OpenShell is a runtime for autonomous AI agents that executes them in sandboxed environments governed by declarative policies. It is used to restrict agents' access to files, credentials, data, and network resources, and the catalogue includes skills and workflows for operating and contributing to it.
Borrowing it
Nothing to install: this file belongs to NVIDIA/OpenShell. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/NVIDIA/OpenShell/main/.agents/skills/build-from-issue/SKILL.mdgit clone --depth 1 https://github.com/NVIDIA/OpenShellWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nvidia/openshell/build-from-issue)<a href="https://agentmods.dev/skills/nvidia/openshell/build-from-issue"><img src="https://agentmods.dev/badge/skills/nvidia/openshell/build-from-issue/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nvidia/openshell/build-from-issue"><img src="https://agentmods.dev/badge/skills/nvidia/openshell/build-from-issue.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Snyk warn
- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 30 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00029 | $0.01023 |
| Opus 5.5 | $0.00012 | $0.00409 |
| Sonnet 5.5 | $0.00006 | $0.00205 |
| Haiku 4.5 | $0.00003 | $0.00102 |
Grade A, and why
build-from-issue scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 39 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Build From Issue
Use a specific GitHub issue to plan and implement a scoped change. Direct user instructions authorize the phase requested. Planning alone does not authorize implementation. For unattended work, inspect the current state:* label descriptions, maintainer assignments, and issue comments to infer the authorized phase. Proceed only when those records authorize the phase; do not assume every state permits implementation.
Inspect the issue
- Run
gh issue view <id> --json number,title,body,state,labels,comments,assigneesand follow Label Discovery inCONTRIBUTING.mdto retrieve every page of currentstate:*label definitions and resolve unclear meanings. Infer whether triage, validation, and human acceptance have happened. Do not hard-code label names or change disposition as part of building. - Read the issue, comments, linked PRs, and current code. Check for an active owner or implementation. If the issue concerns a vulnerability, use
review-security-issueandfix-security-issueinstead. - Confirm that the User Story attests to the human operator's first-hand OpenShell use and gives a specific use case. If the issue lacks this, ask the operator before proceeding with planning or implementation. For a bug, require reproduction using only an OpenShell deployment; do not install third-party tools solely to demonstrate the problem.
- If the user's direct request starts before the normal issue disposition, briefly report the discrepancy and continue with the authorized phase. Stop only when information needed to do the work is actually unavailable or a conflicting owner needs resolution.
Plan
Identify the user-visible outcome, affected code, alternatives, tests, and documentation. For configuration, CLI, SDK, or other UX changes, include notional commands, configuration, or API examples so a human can review the proposed interaction. Consider existing extensibility points such as middleware, interceptors, and providers. Prefer an applicable extension when it satisfies the use case; the need to run another service alone does not disqualify it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed · +2 lines be7557047335
- 18d ago Changed · +2 lines e4db6db7c93f
- 24d ago Changed 5ae89fe214dc
- 1mo ago Changed 5f337a145255
- 1mo ago Changed · -726 lines · -40 tokens per session 7938e32c4dff
- 1mo ago Changed a1083481675b
- 2mo ago Changed · +2 lines 50c79739032c
- 2mo ago First seen · 759 lines · 69 tokens per session scan A 241faa6a4eb9
build-from-issue is a skill published in the GitHub repository NVIDIA/OpenShell (21,172 stars, last pushed yesterday), licensed Apache-2.0. It adds 29 tokens to every session and 1,023 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
build-from-issue compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| build-from-issueNVIDIA/OpenShell | Skill | 21k | yesterday | Apache-2.0 | A | 29 | Claude Code, Codex |
| imagegenopenai/codex | Skill | 133k | today | Apache-2.0 | A | 113 | Codex |
| playwright-climicrosoft/playwright | Skill | 99k | yesterday | Apache-2.0 | A | 19 | Claude Code |
| local-ai-agentsmicrosoft/ai-agents-for-beginners | Skill | 79k | 4d ago | MIT | A | 200 | Claude Code, Codex |
| systematic-debuggingobra/superpowers | Skill | 313k | 3d ago | MIT | A | 21 | Claude Code |
| next-cache-components-adoptionvercel/next.js | Skill | 143k | today | MIT | A | 95 | Claude Code |
| chat-pet-sprite-creationmicrosoft/vscode | Skill | 195k | today | MIT | A | 53 | Claude Code, Codex |