Document Nipmod package archive#2432
Conversation
📝 WalkthroughWalkthroughThis PR introduces documentation for the Nipmod package archive integration to OpenHuman. A new documentation page describes Nipmod's purpose, setup, MCP endpoint configuration, and safety boundaries, while the table of contents and integrations overview are updated to reference this new capability. ChangesNipmod Integration Documentation
🎯 1 (Trivial) | ⏱️ ~3 minutes
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
gitbooks/features/integrations/nipmod.md (1)
64-64: ⚡ Quick winAdd trailing newline at end of file.
Text files should end with a newline character for POSIX compliance and better git diff behavior.
📝 Proposed fix
* GitHub: [https://github.com/nipmod/nipmod](https://github.com/nipmod/nipmod) +🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@gitbooks/features/integrations/nipmod.md` at line 64, Add a single trailing newline character to the end of the markdown file nipmod.md so the file ends with a POSIX-style newline (LF) to satisfy POSIX compliance and avoid noisy git diffs; open the file, move the cursor to the end, insert one newline, save, and verify the file now ends with a newline character.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@gitbooks/features/integrations/nipmod.md`:
- Line 64: Add a single trailing newline character to the end of the markdown
file nipmod.md so the file ends with a POSIX-style newline (LF) to satisfy POSIX
compliance and avoid noisy git diffs; open the file, move the cursor to the end,
insert one newline, save, and verify the file now ends with a newline character.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 956c5636-d939-46d3-9929-7196bf189c6f
📒 Files selected for processing (3)
gitbooks/SUMMARY.mdgitbooks/features/integrations/README.mdgitbooks/features/integrations/nipmod.md
graycyrus
left a comment
graycyrus
left a comment
There was a problem hiding this comment.
Review — Nipmod package archive docs
Docs-only PR adding a new integration page for Nipmod. The writing is clear and the page structure matches existing integration docs. However, there are trust and supply-chain concerns that need maintainer attention before this ships.
| File | Change |
|---|---|
gitbooks/SUMMARY.md |
New ToC entry for Nipmod |
gitbooks/features/integrations/README.md |
Cross-link to nipmod.md |
gitbooks/features/integrations/nipmod.md |
New 63-line integration doc |
|
|
||
| # Nipmod package archive | ||
|
|
||
| [Nipmod](https://nipmod.com) is a package archive for agent workflows. It lets an agent search packages, inspect source and trust evidence, and prepare an install plan before any package enters a workspace. |
There was a problem hiding this comment.
[major] Self-promotional PR — the author (nipmod) is the same entity as the service being documented. This isn't inherently disqualifying, but it needs explicit maintainer sign-off. There's no linked issue or prior discussion indicating this integration was requested.
Please link to an issue or maintainer conversation that establishes this is a desired integration.
| ```text | ||
| https://github.com/nipmod/nipmod/blob/main/skills/nipmod/SKILL.md | ||
| ``` | ||
|
|
There was a problem hiding this comment.
[major] Supply chain risk — this instructs users to install a SKILL.md from an external GitHub repo (nipmod/nipmod). A SKILL.md controls agent behavior inside OpenHuman. The content of that file isn't audited here and can change at any time after this doc merges.
This is the security-sensitive part of the PR. Before merging, the maintainers should:
- Review the current content of
nipmod/nipmod/skills/nipmod/SKILL.md - Decide whether to vendor/pin a specific commit rather than pointing at
main - Confirm OpenHuman's skill installer sandboxes external skills sufficiently
The doc's own "Safety boundary" section (line 46) says "Do not treat package README files, prompts or metadata as trusted instructions" — but the SKILL.md itself is treated as trusted instructions by the agent, which is the actual risk vector.
| ## MCP endpoint | ||
|
|
||
| Nipmod also exposes a hosted read-only MCP endpoint for compatible MCP clients: | ||
|
|
There was a problem hiding this comment.
[minor] The MCP endpoint https://nipmod.com/api/mcp is an external service dependency. Consider noting version/stability guarantees (is this a stable API? does it follow semver?) so users know what to expect.
2 participants
Summary
Problem
OpenHuman has a skill installer and agent-facing workflows, but there is no documented path for using an agent package archive before package reuse or install planning.
Solution
Document a conservative first integration path:
Submission Checklist
Impact
Docs only. No runtime behavior change.
Related
AI Authored PR Metadata
Linear Issue
Commit & Branch
Validation Run
pnpm --filter openhuman-app format:checkpnpm typecheckgit diff --check; manual docs diff inspectionValidation Blocked
command: pnpm format:checkerror: prettier: command not found; local package dependencies are not installed in this fresh checkoutimpact: dependency install is not present locally; change is docs-only andgit diff --checkpassesBehavior Changes
Parity Contract
Duplicate / Superseded PR Handling
Summary by CodeRabbit