Skip to content

Onboard IsaacLab skills for NVCARPS / Isaac Skills catalog - #7879

Open
matthewtrepte wants to merge 29 commits into
isaac-sim:developfrom
matthewtrepte:mtrepte/nvcarps-skill-onboarding
Open

matthewtrepte wants to merge 29 commits into
isaac-sim:developfrom
matthewtrepte:mtrepte/nvcarps-skill-onboarding

Conversation

@matthewtrepte

Copy link
Copy Markdown
Collaborator

Summary

  • Adds 13 IsaacLab user skills (skills/user/isaaclab-*) and internal skills formatted for the Isaac Skills catalog (NVCARPS)
  • Adds .agents/skills/ and .claude/skills discovery aliases for agent auto-discovery
  • Adds skills-check.yml CI gate running SkillEvaluator Tier 1/2A/2B/3 on every PR touching skills/**
  • Adds tools/skills/cli.py local validator with 27 regression tests
  • Extends validator to accept developer-audience skills; scopes license/metadata.author to user-audience only
  • Fixes three frontmatter YAML parser bugs in the local validator

Skills added

Skill Audience
isaaclab-building-environments user
isaaclab-converting-direct-to-manager user
isaaclab-debugging-rl-training user
isaaclab-diagnosing-joint-poses user
isaaclab-migrating-from-isaac-gym user
isaaclab-planning-manipulation-tasks user
isaaclab-preparing-assets-for-newton user
isaaclab-randomizing-with-events user
isaaclab-selecting-backends user
isaaclab-training-multi-gpu user
isaaclab-training-rl-agents user
isaaclab-using-presets user
isaaclab-using-sensors-actuators user
coding-style user
changelog-fragments user
pr-workflow _internal
install _internal
setup-troubleshooting _internal
migrate-2x-to-3x _internal

Test plan

  • python3 tools/skills/cli.py check passes all 23 skills locally
  • 27/27 unit tests pass (tools/skills/test/)
  • SkillEvaluator Tier 1 passes all 13 user skills locally
  • CI check-skills job passes
  • CI validate-skills job passes (requires NVIDIA internal network for SkillEvaluator)

@matthewtrepte
matthewtrepte requested a review from a team September 17, 2026 21:21
@matthewtrepte
matthewtrepte deployed to skillevaluator-review September 17, 2026 21:21 — with GitHub Actions Active
@github-actions github-actions Bot added documentation Improvements or additions to documentation infrastructure labels Sep 17, 2026
@greptile-apps

greptile-apps Bot commented Sep 17, 2026

Copy link
Copy Markdown
Contributor

RetriggerConfidence Score: 4/5

This PR should not merge until the SkillEvaluator job fails when its required internal registry is unavailable; the stale documentation links should also be corrected.

Findings

  1. P1 Validation gate silently skips
  2. P2 Relocation leaves broken links

Summary

This PR restructures Isaac Lab’s agent-skill catalog, adds catalog metadata and evaluation fixtures, extends the local validator, and introduces an internal SkillEvaluator CI job.

  • Renames public skills to the isaaclab-* layout and relocates repository-only skills under skills/_internal.
  • Adds and retargets native agent-discovery aliases.
  • Adds JSON evaluation suites and expands frontmatter/evaluation validation.
  • Adds PR-file discovery and Tier 1/2A/2B/3 CI evaluation.
  • The CI gate currently succeeds without evaluation when its internal registry is unavailable, and several documentation links were not updated after relocation.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  PR[Pull request touching skills] --> Local[Local validator and tests]
  PR --> Runner[Self-hosted GPU runner]
  Runner --> Registry{Internal registry reachable?}
  Registry -->|No| Skip[Warn and skip SkillEvaluator]
  Skip --> Green[Job succeeds without evaluation]
  Registry -->|Yes| Detect[Determine touched user skills]
  Detect --> Evaluate[Tier 1 / 2A / 3 per skill]
  Evaluate --> Similarity[Tier 2B repository similarity]
  Similarity --> Result[Pass or fail job]
Loading

Reviews (1) · Last reviewed commit: "Address review bot: targeted registry sk..."

