mirror of https://github.com/trailofbits/skills synced 2026-06-21 14:12:00 +00:00

Files

T

History

Lixin2026 d5fe2e6a78 feat(codex): add UI metadata for skills (#175 )

* feat(codex): add skill UI metadata

* Use official Trail of Bits logo

* fix: resolve code review findings for PR #175

Codex silently drops the icons as authored: its loader
(codex-rs/core-skills resolve_asset_path) requires icon paths
containing '..' to resolve under <plugin_root>/assets/, and the
repo-root .codex/assets location fails that containment check.
Verified empirically via codex app-server plugin/read: every
iconSmall/iconLarge came back null; only brand_color applied.

P1 fixed:
- Vendor trail-of-bits-mark.svg into plugins/<name>/assets/ for
  all 38 plugins with skills and point every openai.yaml at
  ../../assets/trail-of-bits-mark.svg (the supported plugin-level
  shared asset pattern). Icons now resolve for marketplace
  installs too, since nothing escapes the plugin root.
- Drop the .codex/ additions: .codex/skills/gh-cli/agents/
  openai.yaml resolved nowhere (.codex/skills is not a Codex
  discovery root) and PR #173 removes the whole .codex/ tree

P2 fixed:
- Patch-bump all 38 touched plugins in plugin.json and
  marketplace.json so installed clients pick up the metadata

Verified:
- Static check replicating Codex's resolution algorithm: all 73
  yaml files resolve under their plugin assets/ and exist
- Live codex app-server probe: 71/72 loadable skills report
  resolved iconSmall/iconLarge and brand_color #D83A34
  (claude-in-chrome-troubleshooting fails to load on main due to
  a pre-existing 64-char qualified-name limit, fixed by #173's
  rename; zeroize-audit's manifest mcpServers object is likewise
  a pre-existing Codex incompatibility fixed by #173)
- validate_codex_skills.py, validate_plugin_metadata.py, prek all
  pass

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(codex): use skill-local icon assets

---------

Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-05 12:28:41 -04:00

.claude-plugin

feat(codex): add UI metadata for skills (#175 )

2026-06-05 12:28:41 -04:00

skills/devcontainer-setup

feat(codex): add UI metadata for skills (#175 )

2026-06-05 12:28:41 -04:00

README.md

Sync skill with claude-code-devcontainer repo (#151 )

2026-04-28 20:50:28 -04:00

README.md

Devcontainer Setup Plugin

Create pre-configured devcontainers with Claude Code and language-specific tooling.

Features

Claude Code pre-installed with bypassPermissions auto-configured and marketplace plugins
Multi-language support: Python 3.13, Node 22, Rust, Go
Modern CLI tools: ripgrep, fd, fzf, tmux, git-delta, ast-grep
Session persistence: command history, GitHub CLI auth, Claude config survive rebuilds
Sandboxing: bubblewrap and socat for Claude Code sandboxing support
Network isolation: iptables/ipset with NET_ADMIN capability for restricting outbound traffic
Token forwarding: CLAUDE_CODE_OAUTH_TOKEN and ANTHROPIC_API_KEY forwarded to container

Usage

Tell Claude to "set up a devcontainer" or "add devcontainer support" in your project.

The skill will:

Detect your project's language stack
Generate .devcontainer/ configuration files
Provide instructions for starting the container

Generated Files

File	Purpose
`Dockerfile`	Container build instructions with Claude Code and dev tools
`devcontainer.json`	VS Code/devcontainer configuration
`post_install.py`	Post-creation setup (permissions, tmux, git config)
`.zshrc`	Shell configuration with history persistence
`install.sh`	CLI helper (`devc` command) for managing containers

CLI Helper Commands

After generating, run .devcontainer/install.sh self-install to add the devc command:

devc .              Install template + start container in current directory
devc up             Start the devcontainer
devc rebuild        Rebuild container (preserves persistent volumes)
devc down           Stop the container
devc shell          Open zsh shell in container
devc exec <cmd>     Execute a command in the running container
devc upgrade        Upgrade Claude Code to latest version
devc mount <h> <c>  Add a bind mount to the container
devc sync           Sync sessions from devcontainers to host
devc cp <c> <h>     Copy files from container to host
devc destroy [-f]   Remove container, volumes, and image

Supported Languages

Language	Detection	Configuration
Python	`pyproject.toml`, `*.py`	Python 3.13 via uv (in Dockerfile)
Node/TypeScript	`package.json`, `tsconfig.json`	Node 22 via fnm (in Dockerfile)
Rust	`Cargo.toml`	Devcontainer feature
Go	`go.mod`	Devcontainer feature

Multi-language projects automatically get all detected configurations merged.

Security Model

The devcontainer provides filesystem isolation with network isolation capabilities:

Container filesystem is isolated from host
.devcontainer/ mounted read-only inside the container to prevent escape
Your ~/.gitconfig is mounted read-only
SYS_ADMIN capability blocked by devc CLI to protect read-only mounts
Persistent volumes preserve auth across rebuilds
iptables/ipset with NET_ADMIN/NET_RAW capabilities for restricting network access
NPM security settings: scripts disabled, 24-hour package release delay
SSH commit signing supported via gpg.ssh.program configuration

Reference Material

references/dockerfile-best-practices.md - Docker optimization tips
references/features-vs-dockerfile.md - When to use features vs Dockerfile