OpenShell is a runtime for autonomous AI agents that executes them in sandboxed environments governed by declarative policies. It is used to restrict agents' access to files, credentials, data, and network resources, and the catalogue includes skills and workflows for operating and contributing to it.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add NVIDIA/OpenShell --skill gator-gategit clone --depth 1 https://github.com/NVIDIA/OpenShellWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nvidia/openshell/gator-gate)<a href="https://agentmods.dev/skills/nvidia/openshell/gator-gate"><img src="https://agentmods.dev/badge/skills/nvidia/openshell/gator-gate/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nvidia/openshell/gator-gate"><img src="https://agentmods.dev/badge/skills/nvidia/openshell/gator-gate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 6 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Memory Poisoning · line 539 Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.Fix: Protect agent memory and state from modification by untrusted content. Use read-only memory for critical instructions and validate all state changes.
- high Memory Poisoning · line 540 Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.Fix: Protect agent memory and state from modification by untrusted content. Use read-only memory for critical instructions and validate all state changes.
- high Anti-Refusal · line 687 Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.Fix: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
- medium Agent Snooping · line 14 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Excessive Agency · line 317 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 421 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.17240 |
| Opus 5.5 | $0.00023 | $0.06896 |
| Sonnet 5.5 | $0.00011 | $0.03448 |
| Haiku 4.5 | $0.00006 | $0.01724 |
Grade B, and why
gator-gate scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 25d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Strips warnings and disclaimersmediumAnti-refusal
Omitting safety caveats hides risk from the user and is a common jailbreak preamble.
`gator:in-review`; do not add Warnings. Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
Use REST-backed `gh api` for GitHub write actions inside gator sandboxes. Do not rely on `gh issue edit`, `gh pr edit`, or other high-level write commands when a REST path is available, because some of them use GraphQL m How it starts
The opening of the file, as written. The whole thing — 1,334 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Gator Gate
Validate OpenShell GitHub issues and pull requests for project fit, then monitor valid PRs until they are ready for maintainer approval.
This skill is a gating workflow. It can start from any issue or PR state, inspect the current gator:* label, and continue the correct next action.
Skill Location
Codex and other agent harnesses should load this skill from the repository path scripts/agents/gator/skills/gator-gate/SKILL.md. After this branch is merged, the canonical GitHub location is https://github.com/NVIDIA/OpenShell/blob/main/scripts/agents/gator/skills/gator-gate/SKILL.md.
Prerequisites
- The
ghCLI must be able to call GitHub APIs (gh api user --jq '.login') - You must be in the OpenShell repository root
- GitHub write permissions are required to apply labels, comment, close issues/PRs, or post
/ok to test
Do not use gh auth status as the authentication health check inside provider-backed sandboxes. Scoped provider tokens may be exposed as openshell:resolve:env:* placeholders and gh auth status probes endpoints outside the gator policy, causing false "token is invalid" reports even when allowed gh api and gh pr calls succeed. Use gh api user --jq '.login' and a repo-scoped probe instead.
Use REST-backed gh api for GitHub write actions inside gator sandboxes. Do not rely on gh issue edit, gh pr edit, or other high-level write commands when a REST path is available, because some of them use GraphQL mutations and gator policy allows GraphQL reads only. Do not fall back to curl for credentialed GitHub writes unless the active provider policy explicitly allows the curl binary for the same scoped endpoint. Preferred write shapes:
jq -Rs '{body:.}' comment.md > /tmp/comment.json
gh api --method POST repos/NVIDIA/OpenShell/issues/<number>/comments --input /tmp/comment.json --jq .html_url
gh api --method POST repos/NVIDIA/OpenShell/issues/<number>/labels -f labels[]="gator:<state>"
gh api --method DELETE repos/NVIDIA/OpenShell/issues/<number>/labels/gator%3Ablocked --silent || true
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 25d ago Changed · +15 lines 4802e90e9c75
- 29d ago Changed · +7 lines 9c28bff7b012
- 1mo ago Changed · +6 lines a14313253712
- 1mo ago Changed · +2 lines d168ff07c853
- 1mo ago Changed · +3 lines 030f3c89f270
- 1mo ago Changed b1b2fff94216
- 1mo ago Changed · +1 lines c3a9e50f88b1
- 2mo ago Changed · +6 lines 962dcdfa869d
- 2mo ago First seen · 1,294 lines · 57 tokens per session scan B d80485fd553f
gator-gate is a skill published in the GitHub repository NVIDIA/OpenShell (21,172 stars, last pushed yesterday), licensed Apache-2.0. It adds 57 tokens to every session and 17,240 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it B with 2 findings (strips warnings and disclaimers, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
gator-gate compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| gator-gateNVIDIA/OpenShell | Skill | 21k | yesterday | Apache-2.0 | B | 57 | Claude Code, Codex |
| prYeachan-Heo/oh-my-claudecode | Skill | 41k | yesterday | MIT | A | 47 | Claude Code |
| merge-batchdiegosouzapw/OmniRoute | Skill | 83k | 5d ago | MIT | A | 46 | Claude Code |
| otto-pr-review-loopomnigent-ai/omnigent | Skill | 11k | today | Apache-2.0 | A | 17 | Claude Code, Codex |
| engram-branch-prGentleman-Programming/engram | Skill | 7.8k | today | MIT | A | 37 | Claude Code, Codex |
| github-contributordaymade/claude-code-skills | Skill | 1.5k | yesterday | MIT | A | 105 | Claude Code, Codex |
| revdiffumputun/revdiff | Skill | 945 | yesterday | MIT | A | 250 | Claude Code |