Comment thread .github/workflows/skills-check.yml Outdated
echo "reachable=true" >> "$GITHUB_OUTPUT"
else
echo "reachable=false" >> "$GITHUB_OUTPUT"
echo "::warning::urm.nvidia.com unreachable — runner is not on the NVIDIA internal network; SkillEvaluator steps will be skipped"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Validation gate silently skips

When the selected self-hosted runner cannot resolve the internal registry, this step only emits a warning. The installation and all subsequent SkillEvaluator steps are then skipped, so the job succeeds without running any Tier 1/2A/2B/3 validation. A runner networking or labeling problem therefore silently disables the new CI gate instead of blocking the affected PR.

@@ -1 +1 @@
../../skills/user/setup-troubleshooting No newline at end of file
../../skills/_internal/setup-troubleshooting No newline at end of file

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Relocation leaves broken links

This alias now targets the relocated _internal skill, but related source-of-truth documentation still points to removed skills/user/* and skills/developer/* paths. The setup, migration, and contribution pages therefore contain broken links and direct maintainers to obsolete locations. Please update those references as part of the move.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

@isaaclab-review-bot isaaclab-review-bot Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isaac Lab Review Bot

The catalog-style skill layout, discovery aliases, documentation links, validator extensions, and PR-scoped SkillEvaluator integration are broadly coherent. One CI health-check issue should be corrected: skillevaluator doctor cannot inspect the inference credential because that secret is not provided to its step.

  • Design and architecture: The skills/user versus skills/_internal split and PR-scoped SkillEvaluator workflow are consistent with the catalog boundary. The overall structure is sound, but the workflow’s diagnostic stage should receive the same inference credential as the validation stage so it can meaningfully verify the configured service access.
  • API: The existing skill names exposed through discovery aliases are preserved while repository paths and cross-references are updated. The validator’s new license and metadata.author requirements are scoped to user-facing skills, with no accepted API compatibility concern.
  • Implementation: The nested-frontmatter and JSON evaluation validation changes are supported by focused tests. In .github/workflows/skills-check.yml, add NVIDIA_INFERENCE_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }} to the install/doctor step; otherwise skillevaluator doctor cannot observe the credential it is expected to diagnose and will produce an uninformative warning.

Minor fixes needed. Posted 1 actionable finding inline.

Automated review; human maintainers own approval decisions.

Comment thread .github/workflows/skills-check.yml Outdated
python3 -m pip install --upgrade pip
python3 -m pip install "skillevaluator==${SKILLEVALUATOR_VERSION}" -i https://urm.nvidia.com/artifactory/api/pypi/nv-shared-pypi/simple
skillevaluator --version
skillevaluator doctor || echo "::warning::skillevaluator doctor reported issues — check NVIDIA_INFERENCE_KEY and network access"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Suggestion · Implementation — doctor step lacks the key it validates

skillevaluator doctor runs inside the install step, whose env: block only sets SKILLEVALUATOR_VERSION. NVIDIA_INFERENCE_KEY is first defined two steps later, so the doctor check can never observe the credential and will permanently emit the "check NVIDIA_INFERENCE_KEY" warning, making this health check uninformative. Add NVIDIA_INFERENCE_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }} to this step's env.

@matthewtrepte
matthewtrepte deployed to skillevaluator-review September 17, 2026 21:28 — with GitHub Actions Active
@matthewtrepte
matthewtrepte deployed to skillevaluator-review September 17, 2026 21:59 — with GitHub Actions Active
@matthewtrepte
matthewtrepte deployed to skillevaluator-review September 17, 2026 22:02 — with GitHub Actions Active
@matthewtrepte

Copy link
Copy Markdown
Collaborator Author

run-ci

@isaaclab-bot isaaclab-bot Bot added ci:run-docker Trigger the on-demand Docker and GPU CI workflow and removed ci:run-docker Trigger the on-demand Docker and GPU CI workflow labels Sep 18, 2026
- Add `license: BSD-3-Clause` and `metadata.author` to all 17 user SKILL.md files
- Move `skills/developer/` → `skills/_internal/` (dev-only, not published externally)
- Update `.agents/skills/` symlinks to point to `_internal/` for the four internal skills
- Add `evals/evals.json` for all 17 user-facing skills (positive + negative eval cases)
- Update `tools/skills/cli.py` to support `_internal/` audience, require `license` and
  `metadata.author` fields, and validate `evals/evals.json` alongside `evaluations.md`
These skills are time-limited or maintainer-focused rather than general
user-facing: install/troubleshooting are one-time onboarding tasks that
stale quickly, and the 2x→3x migration guide has a finite lifespan.
These skills are useful to any Isaac Lab contributor, not just internal
maintainers. Added evals/evals.json for each and fixed the broken
relative link in pr-workflow that pointed to the old _internal/ path.
…ification

