RHEcosystemAppEng · dmartinol · Jul 9, 2026 · Jul 8, 2026 · Jul 9, 2026
@@ -42,7 +42,7 @@ metadata:
 
 ## Prerequisites
 
-**Required MCP Servers**: `openshift-self-managed` ([setup guide](../README.md#environment-setup))
+**Required MCP Servers**: `openshift-self-managed`
 
 **MCP Server Architecture**:
 This skill uses `openshift-self-managed` MCP server exclusively. This server connects to Red Hat Assisted Installer API to create self-managed OpenShift clusters.
@@ -440,7 +440,7 @@ Congratulations!
 ## Dependencies
 
 ### Required MCP Servers
-- `openshift-self-managed` - Red Hat Assisted Installer service for self-managed clusters ([setup](../README.md#environment-setup))
+- `openshift-self-managed` - Red Hat Assisted Installer service for self-managed clusters
 
 **Important**: This skill uses ONLY `openshift-self-managed` MCP server. Do NOT use `openshift-ocm-managed` (that server is for ROSA/ARO/OSD managed service clusters, not for OCP/SNO self-managed clusters).
 

@@ -47,7 +47,7 @@ List and inspect OpenShift clusters across all types (OCP, SNO, ROSA, ARO, OSD).
 
 ## Prerequisites
 
-**Required MCP Servers**: `openshift-self-managed`, `openshift-ocm-managed` ([setup guide](../../README.md))
+**Required MCP Servers**: `openshift-self-managed`, `openshift-ocm-managed`
 
 **Required MCP Tools**:
 - `list_clusters` (from both servers) - Lists clusters (auto-routes to correct API)
@@ -224,8 +224,8 @@ Execute when user requests events, troubleshoots errors, or needs installation l
 ## Dependencies
 
 ### Required MCP Servers
-- `openshift-self-managed` - Assisted Installer service for OCP/SNO ([setup](../../README.md))
-- `openshift-ocm-managed` - OCM service for ROSA/ARO/OSD ([setup](../../README.md))
+- `openshift-self-managed` - Assisted Installer service for OCP/SNO
+- `openshift-ocm-managed` - OCM service for ROSA/ARO/OSD
 
 ### Required MCP Tools
 - `list_clusters` (from both servers) - Lists clusters (auto-routes to correct API)

@@ -38,7 +38,7 @@ Generate a unified health and resource report across multiple OpenShift/Kubernet
 
 ## Prerequisites
 
-**Required MCP Servers**: `openshift-administration` ([setup guide](../../README.md#environment-setup))
+**Required MCP Servers**: `openshift-administration`
 
 **MCP Server Architecture**:
 This skill uses `openshift-administration` MCP server exclusively. This server provides multi-cluster administration and reporting capabilities for both OpenShift and Kubernetes clusters.
@@ -60,11 +60,11 @@ This skill uses `openshift-administration` MCP server exclusively. This server p
 
 **Required Environment Variables**: `KUBECONFIG` — must contain at least one cluster context. Two or more recommended for comparison.
 
-**Multi-Cluster Setup**: For large-scale deployments using service account tokens instead of interactive `oc login`, see [multi-cluster-auth.md](docs/multi-cluster-auth.md) and the [build-kubeconfig.py](../../scripts/cluster-report/build-kubeconfig.py) helper script.
+**Multi-Cluster Setup**: For large-scale deployments using service account tokens instead of interactive `oc login`, see [multi-cluster-auth.md](docs/multi-cluster-auth.md) and the [build-kubeconfig.py](scripts/build-kubeconfig.py) helper script.
 
 **Helper Scripts** (Python 3, stdlib only — auditable, do not reimplement):
-- [`assemble.py`](../../scripts/cluster-report/assemble.py) — resolves `$file` references into complete raw data JSON
-- [`aggregate.py`](../../scripts/cluster-report/aggregate.py) — aggregates raw data into structured report JSON
+- [`assemble.py`](scripts/assemble.py) — resolves `$file` references into complete raw data JSON
+- [`aggregate.py`](scripts/aggregate.py) — aggregates raw data into structured report JSON
 
 **Script Usage Rules**:
 - Invoke scripts via the documented pipeline (Step 3) — do NOT reimplement their logic inline
@@ -265,7 +265,7 @@ Fields may also be inlined as raw text strings or set to `null` for failed/unava
 Run the assembly and aggregation pipeline:
 
 ```bash
-python3 ocp-admin/scripts/cluster-report/assemble.py --aggregate < /tmp/cluster-report-manifest.json
+python3 scripts/assemble.py --aggregate < /tmp/cluster-report-manifest.json
 ```
 
 If the pipeline exits with code 1, display the error JSON to the user and stop.
@@ -357,7 +357,7 @@ Would you like to:
 ## Dependencies
 
 ### Required MCP Servers
-- `openshift-administration` - Multi-cluster administration and reporting ([setup](../../README.md#environment-setup))
+- `openshift-administration` - Multi-cluster administration and reporting
 
 **Important**: This skill uses ONLY `openshift-administration` MCP server for querying existing cluster resources via KUBECONFIG. The cluster creation/inventory servers (`openshift-self-managed`, `openshift-ocm-managed`) are not needed for this skill as it operates on already-configured clusters.
 
@@ -377,8 +377,8 @@ Would you like to:
   - Parameters: `context`
 
 ### Helper Scripts
-- [`ocp-admin/scripts/cluster-report/assemble.py`](../../scripts/cluster-report/assemble.py)
-- [`ocp-admin/scripts/cluster-report/aggregate.py`](../../scripts/cluster-report/aggregate.py)
+- [`assemble.py`](scripts/assemble.py)
+- [`aggregate.py`](scripts/aggregate.py)
 
 ### Related Skills
 - `/cluster-inventory` - List and inspect individual clusters

@@ -0,0 +1 @@
+../../../scripts/cluster-report/aggregate.py
@@ -0,0 +1 @@
+../../../scripts/cluster-report/assemble.py
@@ -0,0 +1 @@
+../../../scripts/cluster-report/build-kubeconfig.py
@@ -88,9 +88,9 @@ Do NOT use `version` or `release` labels to reconstruct the image tag.
 
 ## Prerequisites
 
-**Step 0 — Resolve scripts directory.** Before anything else, locate the helper scripts. They are at `../scripts/` relative to this project's root directory. Run:
+**Step 0 — Resolve scripts directory.** Before anything else, locate the helper scripts. They are inside the skill's `scripts/` subfolder. Run:
 ```bash
-SCRIPTS_DIR="$(git rev-parse --show-toplevel)/ocp-admin/scripts/security-validation"
+SCRIPTS_DIR="scripts"
 test -f "$SCRIPTS_DIR/validate_input.py" || { echo "Error: Scripts directory not found at $SCRIPTS_DIR"; exit 1; }
 ```
 Use `$SCRIPTS_DIR` in all subsequent script calls. The scripts handle tool checks internally (regctl, cosign, syft) and return clear errors if tools are missing.

@@ -0,0 +1 @@
+../../../scripts/security-validation/download_sbom.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/fetch_coreos_metadata.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/fetch_cve_metadata.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/fetch_redhat_vex.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/fetch_rhsa_advisory.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/generate_sbom_syft.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/inspect_image.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/scan_newer_images.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/validate_input.py
@@ -20,9 +20,9 @@ Two required inputs:
 
 ## Prerequisites
 
-**Resolve scripts directory** — the helper scripts are at `../scripts/` relative to this project's root:
+**Resolve scripts directory** — the helper scripts are inside the skill's `scripts/` subfolder:
 ```bash
-SCRIPTS_DIR="$(git rev-parse --show-toplevel)/ocp-admin/scripts/security-validation"
+SCRIPTS_DIR="scripts"
 test -f "$SCRIPTS_DIR/validate_input.py" || { echo "Error: Scripts directory not found at $SCRIPTS_DIR"; exit 1; }
 ```
 The scripts check internally for `oc` and `podman`.

@@ -0,0 +1 @@
+../../../scripts/security-validation/download_sbom.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/fetch_coreos_metadata.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/fetch_cve_metadata.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/fetch_redhat_vex.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/fetch_rhsa_advisory.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/generate_sbom_syft.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/inspect_image.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/scan_newer_images.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/validate_input.py
@@ -31,9 +31,9 @@ If the CVE ID is missing or does not match the format, ask the user to provide i
 
 ## Prerequisites
 
-**Resolve scripts directory** — the helper scripts are at `../scripts/` relative to this project's root:
+**Resolve scripts directory** — the helper scripts are inside the skill's `scripts/` subfolder:
 ```bash
-SCRIPTS_DIR="$(git rev-parse --show-toplevel)/ocp-admin/scripts/security-validation"
+SCRIPTS_DIR="scripts"
 test -f "$SCRIPTS_DIR/fetch_cve_metadata.py" || { echo "Error: Scripts directory not found at $SCRIPTS_DIR"; exit 1; }
 ```
 

@@ -0,0 +1 @@
+../../../scripts/security-validation/download_sbom.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/fetch_coreos_metadata.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/fetch_cve_metadata.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/fetch_redhat_vex.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/fetch_rhsa_advisory.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/generate_sbom_syft.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/inspect_image.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/scan_newer_images.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/validate_input.py
@@ -35,7 +35,7 @@ If the image reference is missing or invalid, ask the user to provide it. Do not
 
 **Resolve scripts directory:**
 ```bash
-SCRIPTS_DIR="$(git rev-parse --show-toplevel)/ocp-admin/scripts/security-validation"
+SCRIPTS_DIR="scripts"
 test -f "$SCRIPTS_DIR/inspect_image.py" || { echo "Error: Scripts directory not found at $SCRIPTS_DIR"; exit 1; }
 ```
 The scripts handle tool checks internally (regctl, cosign) and return clear errors if tools are missing.

@@ -0,0 +1 @@
+../../../scripts/security-validation/download_sbom.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/fetch_coreos_metadata.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/fetch_cve_metadata.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/fetch_redhat_vex.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/fetch_rhsa_advisory.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/generate_sbom_syft.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/inspect_image.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/scan_newer_images.py
@@ -0,0 +1 @@
+../../../scripts/security-validation/validate_input.py
@@ -61,7 +61,7 @@ Analyze AI model inference performance, GPU utilization, OpenShift cluster healt
 - `resources_list` (from openshift) - List InferenceServices, Namespaces (fallback for rhoai tools)
 - `pods_list` (from openshift) - List predictor pods for correlation context
 
-**Common prerequisites** (KUBECONFIG, OpenShift+RHOAI cluster, verification protocol): See [skill-conventions.md](../references/skill-conventions.md).
+**Common prerequisites** (KUBECONFIG, OpenShift+RHOAI cluster, verification protocol): See [skill-conventions.md](references/skill-conventions.md).
 
 **Additional environment variables**:
 - `AI_OBSERVABILITY_MCP_URL` - URL for the AI Observability MCP server (e.g., `http://aiobs-mcp.apps.cluster.example.com`)
@@ -416,7 +416,7 @@ See [Prerequisites](#prerequisites) for the complete list of required and option
 
 ## Critical: Human-in-the-Loop Requirements
 
-See [skill-conventions.md](../references/skill-conventions.md) for general HITL and security conventions.
+See [skill-conventions.md](references/skill-conventions.md) for general HITL and security conventions.
 
 **Skill-specific checkpoints:**
 - After triage (Step 1): confirm analysis scope (model, namespace, time range) before running queries

@@ -0,0 +1 @@
+../../references/common-issues.md
@@ -0,0 +1 @@
+../../references/live-doc-lookup.md
@@ -0,0 +1 @@
+../../references/openshift-fallback-templates.md
@@ -0,0 +1 @@
+../../references/skill-conventions.md
@@ -55,9 +55,9 @@ Troubleshoot failed, stuck, or slow InferenceService deployments on Red Hat Open
 - `execute_promql` - Run custom PromQL queries for metrics not covered by standard analysis
 - `korrel8r_get_correlated` - Correlate signals (logs, traces, metrics, alerts) across a pod/namespace for root cause analysis
 
-**Common prerequisites** (KUBECONFIG, OpenShift+RHOAI cluster, KServe, verification protocol): See [skill-conventions.md](../references/skill-conventions.md).
+**Common prerequisites** (KUBECONFIG, OpenShift+RHOAI cluster, KServe, verification protocol): See [skill-conventions.md](references/skill-conventions.md).
 
-**Fallback templates**: See [openshift-fallback-templates.md](../references/openshift-fallback-templates.md) for OpenShift YAML templates used when RHOAI tools are unavailable.
+**Fallback templates**: See [openshift-fallback-templates.md](references/openshift-fallback-templates.md) for OpenShift YAML templates used when RHOAI tools are unavailable.
 
 **Additional cluster requirements**:
 - An existing InferenceService deployment to debug
@@ -196,7 +196,7 @@ Present log analysis:
 - GPU compatibility messages
 
 **If the error is unrecognized -> Trigger live doc lookup:**
-1. **Action**: Read [live-doc-lookup.md](../references/live-doc-lookup.md) using the Read tool
+1. **Action**: Read [live-doc-lookup.md](references/live-doc-lookup.md) using the Read tool
 2. Use **WebFetch** to look up the error message in RHOAI documentation
 3. **Output to user**: "I looked up this error on [source]: [explanation and fix]"
 
@@ -304,7 +304,7 @@ Would you like me to:
 
 ## Common Issues
 
-For common issues (GPU scheduling, OOMKilled, image pull errors, RBAC), see [common-issues.md](../references/common-issues.md).
+For common issues (GPU scheduling, OOMKilled, image pull errors, RBAC), see [common-issues.md](references/common-issues.md).
 
 ### Issue 1: S3 Storage Access Denied
 
@@ -344,11 +344,11 @@ See [Prerequisites](#prerequisites) for the complete list of required and option
 ### Reference Documentation
 - [known-model-profiles.md](docs/references/known-model-profiles.md) - Correct resource sizing for common models
 - [supported-runtimes.md](docs/references/supported-runtimes.md) - Runtime capabilities and known limitations
-- [live-doc-lookup.md](../references/live-doc-lookup.md) - Protocol for looking up unrecognized errors
+- [live-doc-lookup.md](references/live-doc-lookup.md) - Protocol for looking up unrecognized errors
 
 ## Critical: Human-in-the-Loop Requirements
 
-See [skill-conventions.md](../references/skill-conventions.md) for general HITL and security conventions.
+See [skill-conventions.md](references/skill-conventions.md) for general HITL and security conventions.
 
 **Skill-specific checkpoints:**
 - After identifying target (Step 1): confirm which InferenceService to debug

@@ -0,0 +1 @@
+../../references/common-issues.md
@@ -0,0 +1 @@
+../../references/live-doc-lookup.md
@@ -0,0 +1 @@
+../../references/openshift-fallback-templates.md
@@ -0,0 +1 @@
+../../references/skill-conventions.md
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		../../../scripts/cluster-report/build-kubeconfig.py
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		../../../scripts/security-validation/download_sbom.py
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		../../../scripts/security-validation/fetch_coreos_metadata.py
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		../../../scripts/security-validation/generate_sbom_syft.py
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		../../../scripts/security-validation/inspect_image.py
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		../../../scripts/security-validation/scan_newer_images.py
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		../../../scripts/security-validation/validate_input.py
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		../../references/openshift-fallback-templates.md