-
-
Notifications
You must be signed in to change notification settings - Fork 30
feat: Add installable skills marketplace with remote registry #129
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -10,6 +10,8 @@ const GitOperations = require('./gitOps'); | |||||||||
| const { sanitizeAxiosError, formatUserError, createSafeError, isNetworkError } = require('./errorHandler'); | ||||||||||
| const configManager = require('./configManager'); | ||||||||||
| const { getProvider } = require('./providers'); | ||||||||||
| const skillRegistry = require('./skillRegistry'); | ||||||||||
| const skillRunner = require('./skillRunner'); | ||||||||||
|
|
||||||||||
| /** | ||||||||||
| * Core AI Agent that communicates with backend and executes plans | ||||||||||
|
|
@@ -59,6 +61,10 @@ class Agent { | |||||||||
| // Track running processes spawned in separate terminals | ||||||||||
| this.runningProcesses = []; | ||||||||||
|
|
||||||||||
| // Load installed agent skills for tool invocation | ||||||||||
| this.installedSkills = skillRegistry.loadAllSkills(); | ||||||||||
| this.toolManifest = skillRegistry.generateToolManifest(); | ||||||||||
|
|
||||||||||
| // Register cleanup handler for when Coderrr exits | ||||||||||
| this.registerExitCleanup(); | ||||||||||
| } | ||||||||||
|
|
@@ -251,6 +257,16 @@ When editing existing files, use EXACT filenames from the list above. When creat | |||||||||
| For command execution on ${osType}, use appropriate command separators (${osType === 'Windows' ? 'semicolon (;)' : 'ampersand (&&)'}).`; | ||||||||||
| } | ||||||||||
|
|
||||||||||
| // Inject available skill tools into context (if any are installed) | ||||||||||
| if (this.toolManifest) { | ||||||||||
| enhancedPrompt = `${enhancedPrompt} | ||||||||||
|
|
||||||||||
| ${this.toolManifest} | ||||||||||
|
|
||||||||||
| To invoke a skill tool, use the action: "invoke_skill" with "skill", "tool", and "args" properties. | ||||||||||
| Example: {"action": "invoke_skill", "skill": "web-scraper", "tool": "fetch_page", "args": {"url": "..."}, "summary": "Fetching page"}`; | ||||||||||
| } | ||||||||||
|
|
||||||||||
| const spinner = ui.spinner('Thinking...'); | ||||||||||
| spinner.start(); | ||||||||||
|
|
||||||||||
|
|
@@ -451,6 +467,10 @@ For command execution on ${osType}, use appropriate command separators (${osType | |||||||||
| // Store the process handle for potential cleanup later | ||||||||||
| if (!this.runningProcesses) { | ||||||||||
| this.runningProcesses = []; | ||||||||||
|
|
||||||||||
| // Load installed agent skills for tool invocation | ||||||||||
| this.installedSkills = skillRegistry.loadAllSkills(); | ||||||||||
| this.toolManifest = skillRegistry.generateToolManifest(); | ||||||||||
|
Comment on lines
+470
to
+473
|
||||||||||
| // Load installed agent skills for tool invocation | |
| this.installedSkills = skillRegistry.loadAllSkills(); | |
| this.toolManifest = skillRegistry.generateToolManifest(); |
Copilot
AI
Jan 31, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Skill tool execution lacks user permission prompts. According to the project's architecture guidelines (CodingGuidelineID: 1000000), "ALL commands require user permission" like GitHub Copilot's model. The run_command action uses requirePermission: true (line 454), but the new invoke_skill action executes Python tools directly without asking for user confirmation. This violates the established safety pattern where users must approve potentially dangerous operations.
Consider adding a permission prompt before executing skill tools, similar to how command execution is handled. This is especially important since skills are third-party code that could perform arbitrary operations.
| Original file line number | Diff line number | Diff line change | ||
|---|---|---|---|---|
|
|
@@ -9,6 +9,7 @@ const fsSync = require('fs'); | |||
| const path = require('path'); | ||||
| const os = require('os'); | ||||
| const ui = require('./ui'); | ||||
| const skillRunner = require('./skillRunner'); | ||||
|
||||
| const skillRunner = require('./skillRunner'); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Missing validation for required PlanStep fields in invoke_skill action. The backend PlanStep model defines optional fields
skill,tool, andargsfor the invoke_skill action, but there's no validation ensuring these required fields are present when action is "invoke_skill". This could lead to runtime errors if the AI model returns an invoke_skill step without providing the necessary skill/tool information.Consider adding a validation decorator or custom validator to ensure that when
action == "invoke_skill", the fieldsskillandtoolare required (not None). The Pydantic model should enforce this constraint.