AI Dev Runtime

AI Dev Runtime tools - read_file, search, edit, run_terminal, run_tests (hybrid semantic+keyword search, learning memory)

Security Scan

The skill's stated purpose (a local Dev Runtime for reading/searching/editing/running tests) matches its instructions, but the SKILL.md asks the agent to send code snippets and prior memory to an HTTP endpoint (configurable via AI_DEV_RUNTIME_URL) and references environment variables (AI_DEV_RUNTIME_URL, AI_DEV_RUNTIME_API_KEY) that are not declared in the registry metadata — this creates a potential for unintended code or secret exfiltration and is an incoherence to be aware of.

Purpose & Capability

The name/description (tools for read_file, search, edit, run_terminal, run_tests, semantic+keyword search, memory) align with the instructions which describe an AiDevRuntime HTTP service exposing those operations. That capability set is coherent with the stated purpose. Minor mismatch: SKILL.md expects environment configuration (AI_DEV_RUNTIME_URL, optional API key) despite the registry declaring no required env vars.

Instruction Scope

Runtime instructions direct the agent to call an external/local HTTP service and to use memory_search and pass prior code snippets as prior_memory so the runtime can use them. This means the agent will send repository snippets / past fixes / memory to the configured endpoint. SKILL.md also implicitly grants the agent discretion to look up 'similar past fixes' and pass them along — that can lead to sending sensitive code, tokens, or other secrets to the endpoint. The instructions reference env vars (AI_DEV_RUNTIME_URL, AI_DEV_RUNTIME_API_KEY) that are not declared by the skill manifest, creating an inconsistency about what the skill will access.

Install Mechanism

This is an instruction-only skill with no install spec and no code files — low disk/write risk. Nothing is downloaded or installed by the skill manifest.

Credentials

The SKILL.md asks users to set AI_DEV_RUNTIME_URL (default localhost) and optionally AI_DEV_RUNTIME_API_KEY, but the manifest lists no required environment variables or primary credential. Because the endpoint is configurable, the agent could be pointed at a remote server and will transmit code and memory there; that capability justifies declaring and documenting the env vars and the threat model. The mismatch between declared env and instructions is a proportionality and transparency issue.

Persistence & Privilege

The skill does not request always:true, does not install persistent components, and does not claim to modify other skills or global agent settings. Default autonomous invocation is allowed (normal) but not combined with other high-privilege flags.

What to consider before installing

This appears to be a developer tooling integration that expects an AiDevRuntime HTTP service and will send code snippets and prior 'memory' to that service. Before enabling: 1) Confirm where AI_DEV_RUNTIME_URL will point — prefer running the service locally (localhost) rather than a remote/third-party host. 2) Treat AI_DEV_RUNTIME_API_KEY as a secret if used; ask the maintainer to declare required env vars in the manifest. 3) Ask what exact data the runtime receives and whether it persists or shares code snippets or sensitive files. 4) If you cannot verify the server or its operator, avoid pointing the URL to an external host because the agent may transmit repository contents and past fixes (which can include secrets). 5) Consider requesting a manifest update that explicitly lists AI_DEV_RUNTIME_URL and AI_DEV_RUNTIME_API_KEY and documents what data flows to the runtime and retention policies.

Use these tools to interact with AI Dev Runtime:

• ai_dev_runtime_command: Slash command — /ai-dev-runtime <task> runs full dev task (plan → edit → test → fix)
• ai_dev_runtime_invoke: Low-level tool calls — read_file, search, edit, edit_multi, apply_patch, find_references, call_hierarchy, run_terminal, run_tests
• ai_dev_runtime_run_task: Batch task execution (multi-step coding)
• ai_dev_runtime_fix_bug: Bug-fix workflow (analyze → patch → verify)
• ai_dev_runtime_analyze: Codebase analysis (semantic + keyword search, learning memory)

For higher accuracy: Before calling ai_dev_runtime_fix_bug or ai_dev_runtime_run_task, use memory_search to find similar past fixes (e.g. "login bug", "500 error", "pytest"). Pass the snippets as prior_memory so Runtime can use them.

Set AI_DEV_RUNTIME_URL (default http://localhost:8000) and optionally AI_DEV_RUNTIME_API_KEY. Ensure AiDevRuntime HTTP server is running.