- Fix tools/skills/cli.py: eval entries now report missing id/prompt/expected_skill
  by key membership instead of a broken truthy check that let missing fields pass;
  expected_skill still allows null for negative eval cases. Non-object eval entries
  are now flagged instead of silently skipped (and no longer count toward the
  minimum-entries check). Parser now tracks metadata: nesting so a mistaken
  top-level author: can be told apart from a correctly nested metadata.author:.
- Replace unverified metadata.author email (isaaclab@nvidia.com, not used anywhere
  else in the repo) with the name-only Isaac Lab Team, matching the existing
  pyproject.toml/copyright-header convention.
- Move coding-style and changelog-fragments to skills/_internal/ alongside
  pr-workflow -- these are IsaacLab's own contribution/release conventions, not
  general framework-usage skills for external consumers.
- Remove stray untracked franka_panda_patched/ debug artifact from an unrelated
  investigation.
The prior commit's message described these fixes but the diff didn't include
the file -- git add -A skills/ didn't stage it.
Replace the name-only Isaac Lab Team placeholder with the confirmed team
alias, Isaac Lab Team <Isaac-Lab@exchange.nvidia.com>.
Cover the two review-bot findings and the author-nesting fix with dedicated
tests: missing id/prompt/expected_skill detection, expected_skill: null
allowed for negative eval cases, non-object eval entries rejected and
excluded from the minimum-entries count, top-level author rejected, and
_internal skills skip audience/status/owners but still require author.
Also updates the test skill fixture to include the now-required license and
metadata.author fields, which the existing test_validate_accepts_well_formed_user_skill
test was missing.
matthewtrepte and others added 21 commits September 18, 2026 19:38
Runs skillevaluator Tier 1/2A/2B/3 against skills/user/* changed by the
PR, mirroring the proven pattern from Isaac/isaac's
ci/gitlab_workflows/skills.yaml, adapted to GitHub Actions. This is the
prerequisite validation gate from the isaac-skills onboarding steps
(NVCARPS mirroring/publishing itself is a separate, later step).
Avoids provisioning a new secret: the repo already has
NVIDIA_INFERENCE_API_KEY (added for backport-release-3.0.yml's conflict
resolution), which maps to the NVIDIA_INFERENCE_KEY env var
skillevaluator expects.
…a.author

Upstream develop added issue-audit and issue-backlog-triage in
skills/developer/. These developer-utility skills don't carry a public
license or metadata.author because they're not destined for the Isaac
Skills catalog, but the validator was gating on those fields for every
non-internal skill.

Changes:
- Add "developer" back to AUDIENCES (upstream already has it).
- Scope license and metadata.author requirements to audience=="user" only.
- Gate _validate_user_evaluations on audience=="user" (same scoping).
- Update test to reflect that internal skills no longer require
  metadata.author, and add a new test for developer skills.
Parser fixes (tools/skills/cli.py):
- Clear current_map_key after processing a list item so a subsequent
  indented 'key: val' line is not silently absorbed as a dotted map entry
  (e.g. 'owners.stray' when 'stray: val' appeared after a list item).
- Guard nested map key parsing against an empty key produced by '  : val'
  under a map-intro parent.
- Remove the stray empty-list pre-write for map-intro keys (e.g. 'metadata:')
  that left data['metadata']=[] alongside 'metadata.author' dotted entries;
  the list branch creates the list on first item via setdefault.
- Fix false-positive in evals.json field validation: use 'value is None or
  value == ""' instead of 'not entry.get(field)', which incorrectly flagged
  numeric id:0 as a missing field.

CI fixes (.github/workflows/skills-check.yml):
- Replace 'skillevaluator doctor || true' with a GitHub Actions warning so
  pre-flight configuration errors (missing key, network) surface as a named
  diagnostic instead of being silently swallowed.
- Output skill directories newline-separated and consume them with
  'while IFS= read -r' instead of word-splitting on a space-joined string,
  preventing silent path corruption for any directory name with spaces.
…ity flags

SkillEvaluator Tier 1 requires the directory name to equal the frontmatter
'name' field. All 13 user skill directories used short names while the
frontmatter used the full 'isaaclab-*' names, causing a schema failure on
every skill. Renamed all directories and updated:
- .agents/skills/ symlinks to point at the new paths
- Cross-skill relative links (../old-name/ → ../new-name/)
- Backtick paths in all markdown reference files

