OpenShell is a runtime for autonomous AI agents that executes them in sandboxed environments governed by declarative policies. It is used to restrict agents' access to files, credentials, data, and network resources, and the catalogue includes skills and workflows for operating and contributing to it.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add NVIDIA/OpenShell --skill openshell-cligit clone --depth 1 https://github.com/NVIDIA/OpenShellWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nvidia/openshell/openshell-cli)<a href="https://agentmods.dev/skills/nvidia/openshell/openshell-cli"><img src="https://agentmods.dev/badge/skills/nvidia/openshell/openshell-cli/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nvidia/openshell/openshell-cli"><img src="https://agentmods.dev/badge/skills/nvidia/openshell/openshell-cli.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Snyk pass
- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 203 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 225 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00134 | $0.11264 |
| Opus 5.5 | $0.00054 | $0.04506 |
| Sonnet 5.5 | $0.00027 | $0.02253 |
| Haiku 4.5 | $0.00013 | $0.01126 |
Grade A, and why
openshell-cli scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 1,006 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OpenShell CLI
Guide agents through using the openshell CLI for sandbox and platform management -- from basic operations to advanced multi-step workflows.
Overview
The OpenShell CLI (openshell) is the primary interface for managing sandboxes, providers, policies, settings, exposed services, and gateway registrations. Gateway service lifecycle is handled outside the CLI by packages, systemd, or Helm. This skill teaches agents how to orchestrate CLI commands for common and complex workflows.
Companion skill: For creating or modifying sandbox policy YAML content (network rules, L7 inspection, access presets), use the generate-sandbox-policy skill. This skill covers the CLI commands for the policy lifecycle; generate-sandbox-policy covers policy content authoring.
Self-teaching: The CLI has comprehensive built-in help. When you encounter a command or option not covered in this skill, walk the help tree:
openshell --help # Top-level commands
openshell <group> --help # Subcommands in a group
openshell <group> <cmd> --help # Flags for a specific command
This is your primary fallback. Use it freely -- the CLI's help output is authoritative and always up-to-date.
Prerequisites
openshellis on the PATH. Follow the published installation guide when it is not installed.- A reachable OpenShell gateway backed by Docker, Podman, Kubernetes, or the experimental VM driver
- Docker is running only when using BYOC local builds or a Docker-backed gateway
- For Kubernetes deployments:
kubectland Helm access to the target cluster
Authoritative References
Use openshell --help and nested --help output as the authority for the installed CLI version. Use the published documentation for product concepts and supported workflows:
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +3 lines 47ddbf74d006
- 2d ago Changed · +24 lines ead7769174cb
- 3d ago Changed · +2 lines c986b6e37d54
- 6d ago Changed · +10 lines 42aeb3651658
- 7d ago Changed · +2 lines e3992739f626
- 9d ago Changed · +7 lines 49f878be9a76
- 13d ago Changed · +2 lines 6c80295069ef
- 15d ago Changed · +19 lines ecf6e15ba387
- 16d ago Changed · +7 lines 61a5e09c2017
- 17d ago First seen · 930 lines · 134 tokens per session scan A 15257b243ff0
openshell-cli is a skill published in the GitHub repository NVIDIA/OpenShell (16,343 stars, last pushed today), licensed Apache-2.0. It adds 134 tokens to every session and 11,264 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
azd-deployment
Deploy containerized frontend + backend applications to Azure Container Apps with remote builds, managed identity, and idempotent infrastructure.
langbot-deploy
Deploy and configure a LangBot instance — Docker / Docker Compose, Kubernetes, the config.yaml model, the Box sandbox runtime, the plugin runtime, and the global API key. Use when installing, deploying, upgrading, or configuring LangBot in production or self-hosted environments. Triggers on "deploy langbot", "langbot…
compute-env-setup
Set up a compute environment on a remote provider so Claude Science jobs can run there. Covers direct SSH/conda hosts, Slurm clusters, container-via-bridge runners, and managed-API providers (Modal, GCP, RunPod). Use when standing up a new provider, porting an env to a different backend, adding a tool that needs its…
compute-env-setup
Set up a reproducible Feynman compute environment for research jobs. Use when a task needs Python/R packages, GPU libraries, containers, Modal, SSH, caches, or managed model runtime setup.
atmos-helmfile
Helmfile orchestration: sync/apply/destroy/diff, Kubernetes deployments, declarative Helm plugins, varfile generation, EKS integration, source management.
atmos-devcontainer
Devcontainer orchestration: start/stop/attach/shell/exec/rebuild, instance management, config handling, VS Code integration.