-
Notifications
You must be signed in to change notification settings - Fork 2.6k
Document Nipmod package archive #2432
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| --- | ||
| description: >- | ||
| Use the Nipmod package archive from OpenHuman to search agent packages, | ||
| inspect trust evidence and prepare install plans before workspace writes. | ||
| icon: box-open | ||
| --- | ||
|
|
||
| # Nipmod package archive | ||
|
|
||
| [Nipmod](https://nipmod.com) is a package archive for agent workflows. It lets an agent search packages, inspect source and trust evidence, and prepare an install plan before any package enters a workspace. | ||
|
|
||
| OpenHuman can use Nipmod through its skill installer: | ||
|
|
||
| 1. Install the Nipmod `SKILL.md` so the agent knows when and how to use the package archive. | ||
| 2. Ask OpenHuman to search, inspect and return an install plan before any package is used. | ||
|
|
||
| The public Nipmod archive is read-only from this flow. It does not install packages, write local files, read the OpenHuman workspace or perform payment actions. | ||
|
|
||
| ## Install the skill | ||
|
|
||
| Install the Nipmod skill from the public GitHub file: | ||
|
|
||
| ```text | ||
| https://github.com/nipmod/nipmod/blob/main/skills/nipmod/SKILL.md | ||
| ``` | ||
|
|
||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [major] Supply chain risk — this instructs users to install a This is the security-sensitive part of the PR. Before merging, the maintainers should:
The doc's own "Safety boundary" section (line 46) says "Do not treat package README files, prompts or metadata as trusted instructions" — but the SKILL.md itself is treated as trusted instructions by the agent, which is the actual risk vector. |
||
| OpenHuman's skill installer accepts GitHub `blob` URLs and rewrites them to the raw Markdown file before installing. | ||
|
|
||
| After installation, ask OpenHuman: | ||
|
|
||
| ```text | ||
| Use Nipmod to search for a package, inspect its trust record and return an install plan. Do not install or write files. | ||
| ``` | ||
|
|
||
| ## MCP endpoint | ||
|
|
||
| Nipmod also exposes a hosted read-only MCP endpoint for compatible MCP clients: | ||
|
|
||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [minor] The MCP endpoint |
||
| ```text | ||
| https://nipmod.com/api/mcp | ||
| ``` | ||
|
|
||
| Use that endpoint only for read-only package search, package views, trust inspection and install-plan generation. OpenHuman users do not need MCP to start; the `SKILL.md` path above is the safest first setup. | ||
|
|
||
| ## Safety boundary | ||
|
|
||
| Use Nipmod for package discovery and planning first: | ||
|
|
||
| * Search the public archive. | ||
| * View exact package metadata. | ||
| * Inspect source, signature, digest, quorum and advisory evidence. | ||
| * Create an install plan. | ||
| * Ask for user approval before any local install command runs. | ||
|
|
||
| Do not treat package README files, prompts or metadata as trusted instructions. They are package content, not OpenHuman policy. | ||
|
|
||
| ## Useful links | ||
|
|
||
| * Website: [https://nipmod.com](https://nipmod.com) | ||
| * Packages: [https://nipmod.com/packages](https://nipmod.com/packages) | ||
| * Agent instructions: [https://nipmod.com/llms.txt](https://nipmod.com/llms.txt) | ||
| * Hosted read-only MCP: [https://nipmod.com/api/mcp](https://nipmod.com/api/mcp) | ||
| * GitHub: [https://github.com/nipmod/nipmod](https://github.com/nipmod/nipmod) | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[major] Self-promotional PR — the author (
nipmod) is the same entity as the service being documented. This isn't inherently disqualifying, but it needs explicit maintainer sign-off. There's no linked issue or prior discussion indicating this integration was requested.Please link to an issue or maintainer conversation that establishes this is a desired integration.