Also fixed two "Memory Poisoning: Reset state" keyword hits from the static
security scanner. The phrase "reset state" is standard RL environment
terminology but matches a prompt-injection guard looking for agent-memory
manipulation. Rephrased to "initial environment configuration / pose":
- skills/user/isaaclab-debugging-rl-training/reference.md
- skills/user/isaaclab-planning-manipulation-tasks/SKILL.md
- skills/user/isaaclab-randomizing-with-events/examples.md

Remaining Tier 1 security failures ("skillspector scan did not execute
reliably") are caused by the LLM-based semantic analyzers requiring
NVIDIA_INFERENCE_KEY, which is only available in CI. They are not content
issues and will resolve automatically when CI runs with the secret.
The previous commit used overly broad rephrasing ("episode-start",
"initial environment pose/configuration") that replaced the canonical
IsaacLab term "reset" unnecessarily.

The security scanner flags the two-word phrase "reset state" as a
potential memory-poisoning keyword. Breaking that exact phrase is
sufficient; the word "reset" itself is fine.

Revised phrasing keeps "reset" and avoids only the two-word collocation:
- "Reset state for robot, object, and goal"
  → "Robot, object, and goal state after environment reset"
- "reset state, and observation coverage"
  → "state after reset, and observation coverage"
- "Reset state is physically valid"
  → "Environment configuration at reset is physically valid"
- "Reset State Randomization" / "reset state randomization"
  → "Reset-Mode Randomization" / "reset-mode randomization"
ruff format requires the three-line implicit string concatenation in
test_validate_developer_skill_does_not_require_license_or_author to be
written as a single string literal.
The NVIDIA internal Artifactory (urm.nvidia.com) is not accessible from
the open-source self-hosted GPU runners. Add continue-on-error to the
install step and guard downstream steps on install success, so the job
emits a warning instead of failing when the package cannot be fetched.
When a runner with internal network access picks up the job the full
Tier 1/2A/2B/3 validation still runs and can block the PR.
Three issues flagged by greptile on PR isaac-sim#7878:

1. Docs linked to old skill directory names (pre-rename).
   Update 9 doc source files to use the new isaaclab-* paths:
   - prepare-assets-for-newton → isaaclab-preparing-assets-for-newton
   - migrate-from-isaac-gym → isaaclab-migrating-from-isaac-gym
   - domain-randomization-events → isaaclab-randomizing-with-events
   - create-environments → isaaclab-building-environments
   - plan-manipulation-tasks → isaaclab-planning-manipulation-tasks
   - train-rl-agents → isaaclab-training-rl-agents
   - debug-rl-training → isaaclab-debugging-rl-training
   - select-backends → isaaclab-selecting-backends
   - use-presets → isaaclab-using-presets
   - use-sensors-actuators → isaaclab-using-sensors-actuators

2. {"evals": null} caused a TypeError crash in the validator.
   data.get("evals", []) returns None when the key is present with a null
   value; iterating None raises TypeError before any diagnostic is emitted.
   Now validate that evals is a list before iterating and return a clear
   error if it is not. Added regression test.

3. validate-skills job ran untrusted PR code on self-hosted GPU runner
   without an explicit trust decision. Added environment: skillevaluator-review
   which requires maintainer approval in repo settings before execution.
Two issues found in PR CI:

1. Link checker 404s on absolute github.com/blob/develop/ URLs for the
   preparing-assets-for-newton skill — those paths don't exist on develop
   until this PR is merged. Convert to relative paths matching the style
   used by all other skill references in the docs.

2. Self-hosted GPU runner does not have gh CLI installed, so the
   "Determine touched skills" step fails with 'gh: command not found'.
   Replace the gh api call with Python stdlib urllib (always available
   since Python is used earlier in the job), preserving pagination.
The <<'PYEOF' heredoc inside a YAML run: block triggers the check-yaml
pre-commit hook because YAML parsers interpret << as a merge key even
inside block scalars.

Extract the Python that fetches PR changed files into
tools/skills/get_pr_files.py (stdlib only, no extra deps) and call it
directly from the workflow step.
Two issues flagged by isaaclab-review-bot:

1. continue-on-error on the install step meant any failure (bad version
   pin, transient pip error, not just missing network) silently disabled
   the SkillEvaluator gate and left the job green. Replace with an
   explicit registry connectivity pre-check: if urm.nvidia.com is
   unreachable the install step is skipped (not errored), which propagates
   as 'skipped' to downstream steps; if the registry is reachable but
   installation fails for any other reason the job fails as expected.

