CoralOS

End-to-end Coral Cloud workflow — discover registry remote agents, compose and launch a session of agents, then monitor and close it.

Security Scan

The instructions match the stated Coral Cloud workflow, but the skill omits expected pieces (auth requirements and the referenced scripts/payloads), creating an incoherent footprint that could cause unintended network calls or require secrets not declared.

Purpose & Capability

The skill's purpose (discover, create, manage Coral Cloud sessions) aligns with the listed API endpoints and commands, but it claims no required credentials or files while instructing use of remote API endpoints and local helper scripts/examples that are not included in the package. A Coral Cloud integration typically needs authentication (API key or token) and the provided shell/Python helper scripts; their absence is a mismatch.

Instruction Scope

Runtime instructions direct the agent to call live endpoints at api.coralcloud.ai and run local scripts (bash scripts/* and scripts/build_coral_session_payload.py) and to use example payload files (examples/payloads/...). The skill does not include these files and gives no explicit auth or environment guidance, leaving the agent discretion to run network calls or local commands against whatever environment the user provides.

Install Mechanism

This is an instruction-only skill with no install spec and no bundled code—lowest install risk. Nothing is written to disk by the skill package itself.

Credentials

No environment variables, credentials, or config paths are declared, yet the instructions require calling authenticated-sounding APIs and likely need a Coral Cloud API token or local configuration. The absence of declared credentials is disproportionate and unclear about where secrets come from or how they are used.

Persistence & Privilege

The skill does not request persistent/always-on presence (always:false) and uses the default model invocation behavior. It does not attempt to modify other skills or system-wide agent settings.

What to consider before installing

This skill's instructions describe valid Coral Cloud operations, but it omits two important things: (1) the helper scripts and example payloads it tells you to run are not included in the package, and (2) it does not state how to authenticate to api.coralcloud.ai. Before installing or running it, verify where the scripts/payloads come from and whether you need to provide an API token or other secret. Do not store secrets in insecure places; if the skill author expects the agent to read env vars or local config, ask them to document which variables are required and why. If you plan to exercise the live endpoints, run tests in an isolated environment (or sandbox) and confirm the Coral Cloud domain is legitimate (docs.coralos.ai). If you have doubts about missing files or hidden auth behavior, treat the skill as untrusted until the author provides the missing artifacts and authentication guidance.

Coral

Use this skill to run a complete Coral Cloud session: discover available agents, build and submit a session payload, then monitor and close it.

Phase 1 — Discover (Registry)

Identify the agent you want to run before composing a session payload.

Fast commands:

• bash scripts/list_registry_agents.sh
• bash scripts/inspect_registry_agent.sh <source> <agent_name> <version>

Live endpoints:

• List: GET https://api.coralcloud.ai/api/v1/registry
• Inspect: GET https://api.coralcloud.ai/api/v1/registry/{source}/{agentName}/{version}

Before moving on, record:

• source
• agentName
• version
• notable option requirements and constraints

If you see {"message":"Not found"}, compare the URL to the current Coral Cloud API guide.

---

Phase 2 — Create Session

Build and submit a POST /api/v1/local/session payload using the agent identified in Phase 1.

Fast commands:

• bash scripts/create_session.sh examples/payloads/echo-session.json
• bash scripts/create_session_from_simple.sh examples/payloads/simple/echo-session.json

Payload notes:

• Payload shape is strict — start from examples/payloads/echo-session.json or expand from examples/payloads/simple/ using scripts/build_coral_session_payload.py.
• Required fields: agentGraphRequest, namespaceProvider, execution.
• Optional: session annotations, extendedEndReport.
• Custom tool/webhook flows are experimental until callback host policy is confirmed in your environment.

Success criteria:

• Non-error API response
• Real sessionId in the response

---

Phase 3 — Manage Session

Monitor progress and clean up after the session is running.

Fast command:

• bash scripts/get_session_state.sh <namespace> <session_id>

Live endpoint:

• State: GET /api/v1/local/session/{namespace}/{sessionId}
• Verify list and delete routes against your environment before automating cleanup loops.

Lifecycle checklist:

• Session exists
• Agents connect and begin execution
• Output appears in Coral Cloud thread when requested
• Session is closed when no longer needed

Success criteria:

• Real state payload for the target session
• Evidence of agent progress and/or thread activity