overthinkos/cue
tools/skills/cue/SKILL.md
The CUE data-validation / configuration CLI (cue), pinned to v0.16.1. Use when working with the cue candy, installing the cue binary into a box or onto a target:local dev host, or running the offline schema-vendoring pipeline that feeds charly's egress validation.
tools
Updated Jul 1, 2026
$ install --global
skillsauthnpx skillsauth add overthinkos/overthink-plugins cueInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 1, 2026, 8:48 AM130.6s1 file scanned
SKILL.md
- name:
- cue
- description:
- |
- onto a target:
- local dev host, or running the offline schema-vendoring pipeline
cue — CUE CLI (data validation + schema vendoring)
Candy Properties
| Property | Value |
|----------|-------|
| Candy | candy/cue |
| Binary | /usr/local/bin/cue |
| Version | pinned v0.16.1 (matches charly's embedded cuelang.org/go library) |
| Install | download: the cue-lang GitHub release tarball, extract cue (cross-distro, no package:) |
| Status | testing |
What it installs
A single static Go binary, cue, from the pinned cue-lang GitHub release
(cue_v0.16.1_linux_${ARCH}.tar.gz). No distro packages — the download: verb
fetches and extracts the one binary, so the candy is distro-agnostic.
Why it exists — a DEV-TIME tool, not a runtime dependency
charly's runtime never shells out to cue — every build/deploy/check path
validates through the embedded cuelang.org/go library (the cueSchemaCtx
in charly/cue_schema.go, and the egress validator in the compiled-in
candy/plugin-egress — M16 — fronted by the charly/egress.go shim). The cue
CLI is here for the developer/agent workflow:
- running the offline schema-vendoring pipeline (
cue import jsonschema:,cue mod get) that produces the.cuefiles charly embeds — see/charly-internals:egress; - authoring + spot-checking schemas (
cue vet,cue export) in a charly dev/coder box.
Pin v0.16.1 so the CLI that vendors a schema is the SAME CUE version the embedded library compiles it with — a newer CLI could emit constructs the pinned library rejects.
Verification (ADE)
The candy's plan: ships deterministic check: steps: the binary lands at
/usr/local/bin/cue, cue version reports the pinned v0.16.1, and a real
cue export of a computed field (y: x*2 → 42) proves the binary actually
evaluates CUE — a non-functional binary fails the check.
Install on a dev host
charly bundle add cue cue --target local # installs /usr/local/bin/cue on this host
…then the task cue:vendor pipeline (see /charly-internals:egress) can run.
Cross-References
/charly-internals:egress— the egress-validation subsystem the cue CLI feeds (the vendoring pipeline,candy/plugin-egress/egress-schemas/vendor/)./charly-build:validate—charly box validate(the ingress side; uses the embedded library, not this CLI)./charly-image:layer— thedownload:verb the candy uses.
When to Use This Skill
Invoke when working with the cue candy, installing the cue CLI into a box or
onto a target:local host, or before running the schema-vendoring pipeline.
Related Skills
overthinkos/plugin
tools
VerifiedTrustedCommunity
Use when authoring or modifying a charly PLUGIN — a candy with a `plugin:` block that contributes Providers (verbs/kinds/deploy-targets/steps/builders/commands), its own CUE schema, builtin (compiled-in) or external (out-of-tree git repo). Covers the unified Provider model, the per-plugin CUE-schema contract (single source → Go params for dev + schema-over-Describe RPC for runtime), the SDK, and the loader.
SKILL.mdUpdated Jun 22, 2026
overthinkos/egress
tools
VerifiedTrustedCommunity
CUE EGRESS validation — validating (and, where it adds value, generating) the config files charly WRITES to a system BEFORE the bytes hit disk. MUST be invoked before working on charly/egress.go, the vendored schemas under candy/plugin-egress/egress-schemas/vendor/, the ValidateEgress / registerVendoredEgressKind path, the offline `task cue:vendor` pipeline, or adding an egress schema for any written artifact (cloud-init, k8s manifests, traefik routes, runtime config, install ledger, systemd/quadlet units, ssh_config, libvirt XML).
SKILL.mdUpdated Jun 16, 2026
overthinkos/check-k8s
tools
VerifiedTrustedCommunity
Kubernetes cluster-probe declarative check verb — the `kube:` check verb (nodes, pods, ingress, storage class, addon health, apply/delete, and arbitrary resource GETs) served out-of-process by the candy/plugin-kube plugin (vendored client-go; no external kubectl required).
SKILL.mdUpdated Jun 14, 2026
overthinkos/go-quality
development
VerifiedTrustedCommunity
How to check charly's Go source for CLAUDE.md compliance + code quality and fix what's found. Covers golangci-lint v2 (the deterministic backbone) + the charly/.golangci.yml linter set, gopls, go vet, gofmt; the .go compliance checklist (R3 duplication, R4 ad-hoc workarounds, R5 dead/stale paths, repo invariants); the legitimate-pattern allowlist that kills false positives; triage + adversarial verification; and how to fix findings as a handful of large thematic R10-gated cutovers. MUST be invoked before any Go code-quality audit, golangci-lint run, dupl/duplication check, or CLAUDE.md-compliance sweep of charly/.
SKILL.mdUpdated Jun 14, 2026