2. actions/upload-artifact was the only action in the file not pinned to
   an immutable commit SHA. Pin to 043fb46d (v7) matching the SHA-pinning
   style of all sibling actions, particularly important since this step
   runs in the job that holds NVIDIA_INFERENCE_API_KEY.
Without the secret, skillevaluator doctor cannot check inference-API
access and emits an uninformative warning instead of a real diagnostic.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
NVIDIA/SkillEvaluator is Apache 2.0 on GitHub, so the validate-skills
job no longer needs urm.nvidia.com or any NVIDIA-internal network access.

- Remove urm.nvidia.com DNS pre-check and reachable-gate conditions
- Install skillevaluator[tier2,security] from NVIDIA/SkillEvaluator@v0.1.0
- Drop --profile internal and --catalog-path (not in public API)
- Drop --tier3 from validate (Tier 3 needs Docker+Harbor; run separately)
- Rename run step to "Tier 1 / Tier 2A / Tier 2B" to match what actually runs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
setup-troubleshooting moved from skills/user/ to skills/_internal/;
update the two seealso links that still referenced the old location.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The public SkillEvaluator marks Security Scan (skillspector) and Secrets
Detection (gitleaks) as incomplete when the tools are missing, which fails
the job without any actionable findings.

- Install gitleaks (public binary) so Secrets Detection actually runs
- Skip the security check (skillspector is NVIDIA-internal, unavailable
  on public runners) via --checks, leaving all other Tier 1 checks active
- Set NVIDIA_API_KEY (build.nvidia.com) from the repo's
  NVIDIA_INFERENCE_API_KEY secret so Tier 2 embedding calls have a key

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Self-hosted runners run as an unprivileged user; writing to /usr/local/bin
fails with permission denied. Install to RUNNER_TEMP/bin and add to PATH.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
skillevaluator doctor imports from the harbor module (Tier 3 extra),
which is not installed. Remove the call — it was advisory-only and
was generating a noisy traceback that offered no actionable output.

Tier 2A (context-optimization-check) and Tier 2B (similarity-check)
both require an embedding API key (NVIDIA_API_KEY / OPENAI_API_KEY).
Fork PRs cannot access parent-repo secrets, so the key is always
empty on external contributor PRs. Demote these checks to warnings
so Tier 1 failures remain the hard gate; Tier 2A/2B will become
blocking once the key is available on the runner.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
setup-troubleshooting was moved from skills/user/ to skills/_internal/
but skills/README.md still listed the old user/ path. Update to the
actual current location.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add `--external` to `validate` to pin the public-publication profile
  explicitly on every runner.
- Upgrade install extra from `[tier2,security]` to `[tier2,security,tier3]`
  so the Tier 3 CLI is available.
- Add advisory Tier 3 step: `skillevaluator tier3 evaluate --agents codex
  --env-mode docker --external`. Failures emit `::warning::` but do not
  block the job (no `--block-on-agent-eval`), matching the SkillEvaluator
  recommended CI pattern for initial adoption.
- Driver: single `NVIDIA_API_KEY` with `SKILL_EVAL_LLM_PROVIDER=nv_build`
  routes the evaluator LLM and the codex agent through SkillEvaluator's
  NVIDIA Build compatibility bridge — no internal Harbor managed service
  required. Uses the repo's existing `NVIDIA_INFERENCE_API_KEY` secret.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@matthewtrepte
matthewtrepte force-pushed the mtrepte/nvcarps-skill-onboarding branch from 5fa7a05 to 39cd26d Compare September 18, 2026 19:39
@matthewtrepte
matthewtrepte deployed to skillevaluator-review September 18, 2026 19:40 — with GitHub Actions Active
skillevaluator tier3 evaluate does not accept --external (only the
validate subcommand does). All 14 skills were silently skipped with
a warning on the previous run. Remove the flag so Tier 3 actually
executes the agent evaluation.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@matthewtrepte
matthewtrepte deployed to skillevaluator-review September 18, 2026 21:18 — with GitHub Actions Active

This branch was successfully deployed

1 active deployment
skillevaluator-review 8a3b24e2 Deployed Sep 18, 2026 by matthewtrepte via Validate skills (SkillEvaluator) #493
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Improvements or additions to documentation infrastructure

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant