📍 Affects 2 files
.agents/skills/audit-code/SKILL.md#L2-L6(this comment).agents/skills/authoring-tests/SKILL.md#L2-L6
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/audit-code/SKILL.md around lines 2 - 6, Update all renamed
skill references in .agents/skills/agent-upkeep/SKILL.md: replace testing with
authoring-tests at lines 53 and 236, typescript with authoring-typescript at
lines 105 and 237, code-review with audit-code at lines 167 and 238, and
accessibility with audit-accessibility at line 239. The anchor
.agents/skills/audit-code/SKILL.md lines 2-6 and sibling
.agents/skills/authoring-tests/SKILL.md lines 2-6 require no direct changes.
Summary by CodeRabbit
New Features
Improvements