feat: Add byo-rossoctl-cortex skill

[aslom]

Add the byo-rossoctl-cortex skill: build a local rossoctl cortex — an AuthBridge plugin pipeline that hosts a command (e.g. Claude Code) via rossoctl authbridge exec — choosing plugins, generating the config, and running the agent behind it. Specializes in per-agent LiteLLM usage/budget tracking where each agent's spend is isolated by an environment variable (spend_file: ${CORTEX_SPEND_FILE}).

Includes a plugin catalog reference, a forward-proxy + TLS-bridge config template, and a minimal test agent script. Registers the skill in the plugin marketplace and README.

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

Summary

Related issue(s)

(Optional) Testing Instructions

Fixes #

[clawgenti]

Adds the byo-rossoctl-cortex skill with clear step-by-step instructions, a useful plugin catalog reference, and working template assets. CI passes. A couple of minor issues worth addressing before merge.

---

Reviewed by clawgenti using the github-pr-review skill

[clawgenti]

This ca_dir value is a literal placeholder (/ABSOLUTE/PATH/TO/…) rather than an ${ENV_VAR} — if copied and used verbatim it will try to create that exact path and silently produce a non-persistent CA. Consider substituting a real ${CORTEX_CA_DIR} env-var expansion (consistent with the other ${…} fields in this file) so the template can be used directly without manual editing, or add a prominent # EDIT THIS comment to make the requirement impossible to miss.

[clawgenti]

license: Complete terms in LICENSE — no LICENSE file is included in this skill directory. Other skills reference a root-level LICENSE (which covers the repo), but the frontmatter wording implies a per-skill file. Either drop this field, point it to the repo root (../../LICENSE), or add the file.

[clawgenti]

Adds the byo-rossoctl-cortex skill — a well-documented, self-contained guide for running a local rossoctl AuthBridge plugin pipeline with per-agent LiteLLM budget tracking. CI passes, DCO sign-off is present. Two minor findings below.

• nit — templates/agent.sh: uses set -e but not set -u; unset env vars (ANTHROPIC_AUTH_TOKEN, ANTHROPIC_BASE_URL) will silently expand to empty strings and cause curl to fail with a confusing 401/URL error rather than a clear "variable not set" message.
• suggestion — templates/litellm-budget-track.yaml: ca_dir uses a literal placeholder path (/ABSOLUTE/PATH/TO/…) while the rest of the template uses ${ENV_VAR} expansion; consider ca_dir: "${CORTEX_CA_DIR}" for consistency and to make it machine-fillable, or add a prominent # TODO: replace this path comment.

---

Reviewed by clawgenti using the github-pr-review skill

[clawgenti]

nit: set -e prevents ignoring exit codes, but set -u (treat unset variables as errors) is not set. ANTHROPIC_AUTH_TOKEN and ANTHROPIC_BASE_URL are required for the script to work; without set -u, omitting either causes curl to fail with a confusing empty-URL or 401 error rather than an explicit "variable not set" message. Consider adding set -eu (POSIX-safe, no pipefail needed for sh).

[clawgenti]

suggestion: ca_dir is the only config value using a literal placeholder path (/ABSOLUTE/PATH/TO/…) rather than an env-var expansion. The rest of the template uses ${CORTEX_SPEND_FILE} and ${CORTEX_MAX_BUDGET}. Consider ca_dir: "${CORTEX_CA_DIR}" for consistency, or at minimum add a # TODO: replace with your actual path comment so users don't accidentally run the config with the placeholder value.

[aslom]

Thanks @clawgenti — pushed a fix addressing all three findings.

• ca_dir literal placeholder → env var. templates/litellm-budget-track.yaml now
  uses ca_dir: "${CORTEX_CA_DIR}", consistent with the other ${…} fields, so the
  template is machine-fillable and can't be run with a bogus placeholder path. Added a
  comment (export to an absolute, persistent, writable dir), and the header run example
  plus SKILL.md Step 3/4 now export CORTEX_CA_DIR.
• license frontmatter → repo root. Changed to
  Complete terms in the repository-root LICENSE (../../LICENSE) so it no longer implies
  a per-skill file; it points at the actual root LICENSE.
• agent.sh set -e → set -eu. A missing ANTHROPIC_AUTH_TOKEN /
  ANTHROPIC_BASE_URL now fails with a clear "unbound variable" instead of a confusing
  401 / empty-URL from curl. The optional vars use ${VAR:-default} / ${VAR:+word},
  which are set -u-safe; sh -n passes.

No functional change to the skill's behavior. DCO signed-off.

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

[clawgenti]

Adds the byo-rossoctl-cortex skill with a well-structured step-by-step guide, thorough caveats, and working template assets. CI passes, DCO sign-off present, previous review findings addressed in this commit. One substantive inconsistency between the Step 3 config snippet and the full template, plus a minor shell comment formatting nit.

• suggestion — SKILL.md Step 3 inline YAML snippet (lines ~151-162) omits cache_write_cost_per_token / cache_read_cost_per_token, but caveat 6 warns explicitly that omitting these can overstate costs ~10× for Claude Code users and trip the 429 far too early. A user following Step 3 verbatim would copy a snippet without those fields — consider adding them (or at minimum a # see caveat 6 comment) so the two places agree.
• nit — templates/agent.sh: missing blank line between the env var listing comment block and the set -u rationale comment (lines 16-17); minor readability issue.

---

Reviewed by clawgenti using the github-pr-review skill

[clawgenti]

suggestion: The Step 3 inline YAML snippet ends here without cache_write_cost_per_token / cache_read_cost_per_token, but caveat 6 (line ~240) warns that omitting these overstates cache-heavy traffic (Claude Code) by up to ~10× and trips the 429 too early. The full template (litellm-budget-track.yaml) correctly includes both fields. Consider adding them here too, or at minimum a # see caveat 6 below comment, so a user copying this snippet doesn't silently misconfigure budget tracking.

[aslom]

Thanks @clawgenti — both addressed in 89ac0c6.

• Step 3 snippet now matches the template / caveat 6. Added
  cache_write_cost_per_token / cache_read_cost_per_token to the Step 3 inline YAML
  (with a # see caveat 6 note), so a user copying it doesn't silently misconfigure
  budget tracking. Also relabeled input_cost_per_token there as the uncached rate
  for consistency with the template and reference.
• agent.sh readability nit. Inserted a blank # line between the env-var listing
  block and the set -u rationale comment. sh -n still passes.

Docs-only; no change to skill behavior. DCO signed-off.

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

[clawgenti]

Adds the byo-rossoctl-cortex skill — a well-documented guide for standing up a local AuthBridge plugin pipeline with per-agent LiteLLM budget tracking. The content is thorough and the caveats section is genuinely useful.

One suggestion on the install path; overall the skill is in good shape.

---

Reviewed by clawgenti using the github-pr-review skill

[clawgenti]

suggestion: curl -fsSL ... | sh pipes an installer script directly to the shell without verification — this is the canonical "curl-pipe-sh" pattern that can silently execute malicious content if the download URL is compromised or intercepted. Consider documenting the checksum/signature verification step (e.g. curl ... | sha256sum -c) or pointing users to a signed release artifact. For a skill that teaches security-conscious proxy configuration, this is worth calling out explicitly.

[aslom]

This is form official rossctl CLI instructions:
https://github.com/rossoctl/rossoctl-cli#install
FYI @esnible

[rubambiza]

Approving since most AI review comments have been addressed and to enable more team members to kick the tires. Any issues encountered can be filed separately.