Skip to content

chore: skills signing batch 1#4438

Merged
miyoungc merged 10 commits into
mainfrom
export-nemoclaw-user-agent-skills
May 28, 2026
Merged

chore: skills signing batch 1#4438
miyoungc merged 10 commits into
mainfrom
export-nemoclaw-user-agent-skills

Conversation

@miyoungc
Copy link
Copy Markdown
Collaborator

@miyoungc miyoungc commented May 28, 2026

Summary

export nemoclaw user agent skills

Related Issue

Changes

Type of Change

  • Code change (feature, bug fix, or refactor)
  • Code change with doc updates
  • Doc only (prose changes, no code sample modifications)
  • Doc only (includes code sample changes)

Verification

  • npx prek run --all-files passes
  • npm test passes
  • Tests added or updated for new or changed behavior
  • No secrets, API keys, or credentials committed
  • Docs updated for user-facing behavior changes
  • npm run docs builds without warnings (doc changes only)
  • Doc pages follow the style guide (doc changes only)
  • New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Your Name your-email@example.com

Summary by CodeRabbit

  • Documentation
    • Added extensive NemoClaw user docs: overview, quickstart (Hermes + Windows), onboarding, inference/config/security guides, deployment/remote use, sandbox management/monitoring, network policy and troubleshooting, CLI/reference material, a generated-skills README, plus new evaluation datasets and catalog metadata for exported skills.
  • Chores
    • Removed one skill from the exported skills catalog.

Review Change Stack

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented May 28, 2026

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Removes nemoclaw-skills-guide from the catalog export allowlist, adds the generated skills README and catalog metadata, and introduces multiple exported skill bundles (SKILL.md, references, and evals) under skills/ for NemoClaw documentation and tests.

Changes

NemoClaw Generated Skills Export

Layer / File(s) Summary
Catalog allowlist configuration
.agents/catalog-skills.yaml
Removes nemoclaw-skills-guide from the export include allowlist so it is no longer exported into the NVIDIA Verified Skills catalog.
Catalog structure and metadata
skills/README.md, skills/catalog-metadata.json
Adds a generated README describing the skills directory and CI commands, and catalog-metadata.json with export provenance, content hashes, schema/version constraints, and the list of exported skill identifiers.
Agent skills bundle (SKILL, refs, evals)
skills/nemoclaw-user-agent-skills/*
Adds nemoclaw-user-agent-skills SKILL, the references/agent-skills.md guide, and three evaluation cases verifying agent-skill discovery and expected assistant behavior.
Get-started skill bundle, references, and evals
skills/nemoclaw-user-get-started/*
Adds nemoclaw-user-get-started SKILL, quickstart and provider references (prerequisites, quickstart details, Hermes, Windows), and an 11-case evaluation dataset.
Configure-inference skill, refs, and evals
skills/nemoclaw-user-configure-inference/*
Adds SKILL and multiple reference pages covering local inference (Ollama, vLLM, NIM), tool-calling reliability, sub-agent setup, switching providers, and evals validating doc-driven responses.
Configure-security skill, refs, and evals
skills/nemoclaw-user-configure-security/*
Adds security SKILL plus best-practices, credential-storage, and OpenClaw-controls reference pages and security-focused evaluation cases.
Deploy-remote skill, refs, and evals
skills/nemoclaw-user-deploy-remote/*
Adds nemoclaw-user-deploy-remote SKILL, Brev/plugin/hardening refs, and evals covering remote GPU deployment and post-deploy operations.
Manage-policy skill, refs, and evals
skills/nemoclaw-user-manage-policy/*
Adds network policy management SKILL, approve/customize/integration policy references, and evals for policy scenarios and operator approval workflows.
Manage-sandboxes skill, refs, and evals
skills/nemoclaw-user-manage-sandboxes/*
Adds sandbox lifecycle SKILL, backup/restore, lifecycle, messaging, runtime-controls, workspace-files refs, and corresponding evals.
Monitor-sandbox skill and evals
skills/nemoclaw-user-monitor-sandbox/*
Adds monitoring SKILL and three eval cases for sandbox/agent health, logs, and data-collection workflows.
Overview & Reference SKILLs and large docs
skills/nemoclaw-user-overview/*, skills/nemoclaw-user-reference/*
Adds overview/reference SKILLs, extensive architecture, CLI/commands, network-policies, and troubleshooting documentation, plus multiple evaluation datasets indexing those docs.
Test expectation update
test/catalog-skills-export.test.ts
Updates test expectations to remove nemoclaw-skills-guide from the expected exported skill directories in signing-artifact preservation test.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

  • NVIDIA/NemoClaw#4284: Both PRs modify .agents/catalog-skills.yaml to control the skills allowlist used by the export script for generating the signed skills catalog.
  • NVIDIA/NemoClaw#3327: Related changes removing nemoclaw-skills-guide from the catalog export allowlist and adjusting tests.
  • NVIDIA/NemoClaw#4293: Overlapping updates to regenerated nemoclaw-user-* skill documentation and exported artifacts.

Suggested labels

enhancement: skill, documentation

Suggested reviewers

  • jyaunches
  • cv

🐰 I hopped through YAML and docs so neat,
Trimmed one skill from the catalog's sheet,
Wrote READMEs, hashes, evals to show,
Docs now ship tidy — ready to grow,
A tiny rabbit nods: export complete.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch export-nemoclaw-user-agent-skills

@miyoungc
Copy link
Copy Markdown
Collaborator Author

/nvskills-ci

@miyoungc miyoungc requested a review from jyaunches May 28, 2026 15:42
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 28, 2026

E2E Advisor Recommendation

Required E2E: None
Optional E2E: docs-validation-e2e, skill-agent-e2e

Dispatch hint: docs-validation-e2e,skill-agent-e2e

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

  • None. No merge-blocking existing E2E is recommended: the PR only adds generated published skill/catalog documentation artifacts and signatures under skills/ and does not modify runtime code, installer/onboarding implementation, sandbox lifecycle, credentials, network policy, inference routing, or deployment code. Existing E2E jobs are at best adjacent and do not directly cover this root catalog export.

Optional E2E

  • docs-validation-e2e (low): Optional sanity check for documentation/link validation and CLI/docs parity. It is adjacent because this PR publishes user-facing markdown guidance, but it is not merge-blocking for these generated skills/ exports because the existing job does not specifically validate the root skills/ catalog content.
  • skill-agent-e2e (medium): Optional confidence that OpenClaw can load and use an injected skill in a sandboxed assistant session. This is adjacent to published assistant skills, but it does not exercise the newly added catalog skills directly, so it should not be required for this docs/catalog-only PR.

New E2E recommendations

  • catalog-skills (high): Existing E2E coverage does not appear to validate the generated root skills/ catalog export, catalog-metadata.json, evals.json schemas, signature bundle presence, or drift against .agents/skills. Add a lightweight catalog-skills validation job that runs scripts/export-catalog-skills.py --check, validates SKILL.md frontmatter and internal links under skills/, and verifies expected signing artifacts are present for published skills.
    • Suggested test: catalog-skills-validation-e2e
  • assistant-skill-user-flows (medium): The PR publishes user-facing get-started and agent-skills guidance that can affect real assistant answers, but existing skill-agent-e2e only tests a synthetic fixture. Add an assistant skill smoke test that loads the exported nemoclaw-user-get-started and nemoclaw-user-agent-skills content and asks representative evals.json prompts to confirm the assistant selects the expected skill and cites the correct installation/onboarding guidance without unsafe commands or secret leakage.
    • Suggested test: catalog-user-skills-agent-smoke-e2e

Dispatch hint

  • Workflow: .github/workflows/nightly-e2e.yaml
  • jobs input: docs-validation-e2e,skill-agent-e2e

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 28, 2026

E2E Scenario Advisor Recommendation

Required scenario E2E: None
Optional scenario E2E: None

Workflow run

Full scenario advisor summary

E2E Scenario Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required scenario E2E

  • None. No scenario workflow, scenario metadata, scenario runtime, or validation-suite files changed.

Optional scenario E2E

  • None.

Relevant changed files

  • None.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 28, 2026

PR Review Advisor

Findings: 3 needs attention, 5 worth checking, 0 nice ideas
Since last review: 0 prior items resolved, 9 still apply, 0 new items found

Review findings

🛠️ Needs attention

  • Catalog metadata advertises skills that are not exported (skills/catalog-metadata.json:10): The catalog manifest lists ten user skills, but the committed `skills/` export contains only `nemoclaw-user-agent-skills/` and `nemoclaw-user-get-started/`. A consumer or verifier using this metadata as the catalog manifest would expect eight missing skill directories.
    • Recommendation: Commit the full set of skill directories listed in `catalog-metadata.json`, or narrow the metadata, content hash, and user-facing skill list to exactly the directories present in this PR.
    • Evidence: `skills/catalog-metadata.json` lists `nemoclaw-user-configure-inference`, `nemoclaw-user-configure-security`, `nemoclaw-user-deploy-remote`, `nemoclaw-user-manage-policy`, `nemoclaw-user-manage-sandboxes`, `nemoclaw-user-monitor-sandbox`, `nemoclaw-user-overview`, and `nemoclaw-user-reference`, while repository inspection of `skills/` found only `catalog-metadata.json`, `README.md`, `nemoclaw-user-agent-skills/`, and `nemoclaw-user-get-started/`.
  • Generated export cannot be reproduced with the documented source of truth (skills/README.md:6): The new export documents `.agents/catalog-skills.yaml` and `scripts/export-catalog-skills.py` as its source and checker, and `catalog-metadata.json` records the same generator, but those files are not present in this checkout. That leaves the signed, security-sensitive catalog without a working regeneration or `--check` path.
    • Recommendation: Add the exporter and catalog allowlist referenced by the generated artifacts, or update `skills/README.md` and `skills/catalog-metadata.json` to the actual supported generation workflow. Include a repository check that verifies metadata matches the committed tree, recalculates hashes, preserves SPDX/frontmatter policy, and catches high-risk guidance drift.
    • Evidence: `skills/README.md` says to run `python3 scripts/export-catalog-skills.py` and `python3 scripts/export-catalog-skills.py --check`; `skills/catalog-metadata.json` records `"generatedBy": "scripts/export-catalog-skills.py"`; repository inspection found `.agents/skills/` and `scripts/docs-to-skills.py`, but no `.agents/catalog-skills.yaml` or `scripts/export-catalog-skills.py`.
  • New exported Markdown pages are missing SPDX headers (skills/nemoclaw-user-get-started/SKILL.md:1): The PR template's new-page clause expects SPDX headers and frontmatter, but the exported Markdown drops SPDX comments that are present in the `.agents/skills` source files. Because `skills/**` is ignored by markdownlint and the SPDX hook does not cover these Markdown exports, this drift is unlikely to be caught automatically.
    • Recommendation: Preserve SPDX headers in exported `SKILL.md` and reference Markdown files, or document and enforce an explicit alternate license-header policy for generated catalog exports.
    • Evidence: `skills/nemoclaw-user-get-started/SKILL.md` starts with YAML frontmatter and then the heading; `skills/nemoclaw-user-get-started/references/prerequisites.md` starts directly with `# Prerequisites`. The corresponding `.agents/skills/nemoclaw-user-get-started/SKILL.md` and reference files include SPDX comments, and `.markdownlint-cli2.yaml` ignores `skills/**`.

🔎 Worth checking

  • Source-of-truth review needed: Generated catalog export provenance: The advisor marked localized patch analysis as missing.
    • Recommendation: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
    • Evidence: `skills/README.md` references `.agents/catalog-skills.yaml` and `scripts/export-catalog-skills.py`; `skills/catalog-metadata.json` lists ten skills while only two skill directories are committed.
  • Source-of-truth review needed: Compatible endpoint validation and Responses-to-chat-completions fallback guidance: The advisor marked localized patch analysis as needs_followup.
    • Recommendation: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
    • Evidence: `quickstart-details.md` says compatible endpoints can be arbitrary compatible servers, prompts for `COMPATIBLE_API_KEY` or `COMPATIBLE_ANTHROPIC_API_KEY`, says NemoClaw sends a real inference request, and says OpenClaw falls back to `openai-completions` when Responses streaming events are unavailable.
  • Installer guidance executes remote scripts without adjacent verification guidance (skills/nemoclaw-user-get-started/SKILL.md:24): The generated quickstart asks users to pipe remote scripts into shells or run a downloaded PowerShell script with `ExecutionPolicy Bypass`. These are intentional installer trust boundaries, but the primary commands do not include adjacent checksum, signature, pinned-release, review-first, or explicit trust-root guidance.
    • Recommendation: Add safety guidance next to each bootstrap command that documents official trust roots and expected transport guarantees, or show a safer download-review-verify-run flow with checksums/signatures or pinned release URLs where available.
    • Evidence: `skills/nemoclaw-user-get-started/SKILL.md` shows `curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash`; `skills/nemoclaw-user-get-started/references/windows-preparation.md` shows `Invoke-WebRequest` from `raw.githubusercontent.com` followed by `powershell.exe -ExecutionPolicy Bypass`; the same Windows page shows `curl -fsSL https://ollama.com/install.sh | sh`.
  • Compatible endpoint docs do not spell out the SSRF and credential trust boundary (skills/nemoclaw-user-get-started/references/quickstart-details.md:68): The docs tell users that compatible endpoints can be arbitrary servers and that NemoClaw sends a real validation request. That is SSRF- and credential-sensitive because the user-entered endpoint receives host-side validation traffic and the compatible endpoint credential, but the page does not clearly warn users to enter only trusted endpoints or identify which credential is sent.
    • Recommendation: Document that compatible endpoint URLs must be trusted, clarify whether `COMPATIBLE_API_KEY` or `COMPATIBLE_ANTHROPIC_API_KEY` is sent during validation and runtime, and add or reference negative validation coverage for unsafe schemes, internal destinations where policy disallows them, and credential leakage behavior.
    • Evidence: Option 3 says the endpoint can be any server implementing `/v1/chat/completions`, prompts for `COMPATIBLE_API_KEY`, and says NemoClaw sends a real inference request; option 5 similarly accepts an Anthropic-compatible base URL and `COMPATIBLE_ANTHROPIC_API_KEY`.
  • Catalog guide status is ambiguous in user-facing discovery guidance (skills/nemoclaw-user-agent-skills/references/agent-skills.md:23): The exported catalog metadata omits `nemoclaw-skills-guide`, but the user-facing sparse-checkout command still fetches that guide. That may be intentional for repo-local discovery, but the generated catalog docs do not distinguish a repo-local guide from catalog-exported user skills.
    • Recommendation: Either include `nemoclaw-skills-guide` in the exported catalog, or update the guidance to say it is intentionally fetched alongside exported user skills but is not itself published as a catalog user skill.
    • Evidence: `skills/catalog-metadata.json` lists only `nemoclaw-user-*` skill names and omits `nemoclaw-skills-guide`; `skills/nemoclaw-user-agent-skills/references/agent-skills.md` sparse-checkout includes `/.agents/skills/nemoclaw-skills-guide/**`; `AGENTS.md` presents `nemoclaw-skills-guide` as the full catalog decision guide.

🌱 Nice ideas

  • None.
Since last review details

Current findings:

  • Source-of-truth review needed: Generated catalog export provenance: The advisor marked localized patch analysis as missing.
    • Recommendation: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
    • Evidence: `skills/README.md` references `.agents/catalog-skills.yaml` and `scripts/export-catalog-skills.py`; `skills/catalog-metadata.json` lists ten skills while only two skill directories are committed.
  • Source-of-truth review needed: Compatible endpoint validation and Responses-to-chat-completions fallback guidance: The advisor marked localized patch analysis as needs_followup.
    • Recommendation: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
    • Evidence: `quickstart-details.md` says compatible endpoints can be arbitrary compatible servers, prompts for `COMPATIBLE_API_KEY` or `COMPATIBLE_ANTHROPIC_API_KEY`, says NemoClaw sends a real inference request, and says OpenClaw falls back to `openai-completions` when Responses streaming events are unavailable.
  • Catalog metadata advertises skills that are not exported (skills/catalog-metadata.json:10): The catalog manifest lists ten user skills, but the committed `skills/` export contains only `nemoclaw-user-agent-skills/` and `nemoclaw-user-get-started/`. A consumer or verifier using this metadata as the catalog manifest would expect eight missing skill directories.
    • Recommendation: Commit the full set of skill directories listed in `catalog-metadata.json`, or narrow the metadata, content hash, and user-facing skill list to exactly the directories present in this PR.
    • Evidence: `skills/catalog-metadata.json` lists `nemoclaw-user-configure-inference`, `nemoclaw-user-configure-security`, `nemoclaw-user-deploy-remote`, `nemoclaw-user-manage-policy`, `nemoclaw-user-manage-sandboxes`, `nemoclaw-user-monitor-sandbox`, `nemoclaw-user-overview`, and `nemoclaw-user-reference`, while repository inspection of `skills/` found only `catalog-metadata.json`, `README.md`, `nemoclaw-user-agent-skills/`, and `nemoclaw-user-get-started/`.
  • Generated export cannot be reproduced with the documented source of truth (skills/README.md:6): The new export documents `.agents/catalog-skills.yaml` and `scripts/export-catalog-skills.py` as its source and checker, and `catalog-metadata.json` records the same generator, but those files are not present in this checkout. That leaves the signed, security-sensitive catalog without a working regeneration or `--check` path.
    • Recommendation: Add the exporter and catalog allowlist referenced by the generated artifacts, or update `skills/README.md` and `skills/catalog-metadata.json` to the actual supported generation workflow. Include a repository check that verifies metadata matches the committed tree, recalculates hashes, preserves SPDX/frontmatter policy, and catches high-risk guidance drift.
    • Evidence: `skills/README.md` says to run `python3 scripts/export-catalog-skills.py` and `python3 scripts/export-catalog-skills.py --check`; `skills/catalog-metadata.json` records `"generatedBy": "scripts/export-catalog-skills.py"`; repository inspection found `.agents/skills/` and `scripts/docs-to-skills.py`, but no `.agents/catalog-skills.yaml` or `scripts/export-catalog-skills.py`.
  • New exported Markdown pages are missing SPDX headers (skills/nemoclaw-user-get-started/SKILL.md:1): The PR template's new-page clause expects SPDX headers and frontmatter, but the exported Markdown drops SPDX comments that are present in the `.agents/skills` source files. Because `skills/**` is ignored by markdownlint and the SPDX hook does not cover these Markdown exports, this drift is unlikely to be caught automatically.
    • Recommendation: Preserve SPDX headers in exported `SKILL.md` and reference Markdown files, or document and enforce an explicit alternate license-header policy for generated catalog exports.
    • Evidence: `skills/nemoclaw-user-get-started/SKILL.md` starts with YAML frontmatter and then the heading; `skills/nemoclaw-user-get-started/references/prerequisites.md` starts directly with `# Prerequisites`. The corresponding `.agents/skills/nemoclaw-user-get-started/SKILL.md` and reference files include SPDX comments, and `.markdownlint-cli2.yaml` ignores `skills/**`.
  • Installer guidance executes remote scripts without adjacent verification guidance (skills/nemoclaw-user-get-started/SKILL.md:24): The generated quickstart asks users to pipe remote scripts into shells or run a downloaded PowerShell script with `ExecutionPolicy Bypass`. These are intentional installer trust boundaries, but the primary commands do not include adjacent checksum, signature, pinned-release, review-first, or explicit trust-root guidance.
    • Recommendation: Add safety guidance next to each bootstrap command that documents official trust roots and expected transport guarantees, or show a safer download-review-verify-run flow with checksums/signatures or pinned release URLs where available.
    • Evidence: `skills/nemoclaw-user-get-started/SKILL.md` shows `curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash`; `skills/nemoclaw-user-get-started/references/windows-preparation.md` shows `Invoke-WebRequest` from `raw.githubusercontent.com` followed by `powershell.exe -ExecutionPolicy Bypass`; the same Windows page shows `curl -fsSL https://ollama.com/install.sh | sh`.
  • Compatible endpoint docs do not spell out the SSRF and credential trust boundary (skills/nemoclaw-user-get-started/references/quickstart-details.md:68): The docs tell users that compatible endpoints can be arbitrary servers and that NemoClaw sends a real validation request. That is SSRF- and credential-sensitive because the user-entered endpoint receives host-side validation traffic and the compatible endpoint credential, but the page does not clearly warn users to enter only trusted endpoints or identify which credential is sent.
    • Recommendation: Document that compatible endpoint URLs must be trusted, clarify whether `COMPATIBLE_API_KEY` or `COMPATIBLE_ANTHROPIC_API_KEY` is sent during validation and runtime, and add or reference negative validation coverage for unsafe schemes, internal destinations where policy disallows them, and credential leakage behavior.
    • Evidence: Option 3 says the endpoint can be any server implementing `/v1/chat/completions`, prompts for `COMPATIBLE_API_KEY`, and says NemoClaw sends a real inference request; option 5 similarly accepts an Anthropic-compatible base URL and `COMPATIBLE_ANTHROPIC_API_KEY`.
  • Catalog guide status is ambiguous in user-facing discovery guidance (skills/nemoclaw-user-agent-skills/references/agent-skills.md:23): The exported catalog metadata omits `nemoclaw-skills-guide`, but the user-facing sparse-checkout command still fetches that guide. That may be intentional for repo-local discovery, but the generated catalog docs do not distinguish a repo-local guide from catalog-exported user skills.
    • Recommendation: Either include `nemoclaw-skills-guide` in the exported catalog, or update the guidance to say it is intentionally fetched alongside exported user skills but is not itself published as a catalog user skill.
    • Evidence: `skills/catalog-metadata.json` lists only `nemoclaw-user-*` skill names and omits `nemoclaw-skills-guide`; `skills/nemoclaw-user-agent-skills/references/agent-skills.md` sparse-checkout includes `/.agents/skills/nemoclaw-skills-guide/**`; `AGENTS.md` presents `nemoclaw-skills-guide` as the full catalog decision guide.

Workflow run details

This is an automated advisory review. A human maintainer must make the final merge decision.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@skills/nemoclaw-user-agent-skills/references/agent-skills.md`:
- Around line 1-2: Add the SPDX HTML comment header to the very top of this
Markdown file (above the "# NemoClaw Agent Skills for Your AI Coding Assistant"
title). Insert a single HTML comment with the SPDX identifier (for example: <!--
SPDX-License-Identifier: MIT -->) or the correct project license identifier,
ensuring it is the first line in the file so the file complies with the
"Markdown documentation files must include SPDX headers in HTML comment format"
guideline.

In `@skills/nemoclaw-user-agent-skills/SKILL.md`:
- Around line 1-5: Prepend the standard SPDX HTML comment header to the top of
SKILL.md before the existing YAML frontmatter (the leading '---' block) so the
file begins with an SPDX copyright/license comment; ensure the header uses HTML
comment syntax (<!-- ... -->) and includes the SPDX-License-Identifier and
copyright lines per project guidelines, leaving the existing frontmatter
(name/description/license) unchanged.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 990552ca-2386-499f-8aa8-aa871635475e

📥 Commits

Reviewing files that changed from the base of the PR and between ea10007 and 9f29f0d.

📒 Files selected for processing (6)
  • .agents/catalog-skills.yaml
  • skills/README.md
  • skills/catalog-metadata.json
  • skills/nemoclaw-user-agent-skills/SKILL.md
  • skills/nemoclaw-user-agent-skills/evals/evals.json
  • skills/nemoclaw-user-agent-skills/references/agent-skills.md
💤 Files with no reviewable changes (1)
  • .agents/catalog-skills.yaml

Comment on lines +1 to +2
# NemoClaw Agent Skills for Your AI Coding Assistant

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Prepend SPDX header comments to this Markdown reference page.

The required SPDX HTML comment header is missing at the top of this file.

Proposed fix
+<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
 # NemoClaw Agent Skills for Your AI Coding Assistant

As per coding guidelines, "Markdown documentation files must include SPDX headers in HTML comment format".

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# NemoClaw Agent Skills for Your AI Coding Assistant
<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -->
<!-- SPDX-License-Identifier: Apache-2.0 -->
# NemoClaw Agent Skills for Your AI Coding Assistant
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/nemoclaw-user-agent-skills/references/agent-skills.md` around lines 1
- 2, Add the SPDX HTML comment header to the very top of this Markdown file
(above the "# NemoClaw Agent Skills for Your AI Coding Assistant" title). Insert
a single HTML comment with the SPDX identifier (for example: <!--
SPDX-License-Identifier: MIT -->) or the correct project license identifier,
ensuring it is the first line in the file so the file complies with the
"Markdown documentation files must include SPDX headers in HTML comment format"
guideline.

Comment on lines +1 to +5
---
name: "nemoclaw-user-agent-skills"
description: "Describes the agent skills shipped with NemoClaw and how to access them by cloning the repository. Use when users ask about AI agent support, coding assistant integration, or the .agents/skills/ directory. Trigger keywords - nemoclaw agent skills, ai coding assistant, cursor, claude code, copilot."
license: "Apache-2.0"
---
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Add required SPDX header comments at the top of this Markdown file.

This file is missing the SPDX HTML comment header before frontmatter. Please prepend the standard SPDX copyright and license comments.

Proposed fix
+<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
 ---
 name: "nemoclaw-user-agent-skills"
 description: "Describes the agent skills shipped with NemoClaw and how to access them by cloning the repository. Use when users ask about AI agent support, coding assistant integration, or the .agents/skills/ directory. Trigger keywords - nemoclaw agent skills, ai coding assistant, cursor, claude code, copilot."
 license: "Apache-2.0"

As per coding guidelines, "Markdown documentation files must include SPDX headers in HTML comment format".

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
---
name: "nemoclaw-user-agent-skills"
description: "Describes the agent skills shipped with NemoClaw and how to access them by cloning the repository. Use when users ask about AI agent support, coding assistant integration, or the .agents/skills/ directory. Trigger keywords - nemoclaw agent skills, ai coding assistant, cursor, claude code, copilot."
license: "Apache-2.0"
---
<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -->
<!-- SPDX-License-Identifier: Apache-2.0 -->
---
name: "nemoclaw-user-agent-skills"
description: "Describes the agent skills shipped with NemoClaw and how to access them by cloning the repository. Use when users ask about AI agent support, coding assistant integration, or the .agents/skills/ directory. Trigger keywords - nemoclaw agent skills, ai coding assistant, cursor, claude code, copilot."
license: "Apache-2.0"
---
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/nemoclaw-user-agent-skills/SKILL.md` around lines 1 - 5, Prepend the
standard SPDX HTML comment header to the top of SKILL.md before the existing
YAML frontmatter (the leading '---' block) so the file begins with an SPDX
copyright/license comment; ensure the header uses HTML comment syntax (<!-- ...
-->) and includes the SPDX-License-Identifier and copyright lines per project
guidelines, leaving the existing frontmatter (name/description/license)
unchanged.

@miyoungc
Copy link
Copy Markdown
Collaborator Author

/nvskills-ci

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@skills/nemoclaw-user-get-started/references/quickstart-details.md`:
- Around line 1-2: This file is missing the required SPDX HTML comment preamble;
add the SPDX header as HTML comments at the very top of
skills/nemoclaw-user-get-started/references/quickstart-details.md (before the "#
NemoClaw Quickstart with OpenClaw: Details" title). Include the standard SPDX
lines your project requires (e.g. an SPDX-FileCopyrightText comment and an
SPDX-License-Identifier comment) in HTML comment format so the file complies
with the "*.md: Markdown documentation files must include SPDX headers in HTML
comment format" guideline.

In `@skills/nemoclaw-user-get-started/references/windows-preparation.md`:
- Around line 1-2: This Markdown file is missing the required SPDX HTML comment
preamble: insert an SPDX header as an HTML comment at the very top of the file
(above the "# Prepare Windows for NemoClaw" heading), e.g. an HTML comment that
includes SPDX-License-Identifier and any required copyright/notice lines per
repo policy; ensure the header is the first lines of the file and formatted as
an HTML comment (<!-- ... -->).
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 06ce26d2-e490-4797-a4ce-647bdbea49f7

📥 Commits

Reviewing files that changed from the base of the PR and between 9f29f0d and 1f499a1.

📒 Files selected for processing (6)
  • skills/nemoclaw-user-get-started/SKILL.md
  • skills/nemoclaw-user-get-started/evals/evals.json
  • skills/nemoclaw-user-get-started/references/prerequisites.md
  • skills/nemoclaw-user-get-started/references/quickstart-details.md
  • skills/nemoclaw-user-get-started/references/quickstart-hermes.md
  • skills/nemoclaw-user-get-started/references/windows-preparation.md
✅ Files skipped from review due to trivial changes (3)
  • skills/nemoclaw-user-get-started/SKILL.md
  • skills/nemoclaw-user-get-started/references/prerequisites.md
  • skills/nemoclaw-user-get-started/references/quickstart-hermes.md

Comment on lines +1 to +2
# NemoClaw Quickstart with OpenClaw: Details

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Add the required SPDX HTML header at the top of this Markdown file.

This new .md file starts directly with content and is missing the required SPDX comment preamble.

As per coding guidelines, "/*.md: Markdown documentation files must include SPDX headers in HTML comment format".

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/nemoclaw-user-get-started/references/quickstart-details.md` around
lines 1 - 2, This file is missing the required SPDX HTML comment preamble; add
the SPDX header as HTML comments at the very top of
skills/nemoclaw-user-get-started/references/quickstart-details.md (before the "#
NemoClaw Quickstart with OpenClaw: Details" title). Include the standard SPDX
lines your project requires (e.g. an SPDX-FileCopyrightText comment and an
SPDX-License-Identifier comment) in HTML comment format so the file complies
with the "*.md: Markdown documentation files must include SPDX headers in HTML
comment format" guideline.

Comment on lines +1 to +2
# Prepare Windows for NemoClaw

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Add the required SPDX HTML header at the top of this Markdown file.

This new .md file starts with a heading and omits the SPDX comment preamble required for Markdown docs.

As per coding guidelines, "/*.md: Markdown documentation files must include SPDX headers in HTML comment format".

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/nemoclaw-user-get-started/references/windows-preparation.md` around
lines 1 - 2, This Markdown file is missing the required SPDX HTML comment
preamble: insert an SPDX header as an HTML comment at the very top of the file
(above the "# Prepare Windows for NemoClaw" heading), e.g. an HTML comment that
includes SPDX-License-Identifier and any required copyright/notice lines per
repo policy; ensure the header is the first lines of the file and formatted as
an HTML comment (<!-- ... -->).

The catalog export now omits nemoclaw-skills-guide; sync the
catalog-skills-export.test.ts expected directory list to match.

Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented May 28, 2026

Actionable comments posted: 0

@miyoungc
Copy link
Copy Markdown
Collaborator Author

/nvskils-ci

@miyoungc
Copy link
Copy Markdown
Collaborator Author

/nvskills-ci

1 similar comment
@miyoungc
Copy link
Copy Markdown
Collaborator Author

/nvskills-ci

@jyaunches
Copy link
Copy Markdown
Contributor

Opened #4448 to simplify the skills publishing pipeline (deletes the allowlist, exporter script, drift gate, and nightly refresh bot). Once #4448 lands, this PR can rebase onto a cleaner main: drop skills/catalog-metadata.json and re-copy the two skill directories straight from .agents/skills/ (so SPDX headers stay intact). The unit-vitest-linux failure here also goes away because the test it was failing on is deleted in #4448.

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented May 28, 2026

Actionable comments posted: 0

@miyoungc
Copy link
Copy Markdown
Collaborator Author

/nvskills-ci

3 similar comments
@miyoungc
Copy link
Copy Markdown
Collaborator Author

/nvskills-ci

@miyoungc
Copy link
Copy Markdown
Collaborator Author

/nvskills-ci

@miyoungc
Copy link
Copy Markdown
Collaborator Author

/nvskills-ci

jyaunches added a commit that referenced this pull request May 28, 2026
## Summary

Removes the catalog-skills allowlist, exporter script, drift gate, and
nightly refresh automation. Publishing a user-facing skill is now:

```bash
cp -r .agents/skills/nemoclaw-user-<name> skills/
git commit -am "chore(skills): publish nemoclaw-user-<name>"
# open PR, comment /nvskills-ci, merge
```

`skills/` is the source of truth for what is published. NVSkills CI
signs one skill per PR (which is the existing timeout constraint
anyway).

## Why

The current gate (`scripts/export-catalog-skills.py --check
--allow-missing`) requires `.agents/catalog-skills.yaml` and `skills/`
to be in lockstep on every commit. NVSkills CI's per-skill signing
cadence means we land published skills incrementally over many PRs, so
allowlist and export are intentionally out of sync for the duration of
the migration. The gate fights that workflow and forced #4438 to skip
pre-commit hooks just to push.

The system as a whole had three sources of truth (allowlist, source
`.agents/skills/`, exported `skills/`) all needing to agree. Collapsing
to two (source + published) eliminates the class of inconsistencies the
gate was built to catch — because there's nothing left to be
inconsistent.

## What replaces drift detection

On-demand verification: ask an agent to diff `skills/<name>/` against
`.agents/skills/<name>/` and report any content differences (ignoring
`skill.oms.sig` and `skill-card.md`). Documented in the rewritten
`.github/catalog-skills-signing-flow.md`.

The nightly refresh bot's job (regenerating from source) is no longer
meaningful since there's no allowlist driving regeneration — each
published skill is now an explicit human decision per PR.

## Removed

- `.agents/catalog-skills.yaml` (allowlist)
- `scripts/export-catalog-skills.py` (exporter + checker, 460 lines)
- `test/catalog-skills-export.test.ts` (test for the deleted script)
- `.github/workflows/catalog-skills-refresh.yaml` (nightly refresh bot)
- `.github/pr-bodies/catalog-skills-refresh.md` (bot PR body template)
- `.pre-commit-config.yaml` `catalog-skills-export` hook
- `.github/workflows/pr.yaml` "Verify catalog skills export" step
- `.github/CODEOWNERS` line for the deleted allowlist

## Rewritten

- `.github/catalog-skills-signing-flow.md` — was a Mermaid diagram of
the seven-step generator/checker/refresh flow. Now a 40-line manual
workflow doc.

## Downstream

#4438 (and the 9 per-skill PRs to follow) need to rebase onto this.
After rebase, Miyoung's PR becomes a plain `cp -r` of two skill
directories with no manifest and no SPDX-stripping — strictly "as
authored" content under `skills/`.

## Type of Change

- [x] Code change (refactor / removal)

## Verification

- [x] No secrets, API keys, or credentials committed

Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Removed catalog skills automation infrastructure, including workflow,
scripts, and configuration files
* Updated CI verification workflow to focus on platform documentation
checks

* **Documentation**
* Simplified skill publishing guide with step-by-step instructions for
adding, refreshing, and validating skills

* **Tests**
  * Removed catalog skills export test suite

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/NVIDIA/NemoClaw/pull/4448?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
@wscurran wscurran added enhancement: skill Improvements to NemoCall repository hygiene or user functionality with skills. fix labels May 28, 2026
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 17

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@skills/nemoclaw-user-configure-inference/references/inference-options.md`:
- Line 1: This Markdown file lacks the required SPDX HTML comment header; add
the mandatory SPDX header as an HTML comment at the top of the document (above
the existing "# NemoClaw Inference Options" heading) using the project’s
standard SPDX tag (e.g., <!-- SPDX-License-Identifier: ... -->) so the file
begins with the SPDX comment before any content.

In `@skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md`:
- Line 1: Prepend the required SPDX HTML comment header to this Markdown file so
it complies with repo rules: add an HTML comment at the very top of
skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md
containing the SPDX license identifier (e.g., <!-- SPDX-License-Identifier:
Apache-2.0 -->) before the existing content (the "# Set Up Task-Specific
Sub-Agents" header).

In `@skills/nemoclaw-user-configure-inference/SKILL.md`:
- Line 1: Add an SPDX header at the top of SKILL.md in HTML comment format;
insert a single line like <!-- SPDX-License-Identifier: <license-identifier> -->
(replace <license-identifier> with the project's correct SPDX tag) as the very
first line of SKILL.md so the file complies with the Markdown SPDX requirement.

In `@skills/nemoclaw-user-configure-security/references/best-practices.md`:
- Around line 22-43: The Mermaid diagram uses emoji in node labels (e.g., nodes
PROC, FS, AGENT, NET, INF, NC, SB, GW, OUTSIDE, YOU); update each label to
remove emoji and use plain technical text (for example change "⚙️ Process
Layer<br/>Controls what the agent can execute" to "Process Layer<br/>Controls
what the agent can execute") ensuring all occurrences in the block are cleaned
while preserving descriptive text and line breaks.
- Line 1: The file best-practices.md is missing the required SPDX header in HTML
comment format; add a single-line SPDX license identifier as an HTML comment at
the very top of the file (e.g., <!-- SPDX-License-Identifier: ... -->), using
the appropriate SPDX identifier for the project, so the header appears before
the "# NemoClaw Security Best Practices: Controls, Risks, and Posture Profiles"
title.

In `@skills/nemoclaw-user-deploy-remote/references/brev-web-ui.md`:
- Line 1: Add the required SPDX header as an HTML comment at the very top of
this Markdown file: insert a single-line or multi-line HTML comment containing
the SPDX identifier (e.g. <!-- SPDX-FileCopyrightText: <copyright holder> -->
and <!-- SPDX-License-Identifier: <SPDX-License-Identifier> -->) before the
existing content so the file conforms to the "`**/*.md`: Markdown documentation
files must include SPDX headers in HTML comment format" guideline.

In `@skills/nemoclaw-user-manage-policy/references/approve-network-requests.md`:
- Line 1: This Markdown file is missing the required SPDX header; add an HTML
comment SPDX header line (e.g. <!-- SPDX-License-Identifier: <LICENSE> --> using
the project’s canonical license identifier) at the very top of the file,
immediately before the existing first heading "# Approve or Deny Agent Network
Requests", so the document begins with the SPDX comment.

In
`@skills/nemoclaw-user-manage-policy/references/integration-policy-examples.md`:
- Line 1: Add an SPDX HTML comment header as the very first line of the Markdown
file (above the "# Common NemoClaw Integration Policy Examples" title). Insert a
single-line HTML comment of the form <!-- SPDX-License-Identifier: <SPDX_ID> -->
(e.g., MIT, Apache-2.0) using the project's chosen license identifier so the
file complies with the "*.md" guideline requiring an SPDX header.

In `@skills/nemoclaw-user-manage-policy/SKILL.md`:
- Line 1: The SKILL.md file is missing the required SPDX header; add an HTML
comment SPDX header as the first lines of the file (e.g. <!--
SPDX-License-Identifier: MIT -->), ensuring it follows the project’s specified
license identifier and exact HTML comment format and appears before any content
or frontmatter in SKILL.md.

In `@skills/nemoclaw-user-manage-sandboxes/references/backup-restore.md`:
- Line 1: This Markdown file is missing the required SPDX header; add an
HTML-comment SPDX header as the first line of the document (before the "# Backup
and Restore Workspace Files" heading) using the project's chosen SPDX identifier
(for example, <!-- SPDX-License-Identifier: MIT -->), ensuring the exact SPDX
token matches the repository license policy.

In `@skills/nemoclaw-user-manage-sandboxes/references/messaging-channels.md`:
- Line 1: Add the required SPDX header as an HTML comment at the top of this
Markdown file (above the "# Messaging Channels" heading): insert a single-line
SPDX declaration like <!-- SPDX-License-Identifier: <LICENSE> --> (replacing
<LICENSE> with the appropriate identifier per project policy) so the file
complies with the "*.md" SPDX header rule.

In `@skills/nemoclaw-user-overview/references/overview.md`:
- Line 1: Add the required SPDX HTML comment header at the very top of the
Markdown file (above the "# Overview of NVIDIA NemoClaw" heading) in the HTML
comment format used by our guidelines (e.g., an HTML comment containing
SPDX-License-Identifier and any required SPDX-FileCopyrightText); ensure the
SPDX header is present and correctly formatted so the file complies with the
"`**/*.md`: Markdown documentation files must include SPDX headers in HTML
comment format" rule.

In `@skills/nemoclaw-user-overview/references/release-notes.md`:
- Line 1: Add the required SPDX header to the top of release-notes.md by
inserting an HTML comment containing the correct SPDX identifier (for example,
SPDX-License-Identifier: MIT) as the very first line of the file so it conforms
to the "*.md" guideline requiring SPDX headers in HTML comment format.

In `@skills/nemoclaw-user-reference/references/cli-selection-guide.md`:
- Line 1: Add the required SPDX header as an HTML comment immediately before the
existing title line in cli-selection-guide.md; insert a single-line HTML comment
containing the SPDX identifier (e.g., <!-- SPDX-License-Identifier: <identifier>
-->) directly above the "# CLI Selection Guide" heading so the document includes
the mandated SPDX header format.

In `@skills/nemoclaw-user-reference/references/commands.md`:
- Line 1: Add an SPDX HTML comment header at the very top of the Markdown file
before the existing "# NemoClaw CLI Commands Reference" line; insert a
single-line HTML comment of the form <!-- SPDX-License-Identifier:
<YOUR_LICENSE> --> (replace <YOUR_LICENSE> with the project's SPDX identifier)
so the file contains the required SPDX header.

In `@skills/nemoclaw-user-reference/references/network-policies.md`:
- Line 1: This Markdown file starts with "# Network Policies" but is missing the
required SPDX header; add the mandatory SPDX HTML comment as the first line of
the file (e.g. <!-- SPDX-License-Identifier: <LICENSE-ID> -->) above the "#
Network Policies" heading to satisfy the "`**/*.md` must include SPDX headers in
HTML comment format" guideline.

In `@skills/nemoclaw-user-reference/references/troubleshooting.md`:
- Line 1: This Markdown file is missing the required SPDX header; add an SPDX
license header as an HTML comment at the very top of the document (above the "#
Troubleshooting" header) in the format mandated by the guidelines (e.g., <!--
SPDX-License-Identifier: <identifier> -->) so the file includes the required
SPDX metadata.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 64125fef-97b3-458d-b589-7098fe088234

📥 Commits

Reviewing files that changed from the base of the PR and between 22f190b and 4c3d19a.

⛔ Files ignored due to path filters (1)
  • skills/nemoclaw-user-overview/references/images/nemoclaw-highlevel-component-diagram.png is excluded by !**/*.png
📒 Files selected for processing (47)
  • skills/catalog-metadata.json
  • skills/nemoclaw-user-agent-skills/evals/evals.json
  • skills/nemoclaw-user-configure-inference/SKILL.md
  • skills/nemoclaw-user-configure-inference/evals/evals.json
  • skills/nemoclaw-user-configure-inference/references/inference-options.md
  • skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md
  • skills/nemoclaw-user-configure-inference/references/switch-inference-providers.md
  • skills/nemoclaw-user-configure-inference/references/tool-calling-reliability.md
  • skills/nemoclaw-user-configure-inference/references/use-local-inference-details.md
  • skills/nemoclaw-user-configure-security/SKILL.md
  • skills/nemoclaw-user-configure-security/evals/evals.json
  • skills/nemoclaw-user-configure-security/references/best-practices.md
  • skills/nemoclaw-user-configure-security/references/credential-storage.md
  • skills/nemoclaw-user-configure-security/references/openclaw-controls.md
  • skills/nemoclaw-user-deploy-remote/SKILL.md
  • skills/nemoclaw-user-deploy-remote/evals/evals.json
  • skills/nemoclaw-user-deploy-remote/references/brev-web-ui.md
  • skills/nemoclaw-user-deploy-remote/references/install-openclaw-plugins.md
  • skills/nemoclaw-user-deploy-remote/references/sandbox-hardening.md
  • skills/nemoclaw-user-get-started/evals/evals.json
  • skills/nemoclaw-user-manage-policy/SKILL.md
  • skills/nemoclaw-user-manage-policy/evals/evals.json
  • skills/nemoclaw-user-manage-policy/references/approve-network-requests.md
  • skills/nemoclaw-user-manage-policy/references/customize-network-policy-details.md
  • skills/nemoclaw-user-manage-policy/references/integration-policy-examples.md
  • skills/nemoclaw-user-manage-sandboxes/SKILL.md
  • skills/nemoclaw-user-manage-sandboxes/evals/evals.json
  • skills/nemoclaw-user-manage-sandboxes/references/backup-restore.md
  • skills/nemoclaw-user-manage-sandboxes/references/lifecycle-details.md
  • skills/nemoclaw-user-manage-sandboxes/references/messaging-channels.md
  • skills/nemoclaw-user-manage-sandboxes/references/runtime-controls.md
  • skills/nemoclaw-user-manage-sandboxes/references/workspace-files.md
  • skills/nemoclaw-user-monitor-sandbox/SKILL.md
  • skills/nemoclaw-user-monitor-sandbox/evals/evals.json
  • skills/nemoclaw-user-overview/SKILL.md
  • skills/nemoclaw-user-overview/evals/evals.json
  • skills/nemoclaw-user-overview/references/ecosystem.md
  • skills/nemoclaw-user-overview/references/how-it-works.md
  • skills/nemoclaw-user-overview/references/overview.md
  • skills/nemoclaw-user-overview/references/release-notes.md
  • skills/nemoclaw-user-reference/SKILL.md
  • skills/nemoclaw-user-reference/evals/evals.json
  • skills/nemoclaw-user-reference/references/architecture.md
  • skills/nemoclaw-user-reference/references/cli-selection-guide.md
  • skills/nemoclaw-user-reference/references/commands.md
  • skills/nemoclaw-user-reference/references/network-policies.md
  • skills/nemoclaw-user-reference/references/troubleshooting.md
✅ Files skipped from review due to trivial changes (23)
  • skills/nemoclaw-user-monitor-sandbox/SKILL.md
  • skills/nemoclaw-user-manage-sandboxes/references/lifecycle-details.md
  • skills/nemoclaw-user-reference/SKILL.md
  • skills/nemoclaw-user-manage-sandboxes/references/runtime-controls.md
  • skills/nemoclaw-user-manage-sandboxes/references/workspace-files.md
  • skills/nemoclaw-user-configure-security/references/credential-storage.md
  • skills/nemoclaw-user-configure-inference/references/switch-inference-providers.md
  • skills/nemoclaw-user-configure-security/references/openclaw-controls.md
  • skills/nemoclaw-user-overview/references/how-it-works.md
  • skills/catalog-metadata.json
  • skills/nemoclaw-user-manage-policy/references/customize-network-policy-details.md
  • skills/nemoclaw-user-manage-sandboxes/SKILL.md
  • skills/nemoclaw-user-configure-inference/references/tool-calling-reliability.md
  • skills/nemoclaw-user-manage-sandboxes/evals/evals.json
  • skills/nemoclaw-user-overview/SKILL.md
  • skills/nemoclaw-user-reference/references/architecture.md
  • skills/nemoclaw-user-configure-security/SKILL.md
  • skills/nemoclaw-user-configure-security/evals/evals.json
  • skills/nemoclaw-user-overview/references/ecosystem.md
  • skills/nemoclaw-user-deploy-remote/SKILL.md
  • skills/nemoclaw-user-deploy-remote/references/sandbox-hardening.md
  • skills/nemoclaw-user-deploy-remote/references/install-openclaw-plugins.md
  • skills/nemoclaw-user-configure-inference/references/use-local-inference-details.md
🚧 Files skipped from review as they are similar to previous changes (1)
  • skills/nemoclaw-user-get-started/evals/evals.json

@@ -0,0 +1,140 @@
# NemoClaw Inference Options
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Add SPDX header to satisfy Markdown policy.

The file is missing the mandatory SPDX HTML comment header.

As per coding guidelines, "Markdown documentation files must include SPDX headers in HTML comment format".

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/nemoclaw-user-configure-inference/references/inference-options.md` at
line 1, This Markdown file lacks the required SPDX HTML comment header; add the
mandatory SPDX header as an HTML comment at the top of the document (above the
existing "# NemoClaw Inference Options" heading) using the project’s standard
SPDX tag (e.g., <!-- SPDX-License-Identifier: ... -->) so the file begins with
the SPDX comment before any content.

@@ -0,0 +1,118 @@
# Set Up Task-Specific Sub-Agents
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Prepend the required SPDX HTML comment header.

This Markdown doc currently omits the SPDX header required by repo rules.

As per coding guidelines, "Markdown documentation files must include SPDX headers in HTML comment format".

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md` at
line 1, Prepend the required SPDX HTML comment header to this Markdown file so
it complies with repo rules: add an HTML comment at the very top of
skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md
containing the SPDX license identifier (e.g., <!-- SPDX-License-Identifier:
Apache-2.0 -->) before the existing content (the "# Set Up Task-Specific
Sub-Agents" header).

@@ -0,0 +1,281 @@
---
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Add SPDX header at the beginning of the file.

