rzyfront/vendix-ai-agent-tools
skills/vendix-ai-agent-tools/SKILL.md
AI Agent system: AIAgentService ReAct loop, AIToolRegistry, domain tools, permission checks, and provider tool-use integration. Trigger: When creating AI tools, modifying the Tool Registry, working with the ReAct loop, or adding tool-use capabilities.
$ install --global
skillsauthnpx skillsauth add rzyfront/vendix vendix-ai-agent-toolsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 16, 2026, 5:01 AM132.9s1 file scanned
SKILL.md
- name:
- vendix-ai-agent-tools
- description:
- >
- AI Agent system:
- AIAgentService ReAct loop, AIToolRegistry, domain tools,
- permission checks, and provider tool-use integration. Trigger:
- When creating AI tools,
- license:
- Apache-2.0
- author:
- rzyfront
- version:
- 2.1
- scope:
- [root]
Source of Truth
- Agent loop:
apps/backend/src/ai-engine/ai-agent.service.ts - Registry:
apps/backend/src/ai-engine/tools/ai-tool-registry.ts - Tool interfaces:
apps/backend/src/ai-engine/tools/interfaces/tool.interface.ts - Domain tools:
apps/backend/src/ai-engine/tools/domains/ - Registration:
apps/backend/src/ai-engine/ai-engine.module.ts
Tool Contract
interface RegisteredTool {
name: string;
domain: string;
description: string;
parameters: Record<string, unknown>;
requiredPermissions?: string[];
requiresConfirmation?: boolean;
handler(args: Record<string, unknown>, context: ToolExecutionContext): Promise<string>;
}
Handlers must return strings. Use JSON.stringify() for structured data.
Registry Behavior
- Tools are stored by unique
name. - Permission filtering uses
requiredPermissions.every(...). executeTool()readsRequestContextService.getContext().- Runtime permissions come from
requestContext.permissions || context.roles || []. requiresConfirmationis metadata only; current registry does not enforce confirmation.
Existing Tools
Registered domains: sales, inventory, accounting, customers, search.
Current implementation quality:
- Inventory tools are service-backed and include stock queries plus
create_stock_adjustment. - Sales/accounting/customers tools currently return placeholder messages.
semantic_searchis placeholder and is not wired toEmbeddingService.searchByText().
Do not document placeholder tools as production-ready data tools.
Agent Loop
AIAgentService.runAgent() default guardrails:
max_iterations = 10.timeout_ms = 60000.- Emits
ai.agent.iteration,ai.agent.tool_executed,ai.agent.completed. - Tool availability for the LLM is role/permission-context dependent; execution also checks permissions.
- Tool errors are returned to the model as tool results so it can recover.
Adding A Tool
- Add a
RegisteredToolinapps/backend/src/ai-engine/tools/domains/{domain}.tools.ts. - Use snake_case unique names.
- Provide JSON Schema parameters with clear descriptions.
- Add
requiredPermissionsfor sensitive reads/writes. - Return safe, scoped data only.
- Export from tools index if needed.
- Register in
AIEngineModule.onModuleInit()spread list.
For write tools, do not rely on requiresConfirmation alone until enforcement exists.
Related Skills
vendix-ai-platform-corevendix-ai-chatvendix-ai-embeddings-ragvendix-mcp-servervendix-inventory-stock
Related Skills
rzyfront/mobile-dev
development
VerifiedTrustedCommunity
Mobile app development rules for Vendix Expo/React Native project. Trigger: When editing, creating, or modifying any file under apps/mobile, or when developing mobile-specific features.
5SKILL.mdUpdated May 29, 2026
rzyfront/vendix-subscription-gate
development
VerifiedTrustedCommunity
Feature gating by store subscription state: global store write guard, AI feature gate, Redis feature resolution, quota consumption, frontend paywall interceptor, banner, and subscription UI states. Trigger: When adding feature gates, paywalls, subscription-based access control, protecting store write operations, AI feature gates, or rollout flags.
5SKILL.mdUpdated May 16, 2026
rzyfront/vendix-saas-billing
testing
VerifiedTrustedCommunity
SaaS subscription billing for Vendix stores: plan pricing, invoices, Wompi platform payments, manual payments, partner commissions, payouts, proration, and dunning. Trigger: When creating SaaS invoices, working with partner rev-share, margin/surcharge pricing, invoice sequence allocation, partner payout batches, subscription payments, manual payments, or dunning flows.
5SKILL.mdUpdated May 16, 2026
rzyfront/vendix-redis-quota
development
VerifiedTrustedCommunity
Periodic quota counters with Redis, UTC period keys, Lua-based idempotent AI quota consumption, request-id deduplication, and post-success consumption. Trigger: When building quota counters, enforcing monthly/daily feature caps, or reusing AI quota patterns for uploads, emails, exports, or rate-limited features.
5SKILL.mdUpdated May 16, 2026