This Markdown file is missing the required SPDX header in HTML comment format.

As per coding guidelines, "Markdown documentation files must include SPDX headers in HTML comment format".

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/nemoclaw-user-configure-inference/SKILL.md` at line 1, Add an SPDX
header at the top of SKILL.md in HTML comment format; insert a single line like
<!-- SPDX-License-Identifier: <license-identifier> --> (replace
<license-identifier> with the project's correct SPDX tag) as the very first line
of SKILL.md so the file complies with the Markdown SPDX requirement.

@@ -0,0 +1,509 @@
# NemoClaw Security Best Practices: Controls, Risks, and Posture Profiles
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Add SPDX header at the top of this Markdown file.

This doc is missing the required SPDX header in HTML comment format.

As per coding guidelines, "Markdown documentation files must include SPDX headers in HTML comment format".

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/nemoclaw-user-configure-security/references/best-practices.md` at line
1, The file best-practices.md is missing the required SPDX header in HTML
comment format; add a single-line SPDX license identifier as an HTML comment at
the very top of the file (e.g., <!-- SPDX-License-Identifier: ... -->), using
the appropriate SPDX identifier for the project, so the header appears before
the "# NemoClaw Security Best Practices: Controls, Risks, and Posture Profiles"
title.

Comment on lines +22 to +43
YOU["👤 Operator"]

subgraph NC["NemoClaw + OpenShell"]
direction TB

subgraph SB["Sandbox: the agent's isolated world"]
direction LR
PROC["⚙️ Process Layer<br/>Controls what the agent can execute"]
FS["📁 Filesystem Layer<br/>Controls what the agent can read and write"]
AGENT["🤖 Agent"]
end

subgraph GW["Gateway: the gatekeeper"]
direction LR
NET["🌐 Network Layer<br/>Controls where the agent can connect"]
INF["🧠 Inference Layer<br/>Controls which AI models the agent can use"]
end
end
end

OUTSIDE["🌍 Outside World<br/>Internet · AI Providers · APIs"]

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Remove emoji from the technical diagram labels.

The Mermaid node labels include emoji, which violates the docs rule for technical prose.

As per coding guidelines, "No emoji in technical prose."

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/nemoclaw-user-configure-security/references/best-practices.md` around
lines 22 - 43, The Mermaid diagram uses emoji in node labels (e.g., nodes PROC,
FS, AGENT, NET, INF, NC, SB, GW, OUTSIDE, YOU); update each label to remove
emoji and use plain technical text (for example change "⚙️ Process
Layer<br/>Controls what the agent can execute" to "Process Layer<br/>Controls
what the agent can execute") ensuring all occurrences in the block are cleaned
while preserving descriptive text and line breaks.

@@ -0,0 +1,242 @@
# Release Notes
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Add required SPDX header at the top of this Markdown file.

This documentation file is missing the required SPDX header comment.

Proposed fix
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
 # Release Notes

As per coding guidelines "**/*.md: Markdown documentation files must include SPDX headers in HTML comment format".

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/nemoclaw-user-overview/references/release-notes.md` at line 1, Add the
required SPDX header to the top of release-notes.md by inserting an HTML comment
containing the correct SPDX identifier (for example, SPDX-License-Identifier:
MIT) as the very first line of the file so it conforms to the "*.md" guideline
requiring SPDX headers in HTML comment format.

@@ -0,0 +1,203 @@
# CLI Selection Guide
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Insert SPDX header before the title.

This Markdown page is missing the required SPDX header in HTML comment format.

As per coding guidelines, "Markdown documentation files must include SPDX headers in HTML comment format".

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/nemoclaw-user-reference/references/cli-selection-guide.md` at line 1,
Add the required SPDX header as an HTML comment immediately before the existing
title line in cli-selection-guide.md; insert a single-line HTML comment
containing the SPDX identifier (e.g., <!-- SPDX-License-Identifier: <identifier>
-->) directly above the "# CLI Selection Guide" heading so the document includes
the mandated SPDX header format.

@@ -0,0 +1,1379 @@
# NemoClaw CLI Commands Reference
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Add required SPDX header to this Markdown document.

The file starts directly with content and is missing the SPDX HTML comment header.

As per coding guidelines, "Markdown documentation files must include SPDX headers in HTML comment format".

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/nemoclaw-user-reference/references/commands.md` at line 1, Add an SPDX
HTML comment header at the very top of the Markdown file before the existing "#
NemoClaw CLI Commands Reference" line; insert a single-line HTML comment of the
form <!-- SPDX-License-Identifier: <YOUR_LICENSE> --> (replace <YOUR_LICENSE>
with the project's SPDX identifier) so the file contains the required SPDX
header.

@@ -0,0 +1,123 @@
# Network Policies
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Add required SPDX header at the top of this Markdown file.

The file begins with Markdown content and omits the mandatory SPDX HTML header.

Proposed fix
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
 # Network Policies

As per coding guidelines "**/*.md: Markdown documentation files must include SPDX headers in HTML comment format".

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# Network Policies
<!-- SPDX-License-Identifier: Apache-2.0 -->
# Network Policies
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/nemoclaw-user-reference/references/network-policies.md` at line 1,
This Markdown file starts with "# Network Policies" but is missing the required
SPDX header; add the mandatory SPDX HTML comment as the first line of the file
(e.g. <!-- SPDX-License-Identifier: <LICENSE-ID> -->) above the "# Network
Policies" heading to satisfy the "`**/*.md` must include SPDX headers in HTML
comment format" guideline.

@@ -0,0 +1,1419 @@
# Troubleshooting
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Add required SPDX header at the top of this Markdown file.

Required SPDX header is missing from this Markdown doc.

Proposed fix
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
 # Troubleshooting

As per coding guidelines "**/*.md: Markdown documentation files must include SPDX headers in HTML comment format".

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# Troubleshooting
<!-- SPDX-License-Identifier: Apache-2.0 -->
# Troubleshooting
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/nemoclaw-user-reference/references/troubleshooting.md` at line 1, This
Markdown file is missing the required SPDX header; add an SPDX license header as
an HTML comment at the very top of the document (above the "# Troubleshooting"
header) in the format mandated by the guidelines (e.g., <!--
SPDX-License-Identifier: <identifier> -->) so the file includes the required
SPDX metadata.

…agent-skills

# Conflicts:
#	.agents/catalog-skills.yaml
#	test/catalog-skills-export.test.ts
@jyaunches
Copy link
Copy Markdown
Contributor

/nvskills-ci

Signed-off-by: nvskills-svc-account <svc-nvskills-signing@nvidia.com>
@copy-pr-bot
Copy link
Copy Markdown

copy-pr-bot Bot commented May 28, 2026

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@miyoungc miyoungc changed the title chore: export nemoclaw user agent skills chore: skills signing batch 1 May 28, 2026
@miyoungc
Copy link
Copy Markdown
Collaborator Author

/nvskills-ci

@miyoungc miyoungc merged commit bccc22a into main May 28, 2026
21 checks passed
@miyoungc miyoungc deleted the export-nemoclaw-user-agent-skills branch May 28, 2026 21:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement: skill Improvements to NemoCall repository hygiene or user functionality with skills. fix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants