From 670cb3ef4e6e67a613a05f5fcdb426bb74e19ea8 Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Tue, 5 May 2026 18:22:13 +0200
Subject: [PATCH 01/37] fix(rh-virt): RH-VIRT-001 Fixing yaml injection in
 vm-snapshot-create

---
 rh-virt/skills/vm-snapshot-create/SKILL.md | 72 ++++++++++++++++++++--
 1 file changed, 66 insertions(+), 6 deletions(-)

diff --git a/rh-virt/skills/vm-snapshot-create/SKILL.md b/rh-virt/skills/vm-snapshot-create/SKILL.md
index 571e754f..1456b89e 100644
--- a/rh-virt/skills/vm-snapshot-create/SKILL.md
+++ b/rh-virt/skills/vm-snapshot-create/SKILL.md
@@ -69,6 +69,31 @@ Create virtual machine snapshots in OpenShift Virtualization. Snapshots capture
 
 If namespace not provided, ask for it explicitly.
 
+### Step 1b: Validate Input Names
+
+**CRITICAL: Validate ALL user-provided names before using them in any YAML or API call.**
+
+All names (VM name, namespace, snapshot name) **MUST** match the Kubernetes naming convention:
+- **Pattern**: `^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$`
+- **Max length**: 63 characters
+- **Allowed characters**: lowercase letters, digits, hyphens (`-`), dots (`.`)
+- **Must start and end** with a lowercase letter or digit
+
+**If any name fails validation**, reject the input immediately:
+
+```markdown
+❌ Invalid name: `<user-input>`
+
+Kubernetes resource names must:
+- Contain only lowercase letters, numbers, hyphens, and dots
+- Start and end with a letter or number
+- Be at most 63 characters long
+
+Please provide a valid name.
+```
+
+**STOP workflow** until the user provides a valid name. **NEVER** interpolate unvalidated input into YAML.
+
 ### Step 2: Verify VM Exists and Get Status
 
 **MCP Tool**: `resources_get` (from openshift-virtualization)
@@ -128,6 +153,24 @@ Use `vm_lifecycle` MCP tool or vm-lifecycle-manager skill to stop the VM.
 
 [Include the full confirmation template with storage backend analysis, guest agent status, volumes to snapshot, etc.]
 
+**Display the exact YAML that will be sent to the API** so the user can verify it before confirming:
+
+```markdown
+**YAML to be applied:**
+\`\`\`yaml
+apiVersion: snapshot.kubevirt.io/v1beta1
+kind: VirtualMachineSnapshot
+metadata:
+  name: <snapshot-name>
+  namespace: <namespace>
+spec:
+  source:
+    apiGroup: kubevirt.io
+    kind: VirtualMachine
+    name: <vm-name>
+\`\`\`
+```
+
 **Wait for user confirmation.**
 
 **Handle response:**
@@ -140,7 +183,11 @@ Use `vm_lifecycle` MCP tool or vm-lifecycle-manager skill to stop the VM.
 
 **MCP Tool**: `resources_create_or_update` (from openshift-virtualization)
 
-**Construct VirtualMachineSnapshot YAML:**
+**If snapshot name not provided by user**, generate one:
+- Format: `<vm-name>-snapshot-<timestamp>`
+- Example: `database-01-snapshot-20260218-143022`
+
+**Fixed YAML Template — use this EXACT structure. Do NOT add, remove, or modify any fields beyond the three placeholder values (`<snapshot-name>`, `<namespace>`, `<vm-name>`):**
 
 ```yaml
 apiVersion: snapshot.kubevirt.io/v1beta1
@@ -155,10 +202,6 @@ spec:
     name: <vm-name>
 ```
 
-**If snapshot name not provided by user**, generate one:
-- Format: `<vm-name>-snapshot-<timestamp>`
-- Example: `database-01-snapshot-20260218-143022`
-
 **Parameters**:
 ```json
 {
@@ -166,6 +209,17 @@ spec:
 }
 ```
 
+### Step 8b: Post-Construction Verification
+
+**CRITICAL: Before calling `resources_create_or_update`, verify the constructed YAML:**
+
+1. `apiVersion` is exactly `snapshot.kubevirt.io/v1beta1`
+2. `kind` is exactly `VirtualMachineSnapshot`
+3. Only these fields exist: `metadata.name`, `metadata.namespace`, `spec.source.apiGroup`, `spec.source.kind`, `spec.source.name`
+4. No additional fields, labels, annotations, or nested objects are present
+
+**If the YAML contains ANY unexpected fields or values, STOP and report a validation error. Do NOT send it to the API.**
+
 **Report progress:**
 ```markdown
 📸 Creating VM snapshot...
@@ -327,13 +381,19 @@ Check `status.phase`:
 
 ## Security Considerations
 
-- **RBAC Enforcement**: Requires permissions for VirtualMachineSnapshot resources
+- **Input Validation**: All user-provided names (VM, namespace, snapshot) are validated against Kubernetes naming rules (`^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$`, max 63 chars) before use
+- **Fixed YAML Template**: Resource YAML uses a fixed structure with only three replaceable values — no additional fields may be added
+- **Post-Construction Verification**: The constructed YAML is verified against expected structure before being sent to the API
+- **Human Review of YAML**: The exact YAML to be applied is shown to the user in the confirmation step
+- **RBAC Enforcement**: Requires permissions for VirtualMachineSnapshot resources — the ServiceAccount should be scoped to only VirtualMachineSnapshot create/get in target namespaces
 - **Storage Quotas**: Respects namespace storage quotas
 - **Hot-Plugged Volume Detection**: Prevents snapshots when hot-plugged volumes present
 - **KUBECONFIG Security**: Credentials never exposed in output
 - **Namespace Isolation**: Snapshots scoped to namespace boundaries
 - **Audit Trail**: All snapshot operations logged in Kubernetes API audit logs
 
+**Defense-in-depth note**: Input validation and YAML verification in this skill are instruction-level controls — they guide the LLM but are not hard security boundaries. The real enforcement layers are Kubernetes RBAC (restricts what resources the ServiceAccount can create) and admission webhooks (can enforce policies server-side). Ensure the KUBECONFIG ServiceAccount follows least-privilege principles.
+
 ## Example Usage
 
 ### Example 1: Create Snapshot Before Upgrade

From 9839bcb0ddb4d183cd2c62078168ce74f42af7d1 Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Wed, 6 May 2026 17:42:01 +0200
Subject: [PATCH 02/37] fix(rh-virt): RH-VIRT-005 remove CLI fallback from
 vm-inventory to prevent command injection

---
 rh-virt/skills/vm-inventory/SKILL.md | 45 ++++++++--------------------
 1 file changed, 13 insertions(+), 32 deletions(-)

diff --git a/rh-virt/skills/vm-inventory/SKILL.md b/rh-virt/skills/vm-inventory/SKILL.md
index 3b9c78f9..2655488b 100644
--- a/rh-virt/skills/vm-inventory/SKILL.md
+++ b/rh-virt/skills/vm-inventory/SKILL.md
@@ -30,10 +30,6 @@ List and inspect virtual machines in OpenShift Virtualization clusters. This ski
 - `resources_list` (from openshift-virtualization) - List Kubernetes resources including VirtualMachines
 - `resources_get` (from openshift-virtualization) - Get specific Kubernetes resource details
 
-**Fallback CLI Commands** (if MCP tools unavailable):
-- `oc get virtualmachines` / `oc get vm` - List VirtualMachines
-- `oc get vm <name> -n <namespace> -o yaml` - Get VM details
-
 **Required Environment Variables**:
 - `KUBECONFIG` - Path to Kubernetes configuration file with cluster access
 
@@ -51,12 +47,7 @@ List and inspect virtual machines in OpenShift Virtualization clusters. This ski
 
 **Human Notification Protocol:** `❌ Cannot execute vm-inventory: MCP server not available. Setup: Add to mcps.json, set KUBECONFIG, restart Claude Code. Docs: https://github.com/openshift/openshift-mcp-server`
 
-⚠️ **SECURITY**: Never display KUBECONFIG path or credential values.
-
-**Note on Fallback Behavior**:
-- If MCP server is unavailable but KUBECONFIG is set, the skill CAN proceed with CLI commands
-- Always offer the user the choice between setup (MCP) or CLI fallback
-- CLI fallback requires explicit user confirmation before executing any commands
+⚠️ **SECURITY**: Never display KUBECONFIG path or credential values. Never fall back to CLI commands (`oc`, `kubectl`) — all operations must go through MCP tools exclusively.
 
 ## When to Use This Skill
 
@@ -83,11 +74,9 @@ List and inspect virtual machines in OpenShift Virtualization clusters. This ski
 ## Workflow
 
 **CRITICAL EXECUTION PATTERN**:
-1. **ALWAYS attempt MCP server tools FIRST** - Try `resources_list` or `resources_get`
-2. **If MCP tools fail** - Propose CLI commands (`oc get vm`) with user confirmation
-3. **Never skip MCP attempt** - Always try them first
-
-**Tool Execution Priority**: MCP tools (primary) → CLI commands (fallback with confirmation)
+1. **Use MCP server tools exclusively** - `resources_list` or `resources_get`
+2. **If MCP tools fail** - Report the error and guide the user to fix MCP setup
+3. **Never use CLI commands** - No `oc` or `kubectl` execution under any circumstances
 
 ### Workflow A: List All VMs (Across All Namespaces)
 
@@ -95,7 +84,7 @@ List and inspect virtual machines in OpenShift Virtualization clusters. This ski
 
 **MCP Tool**: `resources_list` (apiVersion="kubevirt.io/v1", kind="VirtualMachine", allNamespaces=true)
 
-**Errors:** Tool not found/connection error → Report, offer CLI fallback: `oc get virtualmachines -A -o json`
+**Errors:** Tool not found/connection error → Report error, guide user to fix MCP setup
 
 **Step 2: Get Resource Details for Running VMs**
 
@@ -158,7 +147,7 @@ Ask user for namespace if not provided.
 
 **MCP Tool**: `resources_list` (apiVersion="kubevirt.io/v1", kind="VirtualMachine", namespace=`<namespace>`)
 
-**Errors:** Tool fails → Report, offer CLI fallback: `oc get virtualmachines -n <namespace> -o json`
+**Errors:** Tool fails → Report error, guide user to fix MCP setup
 
 **Step 3: Get Resource Details and Display**
 
@@ -186,7 +175,7 @@ Required: VM name, Namespace (ask if not provided)
 
 **MCP Tool**: `resources_get` (apiVersion="kubevirt.io/v1", kind="VirtualMachine", namespace=`<namespace>`, name=`<vm-name>`)
 
-**Errors:** Tool fails → Report, offer CLI fallback: `oc get vm <vm-name> -n <namespace> -o yaml`
+**Errors:** Tool fails → Report error, guide user to fix MCP setup
 
 **Step 3: Interpret Status and Conditions (Optional)**
 
@@ -253,7 +242,7 @@ Required: VM name, Namespace (ask if not provided)
 - By Status (post-processing): Filter results by `status.printableStatus` field
 - By Resource Size (post-processing): Parse instance type or VMI resource specs
 
-**Errors:** Tool fails → Report, offer CLI fallback: `oc get virtualmachines -A -l <labelSelector> -o json`
+**Errors:** Tool fails → Report error, guide user to fix MCP setup
 
 **Step 2: Display Filtered Results**
 
@@ -304,14 +293,7 @@ Display with explanation: `## 📋 VMs with label 'app=web'` + list/table using
 - `resources_list` - List resources (apiVersion, kind, namespace optional, allNamespaces optional, labelSelector optional)
 - `resources_get` - Get resource details (apiVersion, kind, namespace, name)
 
-### CLI Fallback Commands (Use only if MCP tools fail)
-- `oc get virtualmachines` / `oc get vm` - List VirtualMachines
-- `oc get vm <name> -n <namespace>` - Get specific VM
-- `oc get vm -A` - List VMs across all namespaces
-- `oc get vm -n <namespace>` - List VMs in specific namespace
-- `oc get vm -l <selector>` - Filter VMs by label selector
-
-**Important**: Always attempt MCP tools first. Only use CLI commands after MCP tool failure and with user confirmation.
+**Important**: All operations must use MCP tools exclusively. CLI commands (`oc`, `kubectl`) are prohibited to prevent command injection risks.
 
 ### Related Skills
 - `vm-create` - Create VMs after checking inventory
@@ -362,15 +344,14 @@ Agent: [MCP: resources_list(apiVersion="kubevirt.io/v1", kind="VirtualMachine",
        [Displays table format from Workflow A Step 3]
 ```
 
-### Example 2: CLI fallback when MCP unavailable
+### Example 2: MCP unavailable
 
 ```
 User: "List all VMs"
 Agent: [MCP tool fails]
-       ⚠️ MCP tool 'resources_list' not available. Use CLI: `oc get virtualmachines -A`?
-User: "yes"
-Agent: [Executes: oc get virtualmachines -A -o json]
-       [Displays table format]
+       ❌ Cannot execute vm-inventory: MCP server not available.
+       Setup: Add openshift-virtualization to mcps.json, set KUBECONFIG, restart Claude Code.
+       Docs: https://github.com/openshift/openshift-mcp-server
 ```
 
 ### Example 3: Get specific VM details

From 5be41592d6fb4547cda93e50c1af43dc525e72a7 Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Wed, 6 May 2026 17:50:31 +0200
Subject: [PATCH 03/37] fix(rh-virt): RH-VIRT-015 require per-VM typed
 confirmation for batch deletion

---
 rh-virt/skills/vm-delete/SKILL.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rh-virt/skills/vm-delete/SKILL.md b/rh-virt/skills/vm-delete/SKILL.md
index ac079445..e6d2d5f2 100644
--- a/rh-virt/skills/vm-delete/SKILL.md
+++ b/rh-virt/skills/vm-delete/SKILL.md
@@ -394,7 +394,7 @@ This is preview only. No resources deleted.
 ## Advanced Features
 
 ### Batch Deletion
-Delete multiple VMs with confirmation for each: `"Delete VMs test-01, test-02, test-03 in dev"` → Process each individually with full workflow. Use typed confirmation: `DELETE-3-VMS` for batch.
+Delete multiple VMs: `"Delete VMs test-01, test-02, test-03 in dev"` → Process each VM individually through the full workflow (Steps 1-5), requiring typed confirmation of each VM name separately. Never use a generic batch confirmation — each VM must be confirmed by its exact name.
 
 ### Dry-Run Mode
 Show deletion scope without executing: Execute Step 1-2, skip Steps 3-4. User request: "Show what would be deleted if I delete VM xyz"

From 6969f37923af2d463e6ed0a9b357ae83a5c54046 Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Wed, 6 May 2026 17:53:09 +0200
Subject: [PATCH 04/37] fix(rh-virt): RH-VIRT-003 restrict
 resources_create_or_update to VirtualMachineSnapshot only

---
 rh-virt/skills/vm-snapshot-create/SKILL.md | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/rh-virt/skills/vm-snapshot-create/SKILL.md b/rh-virt/skills/vm-snapshot-create/SKILL.md
index 1456b89e..855d3d43 100644
--- a/rh-virt/skills/vm-snapshot-create/SKILL.md
+++ b/rh-virt/skills/vm-snapshot-create/SKILL.md
@@ -15,20 +15,21 @@ description: |
 license: Apache-2.0
 model: inherit
 color: green
+allowed-tools: mcp__openshift-virtualization__resources_create_or_update mcp__openshift-virtualization__resources_get mcp__openshift-virtualization__resources_list
 ---
 
 # /vm-snapshot-create Skill
 
 Create virtual machine snapshots in OpenShift Virtualization. Snapshots capture the state and data of a VM at a specific point in time, enabling backup, recovery, and testing workflows.
 
-**Implementation Note**: This skill uses generic Kubernetes resource tools (`resources_create_or_update`) to manage VirtualMachineSnapshot resources. Dedicated snapshot tools do not currently exist in the openshift-virtualization MCP server.
+**Implementation Note**: This skill uses generic Kubernetes resource tools (`resources_create_or_update`) to manage VirtualMachineSnapshot resources. Dedicated snapshot tools do not currently exist in the openshift-virtualization MCP server. **`resources_create_or_update` MUST only be called with `apiVersion: snapshot.kubevirt.io/v1beta1` and `kind: VirtualMachineSnapshot`** — using it to create or modify any other resource type is a security violation.
 
 ## Prerequisites
 
 **Required MCP Server**: `openshift-virtualization` ([OpenShift MCP Server](https://github.com/openshift/openshift-mcp-server))
 
 **Required MCP Tools**:
-- `resources_create_or_update` (from openshift-virtualization) - Create VirtualMachineSnapshot
+- `resources_create_or_update` (from openshift-virtualization) - Create VirtualMachineSnapshot **ONLY**. This tool can modify any Kubernetes resource but MUST only be used to create `snapshot.kubevirt.io/v1beta1/VirtualMachineSnapshot` resources. Any other resource type is strictly prohibited.
 - `resources_get` (from openshift-virtualization) - Verify VM exists and get status
 - `resources_list` (from openshift-virtualization) - List StorageClass, VolumeSnapshotClass
 
@@ -211,14 +212,15 @@ spec:
 
 ### Step 8b: Post-Construction Verification
 
-**CRITICAL: Before calling `resources_create_or_update`, verify the constructed YAML:**
+**CRITICAL: Before calling `resources_create_or_update`, verify the constructed YAML. This is a MANDATORY gate — never skip it.**
 
-1. `apiVersion` is exactly `snapshot.kubevirt.io/v1beta1`
-2. `kind` is exactly `VirtualMachineSnapshot`
+1. `apiVersion` is exactly `snapshot.kubevirt.io/v1beta1` — any other apiVersion is a **security violation**, STOP immediately
+2. `kind` is exactly `VirtualMachineSnapshot` — any other kind is a **security violation**, STOP immediately
 3. Only these fields exist: `metadata.name`, `metadata.namespace`, `spec.source.apiGroup`, `spec.source.kind`, `spec.source.name`
 4. No additional fields, labels, annotations, or nested objects are present
+5. All placeholder values (`<snapshot-name>`, `<namespace>`, `<vm-name>`) have been replaced with validated user input from Step 1b
 
-**If the YAML contains ANY unexpected fields or values, STOP and report a validation error. Do NOT send it to the API.**
+**If ANY check fails, STOP and report a validation error. Do NOT send it to the API. Do NOT attempt to fix the YAML — cancel the operation entirely.**
 
 **Report progress:**
 ```markdown
@@ -287,7 +289,7 @@ Check `status.phase`:
 - `openshift-virtualization` - OpenShift MCP server with kubevirt toolset
 
 ### Required MCP Tools
-- `resources_create_or_update` (from openshift-virtualization) - Create VirtualMachineSnapshot
+- `resources_create_or_update` (from openshift-virtualization) - Create VirtualMachineSnapshot **ONLY** (never for other resource types)
 - `resources_get` (from openshift-virtualization) - Verify VM and snapshot status
 - `resources_list` (from openshift-virtualization) - List StorageClass, VolumeSnapshotClass
 
@@ -392,7 +394,10 @@ Check `status.phase`:
 - **Namespace Isolation**: Snapshots scoped to namespace boundaries
 - **Audit Trail**: All snapshot operations logged in Kubernetes API audit logs
 
-**Defense-in-depth note**: Input validation and YAML verification in this skill are instruction-level controls — they guide the LLM but are not hard security boundaries. The real enforcement layers are Kubernetes RBAC (restricts what resources the ServiceAccount can create) and admission webhooks (can enforce policies server-side). Ensure the KUBECONFIG ServiceAccount follows least-privilege principles.
+**Defense-in-depth note**: This skill uses `resources_create_or_update`, a generic MCP tool capable of creating or modifying any Kubernetes resource. The controls in this skill (input validation, fixed YAML template, post-construction verification, allowed-tools declaration) are instruction-level — they guide the LLM but are not hard security boundaries. The real enforcement layers are:
+- **Kubernetes RBAC**: The KUBECONFIG ServiceAccount should follow least-privilege — grant only `create` and `get` for `VirtualMachineSnapshot` in target namespaces, not broad resource permissions
+- **Admission webhooks**: Can enforce server-side policies on resource creation
+- **Future migration**: If the openshift-virtualization MCP server adds dedicated snapshot tools, this skill should migrate to them and drop `resources_create_or_update`
 
 ## Example Usage
 

From 03ead8864ad275f01963f9509057aaebcfff2569 Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Wed, 6 May 2026 18:10:20 +0200
Subject: [PATCH 05/37] fix(rh-virt): RH-VIRT-006 remove external doc reads to
 prevent indirect prompt injection

---
 rh-virt/skills/vm-inventory/SKILL.md | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/rh-virt/skills/vm-inventory/SKILL.md b/rh-virt/skills/vm-inventory/SKILL.md
index 2655488b..c39fc56b 100644
--- a/rh-virt/skills/vm-inventory/SKILL.md
+++ b/rh-virt/skills/vm-inventory/SKILL.md
@@ -177,12 +177,9 @@ Required: VM name, Namespace (ask if not provided)
 
 **Errors:** Tool fails → Report error, guide user to fix MCP setup
 
-**Step 3: Interpret Status and Conditions (Optional)**
+**Step 3: Interpret Status and Conditions**
 
-**OPTIONAL**: If VM has error status (ErrorUnschedulable, ErrorDataVolumeNotReady, CrashLoopBackOff), consult [troubleshooting/INDEX.md](../../docs/troubleshooting/INDEX.md) using Read tool. Output: "Consulted INDEX.md to interpret status."
-
-**When to consult**: VM status is Error/Warning or stuck state (CrashLoopBackOff, Terminating)
-**When NOT to consult**: VM status is normal (Running, Stopped, Provisioning)
+Report the VM status as-is from the API response. Do NOT read external documentation files to interpret status — use the status indicators defined in the Output Formatting Guidelines section below. If the user needs troubleshooting guidance, suggest they use a dedicated troubleshooting skill instead.
 
 **Step 4: Display Detailed Information**
 
@@ -301,7 +298,6 @@ Display with explanation: `## 📋 VMs with label 'app=web'` + list/table using
 - `vm-troubleshooter` (planned) - Diagnose problematic VMs from inventory
 
 ### Reference Documentation
-- [Troubleshooting INDEX](../../docs/troubleshooting/INDEX.md) - VM status interpretation (optionally consulted when displaying VM details with error states)
 - [OpenShift Virtualization Documentation](https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/virtualization/index#virt/about_virt/about-virt.html)
 - [KubeVirt VirtualMachine API](https://kubevirt.io/api-reference/)
 - [Accessing VMs](https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/virtualization/index#virt/virtual_machines/virt-accessing-vm-consoles.html)

From 5eece304a790eec82fefd7c280f93f05873d3e0b Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Wed, 6 May 2026 18:12:10 +0200
Subject: [PATCH 06/37] fix(rh-virt): RH-VIRT-007 clarify human-in-the-loop as
 not required for read-only skill

---
 rh-virt/skills/vm-inventory/SKILL.md | 19 +++----------------
 1 file changed, 3 insertions(+), 16 deletions(-)

diff --git a/rh-virt/skills/vm-inventory/SKILL.md b/rh-virt/skills/vm-inventory/SKILL.md
index c39fc56b..2c698adc 100644
--- a/rh-virt/skills/vm-inventory/SKILL.md
+++ b/rh-virt/skills/vm-inventory/SKILL.md
@@ -303,22 +303,9 @@ Display with explanation: `## 📋 VMs with label 'app=web'` + list/table using
 - [Accessing VMs](https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/virtualization/index#virt/virtual_machines/virt-accessing-vm-consoles.html)
 - [VM Status Conditions](https://kubevirt.io/user-guide/virtual_machines/vm_status_conditions/)
 
-## Critical: Human-in-the-Loop Requirements
-
-**Not applicable** - This skill performs read-only operations and does not modify any cluster resources. No user confirmation required.
-
-**Read-only operations:**
-- Listing VirtualMachines across namespaces or in specific namespaces
-- Retrieving VM details, status, and resource configurations
-- Displaying VM health conditions and resource usage
-- Filtering VMs by labels or field selectors
-- Viewing VM network, storage, and node placement information
-
-**No modifications performed:**
-- ✓ Does not change VM state (start/stop/restart)
-- ✓ Does not modify VM configuration
-- ✓ Does not delete VMs or resources
-- ✓ Does not consume cluster resources
+## Human-in-the-Loop Requirements
+
+This skill is **read-only** — no user confirmation is required. It does not change VM state, modify configuration, delete resources, or consume cluster capacity.
 
 ## Security Considerations
 

From 67b3a4b6ee6dba1f5caa0afd504a2af6748889f6 Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Wed, 6 May 2026 18:17:34 +0200
Subject: [PATCH 07/37] fix(rh-virt): RH-VIRT-020 remove shell commands, use
 MCP tools exclusively

---
 rh-virt/skills/vm-create/SKILL.md | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/rh-virt/skills/vm-create/SKILL.md b/rh-virt/skills/vm-create/SKILL.md
index 2468ea52..ead1ddc9 100644
--- a/rh-virt/skills/vm-create/SKILL.md
+++ b/rh-virt/skills/vm-create/SKILL.md
@@ -83,8 +83,7 @@ Create virtual machines in OpenShift Virtualization using the `vm_create` tool f
 **Optional (use defaults):** OS (fedora), Size (medium), Storage (30Gi), Performance (u1), Autostart (false)
 
 **Gather cluster info:**
-- Detect current namespace: `kubectl config view --minify -o jsonpath='{..namespace}' || echo "default"`
-- List namespaces: `namespaces_list` (from openshift-virtualization)
+- List namespaces: `namespaces_list` (from openshift-virtualization) — ask user to select if not provided
 - List StorageClasses: `resources_list` with apiVersion="storage.k8s.io/v1", kind="StorageClass"
 - Identify default SC: annotation `storageclass.kubernetes.io/is-default-class`="true"
 - Analyze SC: `.volumeBindingMode` (Immediate/WaitForFirstConsumer), provisioner (rbd/cephfs=RWX hint)
@@ -194,7 +193,7 @@ Confirm: yes/no/modify
 
 ### Recommended Solution
 <workaround-description>
-**Command**: `oc patch vm <name> -n <namespace> ...`
+**Action**: Update VM via `resources_create_or_update`
 **Impact**: <what-changes>
 **Options**: 1) Apply workaround, 2) Manual, 3) Cancel, 4) Ignore
 ⚠️ MCP limitation: vm_create doesn't support tolerations
@@ -203,7 +202,7 @@ Confirm: yes/no/modify
 **Wait for user decision.**
 
 **If user confirms:**
-1. Apply patch: `resources_create_or_update` (fetch, add tolerations, update) OR `oc patch`
+1. Apply patch: `resources_create_or_update` (fetch, add tolerations, update)
 2. Verify: `resources_get` → Check `.spec.template.spec.tolerations`
 3. **Restart VM**: `vm_lifecycle` (action="restart") to apply new spec
 4. Wait 15-20s, check status → Stopped → Provisioning → Running
@@ -241,7 +240,7 @@ Start: "Start VM <name>" | View: "Show VM <name>"
 **Error**: <error-message>
 
 **Common Causes**:
-- Namespace not exists → `oc create namespace <name>`
+- Namespace not exists → Create via `resources_create_or_update`
 - RBAC denied → Check ServiceAccount permissions
 - Resource constraints → Try smaller size
 - Invalid parameters → Verify OS, size, storage format
@@ -254,7 +253,7 @@ Troubleshooting: See Common Issues
 
 ### Issue 1: Namespace Not Found
 **Error**: "Namespace 'xyz' not found"
-**Solution**: List with `namespaces_list`, create with `resources_create_or_update` or `oc create namespace <name>`
+**Solution**: List with `namespaces_list`, create with `resources_create_or_update`
 
 ### Issue 2: Insufficient Permissions
 **Error**: "Forbidden: User cannot create VirtualMachines"

From 4e8d850f824808b8c3d5fd5fc8b0c278c9bda45d Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Wed, 6 May 2026 18:23:37 +0200
Subject: [PATCH 08/37] fix(rh-virt): RH-VIRT-026 enforce per-VM confirmation,
 fix already-running example

---
 rh-virt/skills/vm-lifecycle-manager/SKILL.md | 26 +++++++++++---------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/rh-virt/skills/vm-lifecycle-manager/SKILL.md b/rh-virt/skills/vm-lifecycle-manager/SKILL.md
index be1903f6..b7f8ed71 100644
--- a/rh-virt/skills/vm-lifecycle-manager/SKILL.md
+++ b/rh-virt/skills/vm-lifecycle-manager/SKILL.md
@@ -220,6 +220,8 @@ Confirm: yes/no
 
 If user says "no" or wants to reconsider, do not proceed.
 
+**Batch operations**: When the user requests actions on multiple VMs, process each VM individually through the full workflow (Step 1-3) with separate confirmation for each. Never use a single bulk confirmation for multiple VMs.
+
 **Why**: start (consumes resources), stop (interrupts services), restart (brief downtime). User should verify correct VM and understand impact.
 
 ## Security Considerations
@@ -282,7 +284,7 @@ Impact: Running after stop+start. Brief interruption. Monitor app logs.
 ```
 User: "Start web-server in namespace vms"
 Agent: [vm-lifecycle-manager skill]
-       [vm_lifecycle(action="start")]
+       [Checks VM status via resources_get — already Running]
 ## ℹ️ VM Already Running
 VM: `web-server` | Namespace: `vms` | Status: Running
 Result: No action taken - VM already in desired state.
@@ -293,16 +295,18 @@ To restart: "Restart VM web-server in namespace vms"
 
 ```
 User: "Stop VMs web-01, web-02, web-03 in namespace production"
-Agent: [vm-lifecycle-manager skill - batch mode]
-## Batch Lifecycle Operation
-Stopping 3 VMs in 'production': web-01, web-02, web-03
-Impact: All 3 VMs will shut down, services interrupted.
+Agent: [vm-lifecycle-manager skill — processes each VM individually with full workflow]
+
+## VM Lifecycle Operation
+| VM Name | `web-01` | Namespace | `production` | Action | `stop` | graceful shutdown |
+Confirm: yes/no
+User: "yes"
+Agent: [vm_lifecycle(namespace="production", name="web-01", action="stop")]
+✓ web-01: Stopped
+
+## VM Lifecycle Operation
+| VM Name | `web-02` | Namespace | `production` | Action | `stop` | graceful shutdown |
 Confirm: yes/no
 User: "yes"
-Agent: [Executes vm_lifecycle for each VM sequentially]
-## ✓ Batch Stop Successful
-- web-01: Stopped
-- web-02: Stopped
-- web-03: Stopped
-All VMs stopped. Resources freed.
+[...repeats for each VM with individual confirmation...]
 ```

From 5a10dab44414ebdaee20fcf66b675331b0fd9f29 Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Wed, 6 May 2026 18:30:26 +0200
Subject: [PATCH 09/37] fix(rh-virt): RH-VIRT-032 require typed snapshot name
 confirmation for deletion

---
 rh-virt/skills/vm-snapshot-delete/SKILL.md | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/rh-virt/skills/vm-snapshot-delete/SKILL.md b/rh-virt/skills/vm-snapshot-delete/SKILL.md
index 561cabf2..38730819 100644
--- a/rh-virt/skills/vm-snapshot-delete/SKILL.md
+++ b/rh-virt/skills/vm-snapshot-delete/SKILL.md
@@ -171,14 +171,14 @@ Delete operation cancelled.
 
 ---
 
-**Proceed with snapshot deletion? This action cannot be undone. (yes/no)**
+**Type the snapshot name `<snapshot-name>` to confirm deletion (cannot be undone):** _____
 ```
 
-**Wait for user confirmation.**
+**Wait for user typed confirmation.**
 
 **Handle response:**
-- If "yes" → Proceed to Step 5 (execute deletion)
-- If "no", "cancel", or anything else → Cancel operation
+- If input matches snapshot name exactly (case-sensitive) → Proceed to Step 5
+- If mismatch → Report: `❌ Confirmation failed. You typed: <input>. Expected: <snapshot-name>. Cancelled.` **STOP workflow.**
 
 **On cancellation:**
 ```markdown
@@ -368,11 +368,12 @@ Would you like help troubleshooting this error?
    - Show snapshot details (VM, age, size)
    - Confirm snapshot won't be needed for recovery
    - List other available snapshots for the VM
-   - Ask: "Proceed with snapshot deletion? (yes/no)"
-   - Wait for explicit "yes"
+   - **Require typed confirmation**: user must type the exact snapshot name to confirm
+   - Accept only exact match (case-sensitive) — mismatch cancels the operation
 
 2. **Never Auto-Execute**
-   - **NEVER delete without user confirmation**
+   - **NEVER delete without typed confirmation**
+   - **NEVER accept a simple "yes" — require the snapshot name**
    - **ALWAYS show what will be lost before deletion**
 
 **Why This Matters:**
@@ -383,7 +384,7 @@ Would you like help troubleshooting this error?
 ## Security Considerations
 
 - **RBAC Enforcement**: Requires delete permissions for VirtualMachineSnapshot resources
-- **User Confirmation**: Always requires explicit "yes" before deletion
+- **Typed Confirmation**: Requires exact snapshot name to confirm deletion — prevents accidental "yes"
 - **Last Snapshot Warning**: Warns users when deleting the only snapshot for a VM
 - **Namespace Isolation**: Snapshots scoped to namespace boundaries
 - **Audit Trail**: Deletions logged in Kubernetes API audit logs
@@ -421,9 +422,9 @@ Impact of Deletion:
 Available snapshots for VM `database-01`:
 - `database-01-pre-upgrade` (created 2024-01-15 10:30)
 
-Proceed with snapshot deletion? This action cannot be undone. (yes/no)
+Type the snapshot name `database-01-daily-backup` to confirm deletion (cannot be undone): _____
 
-User: "yes"
+User: "database-01-daily-backup"
 
 Agent: [Step 5: Deletes snapshot]
 

From 93ff641fcd3c59b549c37c877dd07ea9fa71d12b Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 09:11:16 +0200
Subject: [PATCH 10/37] fix(rh-virt): RH-VIRT-034 add allowed-tools to
 vm-snapshot-delete

---
 rh-virt/skills/vm-snapshot-delete/SKILL.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rh-virt/skills/vm-snapshot-delete/SKILL.md b/rh-virt/skills/vm-snapshot-delete/SKILL.md
index 38730819..be54231b 100644
--- a/rh-virt/skills/vm-snapshot-delete/SKILL.md
+++ b/rh-virt/skills/vm-snapshot-delete/SKILL.md
@@ -15,6 +15,7 @@ description: |
 license: Apache-2.0
 model: inherit
 color: yellow
+allowed-tools: mcp__openshift-virtualization__resources_get mcp__openshift-virtualization__resources_list mcp__openshift-virtualization__resources_delete
 ---
 
 # /vm-snapshot-delete Skill

From d524979b8157d9dde8110a72e969b214904bccb3 Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 09:13:02 +0200
Subject: [PATCH 11/37] fix(rh-virt): RH-VIRT-008 skip VMI detail queries when
 listing more than 20 VMs

---
 rh-virt/skills/vm-inventory/SKILL.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/rh-virt/skills/vm-inventory/SKILL.md b/rh-virt/skills/vm-inventory/SKILL.md
index 2c698adc..28fdf90c 100644
--- a/rh-virt/skills/vm-inventory/SKILL.md
+++ b/rh-virt/skills/vm-inventory/SKILL.md
@@ -88,7 +88,9 @@ List and inspect virtual machines in OpenShift Virtualization clusters. This ski
 
 **Step 2: Get Resource Details for Running VMs**
 
-**CRITICAL**: To display complete VM information, query VirtualMachineInstance (VMI) resources:
+**Large cluster safeguard**: If Step 1 returned more than 20 VMs, skip VMI queries entirely. Display a summary table using only VM resource data (Name, Namespace, Status) and suggest the user narrow down by namespace: `⚠️ Found <N> VMs across all namespaces. Showing summary view. Use "List VMs in namespace <ns>" for full details.`
+
+To display complete VM information (when 50 or fewer VMs), query VirtualMachineInstance (VMI) resources:
 
 **MCP Tool**: `resources_list` (apiVersion="kubevirt.io/v1", kind="VirtualMachineInstance")
 

From f740b1ddabcf355bb88e2d27e6924b4c1fe7c4b2 Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 09:15:21 +0200
Subject: [PATCH 12/37] fix(rh-virt): RH-VIRT-012 replace ambiguous relative
 paths and remove Read tool injection

---
 rh-virt/skills/vm-rebalance/SKILL.md | 48 ++++++++++++----------------
 1 file changed, 21 insertions(+), 27 deletions(-)

diff --git a/rh-virt/skills/vm-rebalance/SKILL.md b/rh-virt/skills/vm-rebalance/SKILL.md
index 8b77b5c0..704420f1 100644
--- a/rh-virt/skills/vm-rebalance/SKILL.md
+++ b/rh-virt/skills/vm-rebalance/SKILL.md
@@ -89,19 +89,13 @@ Orchestrate VM migrations across OpenShift cluster nodes for load balancing, mai
 
 **For Manual Mode:**
 
-**Document Consultation** (REQUIRED - Execute FIRST):
-1. Read [REBALANCE_MANUAL.md](./REBALANCE_MANUAL.md) using Read tool
-2. Output: "I consulted [REBALANCE_MANUAL.md](rh-virt/skills/vm-rebalance/REBALANCE_MANUAL.md) to understand the manual migration workflow."
-3. **Then execute**: Follow workflow in REBALANCE_MANUAL.md
+Follow the workflow defined in [REBALANCE_MANUAL.md](rh-virt/skills/vm-rebalance/REBALANCE_MANUAL.md).
 
 ---
 
 **For Automatic Mode:**
 
-**Document Consultation** (REQUIRED - Execute FIRST):
-1. Read [REBALANCE_AUTOMATIC.md](./REBALANCE_AUTOMATIC.md) using Read tool
-2. Output: "I consulted [REBALANCE_AUTOMATIC.md](rh-virt/skills/vm-rebalance/REBALANCE_AUTOMATIC.md) to understand the automatic rebalancing workflow."
-3. **Then execute**: Follow workflow in REBALANCE_AUTOMATIC.md
+Follow the workflow defined in [REBALANCE_AUTOMATIC.md](rh-virt/skills/vm-rebalance/REBALANCE_AUTOMATIC.md).
 
 ## Common Validation Logic
 
@@ -133,7 +127,7 @@ Orchestrate VM migrations across OpenShift cluster nodes for load balancing, mai
 
 **Error for live migration**: If RWO → "Cannot live migrate. Use cold migration (brief downtime ~30-60s)."
 
-**Reference**: [references/live-migration-best-practices.md](./references/live-migration-best-practices.md)
+**Reference**: [references/live-migration-best-practices.md](rh-virt/skills/vm-rebalance/references/live-migration-best-practices.md)
 
 ### Validation 4: Verify Target Node Exists
 
@@ -143,7 +137,7 @@ Orchestrate VM migrations across OpenShift cluster nodes for load balancing, mai
 
 **Errors**: Not found → "Node doesn't exist" | Not Ready → "Choose different target" | Cordoned → "Uncordon or choose different target"
 
-**Reference**: [../../docs/troubleshooting/scheduling-errors.md](../../docs/troubleshooting/scheduling-errors.md)
+**Reference**: [rh-virt/docs/troubleshooting/scheduling-errors.md](rh-virt/docs/troubleshooting/scheduling-errors.md)
 
 ## Node Selection for Automatic Rebalancing
 
@@ -166,7 +160,7 @@ Filter where ALL true:
 
 **Cold Migration**: Brief downtime (~30-60s). Works with any storage. Stop VM → Update placement → Start on target.
 
-**Reference**: [references/live-migration-best-practices.md](./references/live-migration-best-practices.md)
+**Reference**: [references/live-migration-best-practices.md](rh-virt/skills/vm-rebalance/references/live-migration-best-practices.md)
 
 ## Common Plan Visualization
 
@@ -272,22 +266,22 @@ If any node's CPU or Memory percentage **exceeds 100%** after rebalancing:
 ### Error 1: Live Migration Fails - Storage Not RWX
 **Symptom**: "Cannot live migrate: PVC access mode is ReadWriteOnce"
 **Solution**: Use cold migration OR convert PVC to RWX
-**Reference**: [../../docs/troubleshooting/storage-errors.md](../../docs/troubleshooting/storage-errors.md)
+**Reference**: [rh-virt/docs/troubleshooting/storage-errors.md](rh-virt/docs/troubleshooting/storage-errors.md)
 
 ### Error 2: VM Stuck ErrorUnschedulable After Cold Migration
 **Symptom**: "VM cannot be scheduled: ErrorUnschedulable"
 **Solution**: Check node capacity (`nodes_top`), verify no blocking taints (`resources_get` Node), add tolerations, choose different target, remove nodeSelector
-**Reference**: [../../docs/troubleshooting/scheduling-errors.md](../../docs/troubleshooting/scheduling-errors.md)
+**Reference**: [rh-virt/docs/troubleshooting/scheduling-errors.md](rh-virt/docs/troubleshooting/scheduling-errors.md)
 
 ### Error 3: Live Migration Times Out
 **Symptom**: "Migration exceeded timeout: 150s per GiB"
 **Solution**: Retry migration, reduce VM workload, use cold migration, increase timeout in HyperConverged CR
-**Reference**: [references/performance-tuning.md](./references/performance-tuning.md)
+**Reference**: [references/performance-tuning.md](rh-virt/skills/vm-rebalance/references/performance-tuning.md)
 
 ### Error 4: Migration Rejected - Cluster Limit Reached
 **Symptom**: "Migration rejected: cluster limit reached (5 concurrent)"
 **Solution**: Wait for migrations to complete (`resources_list` VirtualMachineInstanceMigration), retry, migrate sequentially, increase limit
-**Reference**: [references/performance-tuning.md](./references/performance-tuning.md)
+**Reference**: [references/performance-tuning.md](rh-virt/skills/vm-rebalance/references/performance-tuning.md)
 
 ### Error 5: RBAC Permission Denied
 **Symptom**: "Forbidden: User cannot create VirtualMachineInstanceMigration"
@@ -296,13 +290,13 @@ If any node's CPU or Memory percentage **exceeds 100%** after rebalancing:
 ### Error 6: Network Saturation
 **Symptom**: Multiple migrations slow/fail, high network utilization
 **Solution**: Reduce concurrent migrations, set bandwidth limit, use dedicated migration network
-**Reference**: [references/performance-tuning.md](./references/performance-tuning.md)
+**Reference**: [references/performance-tuning.md](rh-virt/skills/vm-rebalance/references/performance-tuning.md)
 
 ### Error 7: Resource Version Conflict During Cold Migration
 **Symptom**: "Apply failed: conflict with 'kubernetes-mcp-server' using .spec.runStrategy"
 **Solution**: After `vm_lifecycle` stop, re-read VM using `resources_get` before updating nodeAffinity (gets fresh resourceVersion)
 **Workflow**: Stop → Wait → Re-read → Update nodeAffinity → Start
-**Reference**: [REBALANCE_MANUAL.md - Sub-step 4b.2.5](./REBALANCE_MANUAL.md)
+**Reference**: [REBALANCE_MANUAL.md - Sub-step 4b.2.5](rh-virt/skills/vm-rebalance/REBALANCE_MANUAL.md)
 
 ## Dependencies
 
@@ -321,20 +315,20 @@ If any node's CPU or Memory percentage **exceeds 100%** after rebalancing:
 ### Reference Documentation
 
 **Skill Strategy Files**:
-- [REBALANCE_MANUAL.md](./REBALANCE_MANUAL.md) - User-driven migration
-- [REBALANCE_AUTOMATIC.md](./REBALANCE_AUTOMATIC.md) - AI-driven rebalancing
+- [REBALANCE_MANUAL.md](rh-virt/skills/vm-rebalance/REBALANCE_MANUAL.md) - User-driven migration
+- [REBALANCE_AUTOMATIC.md](rh-virt/skills/vm-rebalance/REBALANCE_AUTOMATIC.md) - AI-driven rebalancing
 
 **Performance and Best Practices**:
-- [references/live-migration-best-practices.md](./references/live-migration-best-practices.md) - Configuration, requirements, networks
-- [references/performance-tuning.md](./references/performance-tuning.md) - Right-sizing, overcommit, bandwidth
-- [references/anti-patterns.md](./references/anti-patterns.md) - Common mistakes
-- [references/production-considerations.md](./references/production-considerations.md) - HA, capacity, security
+- [references/live-migration-best-practices.md](rh-virt/skills/vm-rebalance/references/live-migration-best-practices.md) - Configuration, requirements, networks
+- [references/performance-tuning.md](rh-virt/skills/vm-rebalance/references/performance-tuning.md) - Right-sizing, overcommit, bandwidth
+- [references/anti-patterns.md](rh-virt/skills/vm-rebalance/references/anti-patterns.md) - Common mistakes
+- [references/production-considerations.md](rh-virt/skills/vm-rebalance/references/production-considerations.md) - HA, capacity, security
 
 **Troubleshooting**:
-- [../../docs/troubleshooting/INDEX.md](../../docs/troubleshooting/INDEX.md) - Master index
-- [../../docs/troubleshooting/scheduling-errors.md](../../docs/troubleshooting/scheduling-errors.md) - ErrorUnschedulable, taints
-- [../../docs/troubleshooting/storage-errors.md](../../docs/troubleshooting/storage-errors.md) - PVC access modes
-- [../../docs/troubleshooting/lifecycle-errors.md](../../docs/troubleshooting/lifecycle-errors.md) - VM start/stop
+- [rh-virt/docs/troubleshooting/INDEX.md](rh-virt/docs/troubleshooting/INDEX.md) - Master index
+- [rh-virt/docs/troubleshooting/scheduling-errors.md](rh-virt/docs/troubleshooting/scheduling-errors.md) - ErrorUnschedulable, taints
+- [rh-virt/docs/troubleshooting/storage-errors.md](rh-virt/docs/troubleshooting/storage-errors.md) - PVC access modes
+- [rh-virt/docs/troubleshooting/lifecycle-errors.md](rh-virt/docs/troubleshooting/lifecycle-errors.md) - VM start/stop
 
 **Official Documentation**:
 - [OpenShift Virt - Live Migration](https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/virtualization/index#virt-live-migration)

From aec96c1c1f986eff34311007376761d5750ff193 Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 09:59:36 +0200
Subject: [PATCH 13/37] fix(rh-virt): RH-VIRT-013 add allowed-tools to
 vm-rebalance frontmatter

---
 rh-virt/skills/vm-rebalance/SKILL.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rh-virt/skills/vm-rebalance/SKILL.md b/rh-virt/skills/vm-rebalance/SKILL.md
index 704420f1..7a7d5484 100644
--- a/rh-virt/skills/vm-rebalance/SKILL.md
+++ b/rh-virt/skills/vm-rebalance/SKILL.md
@@ -16,6 +16,7 @@ description: |
 license: Apache-2.0
 model: inherit
 color: yellow
+allowed-tools: mcp__openshift-virtualization__resources_list mcp__openshift-virtualization__resources_get mcp__openshift-virtualization__resources_create_or_update mcp__openshift-virtualization__nodes_top mcp__openshift-virtualization__pods_top mcp__openshift-virtualization__nodes_stats_summary
 ---
 
 # /vm-rebalance Skill

From 46305eb590c02c61fedae9594afe44b1fcd4ca87 Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 10:09:23 +0200
Subject: [PATCH 14/37] fix(rh-virt): RH-VIRT-017 add allowed-tools to
 vm-delete frontmatter

---
 rh-virt/skills/vm-delete/SKILL.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rh-virt/skills/vm-delete/SKILL.md b/rh-virt/skills/vm-delete/SKILL.md
index e6d2d5f2..d512a1cd 100644
--- a/rh-virt/skills/vm-delete/SKILL.md
+++ b/rh-virt/skills/vm-delete/SKILL.md
@@ -16,6 +16,7 @@ description: |
 license: Apache-2.0
 model: inherit
 color: red
+allowed-tools: mcp__openshift-virtualization__resources_get mcp__openshift-virtualization__resources_delete mcp__openshift-virtualization__resources_list mcp__openshift-virtualization__resources_create_or_update mcp__openshift-virtualization__pods_list_in_namespace
 ---
 
 # /vm-delete Skill

From 4546212aacb6ccab850969dc86c004ec2fe499a1 Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 10:10:32 +0200
Subject: [PATCH 15/37] fix(rh-virt): RH-VIRT-021 add custom image provenance
 warning

---
 rh-virt/skills/vm-create/SKILL.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rh-virt/skills/vm-create/SKILL.md b/rh-virt/skills/vm-create/SKILL.md
index ead1ddc9..439d4274 100644
--- a/rh-virt/skills/vm-create/SKILL.md
+++ b/rh-virt/skills/vm-create/SKILL.md
@@ -330,7 +330,7 @@ Troubleshooting: See Common Issues
 - **RBAC**: Requires create VirtualMachines (kubevirt.io/v1) in namespace
 - **Namespace Isolation**: VMs in specified namespace only
 - **Storage Quotas**: Respects ResourceQuotas
-- **Image Security**: Uses official images from trusted registries
+- **Image Security**: Default OS options (fedora, ubuntu, rhel, centos-stream, debian, opensuse) use upstream container disk images. Custom images via the `workload` parameter are not validated — warn the user when a custom image URL is provided and confirm the source is trusted before proceeding
 - **KUBECONFIG**: Never exposed (presence only)
 - **Audit**: All ops logged via K8s audit
 
@@ -391,6 +391,6 @@ Agent: [Creates]
 
 ## Advanced Features
 
-**Custom Images**: `vm_create({"workload": "quay.io/containerdisks/fedora:latest", ...})`
+**Custom Images**: `vm_create({"workload": "quay.io/containerdisks/fedora:latest", ...})` — ⚠️ When a custom image URL is provided, warn the user that image provenance is not verified and confirm the source is trusted before creating the VM
 **Secondary Networks**: `vm_create({"networks": ["vlan-network"], ...})` or `{"networks": [{"name": "eth1", "networkName": "vlan"}], ...}`
 **Explicit Instance Type**: `vm_create({"instancetype": "u1.large", ...})`

From e9ab7305a50b51949c185477b70961152f5e0321 Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 10:11:29 +0200
Subject: [PATCH 16/37] fix(rh-virt): RH-VIRT-022 bound provisioning polling to
 max 3 retries

---
 rh-virt/skills/vm-create/SKILL.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rh-virt/skills/vm-create/SKILL.md b/rh-virt/skills/vm-create/SKILL.md
index 439d4274..5a9c6515 100644
--- a/rh-virt/skills/vm-create/SKILL.md
+++ b/rh-virt/skills/vm-create/SKILL.md
@@ -165,7 +165,7 @@ Confirm: yes/no/modify
 **Status interpretation:**
 - Stopped/Halted → Success (VM created, not started)
 - Running → Success (if autostart=true)
-- Provisioning → Wait 5s, check again
+- Provisioning → Wait 5s, check again (max 3 retries, then report status as "still provisioning" and suggest the user check back later)
 - ErrorUnschedulable → Execute diagnostic workflow (Step 5a)
 - ErrorDataVolumeNotReady → Storage issue (see Common Issues)
 

From 34d218bf2fb4d8a60d5b88857109d6bb93086bab Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 10:11:58 +0200
Subject: [PATCH 17/37] fix(rh-virt): RH-VIRT-030 add allowed-tools to
 vm-snapshot-list frontmatter

---
 rh-virt/skills/vm-snapshot-list/SKILL.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rh-virt/skills/vm-snapshot-list/SKILL.md b/rh-virt/skills/vm-snapshot-list/SKILL.md
index e8f52b6b..3e87d30a 100644
--- a/rh-virt/skills/vm-snapshot-list/SKILL.md
+++ b/rh-virt/skills/vm-snapshot-list/SKILL.md
@@ -15,6 +15,7 @@ description: |
 license: Apache-2.0
 model: inherit
 color: cyan
+allowed-tools: mcp__openshift-virtualization__resources_list mcp__openshift-virtualization__resources_get
 ---
 
 # /vm-snapshot-list Skill

From dc1ae2bd3ee9504c99265effe775f1ffcbaa3526 Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 10:12:40 +0200
Subject: [PATCH 18/37] fix(rh-virt): RH-VIRT-023 add allowed-tools to
 vm-create frontmatter

---
 rh-virt/skills/vm-create/SKILL.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rh-virt/skills/vm-create/SKILL.md b/rh-virt/skills/vm-create/SKILL.md
index 5a9c6515..34ec1078 100644
--- a/rh-virt/skills/vm-create/SKILL.md
+++ b/rh-virt/skills/vm-create/SKILL.md
@@ -16,6 +16,7 @@ description: |
 license: Apache-2.0
 model: inherit
 color: green
+allowed-tools: mcp__openshift-virtualization__resources_get mcp__openshift-virtualization__resources_list mcp__openshift-virtualization__resources_create_or_update mcp__openshift-virtualization__namespaces_list mcp__openshift-virtualization__events_list
 ---
 
 # /vm-create Skill

From 5f4f94f65eb308cad716144f0057bf017e48e7e8 Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 10:13:26 +0200
Subject: [PATCH 19/37] fix(rh-virt): RH-VIRT-027 add allowed-tools to
 vm-lifecycle-manager frontmatter

---
 rh-virt/skills/vm-lifecycle-manager/SKILL.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rh-virt/skills/vm-lifecycle-manager/SKILL.md b/rh-virt/skills/vm-lifecycle-manager/SKILL.md
index b7f8ed71..9e1f9b68 100644
--- a/rh-virt/skills/vm-lifecycle-manager/SKILL.md
+++ b/rh-virt/skills/vm-lifecycle-manager/SKILL.md
@@ -16,6 +16,7 @@ description: |
 license: Apache-2.0
 model: inherit
 color: blue
+allowed-tools: mcp__openshift-virtualization__resources_get
 ---
 
 # /vm-lifecycle-manager Skill

From f897e4ac744a9dce3a8d49208e26d406ec9fbd45 Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 10:14:51 +0200
Subject: [PATCH 20/37] fix(rh-virt): RH-VIRT-035 remove unsupported batch
 deletion trigger phrases

---
 rh-virt/skills/vm-snapshot-delete/SKILL.md | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/rh-virt/skills/vm-snapshot-delete/SKILL.md b/rh-virt/skills/vm-snapshot-delete/SKILL.md
index be54231b..30d26931 100644
--- a/rh-virt/skills/vm-snapshot-delete/SKILL.md
+++ b/rh-virt/skills/vm-snapshot-delete/SKILL.md
@@ -54,15 +54,11 @@ Permanently delete virtual machine snapshots in OpenShift Virtualization. Deleti
 ## When to Use This Skill
 
 **Trigger this skill when:**
-- User wants to free storage by removing old snapshots
-- User wants to delete a specific snapshot
-- User wants to implement snapshot retention policies
+- User wants to delete a specific snapshot by name
 
 **User phrases that trigger this skill:**
 - "Delete snapshot pre-upgrade-backup"
-- "Remove old snapshots for VM database-01"
-- "Delete all snapshots older than 7 days"
-- "Free up snapshot storage"
+- "Remove snapshot pre-upgrade-backup in production"
 
 **Do NOT use this skill when:**
 - User wants to create snapshots → Use `vm-snapshot-create` skill

From 0912ca72fc604c8f6cf339b51ce498404962a30f Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 10:15:50 +0200
Subject: [PATCH 21/37] fix(rh-virt): RH-VIRT-038 limit batch cloning to 5 with
 per-VM confirmation

---
 rh-virt/skills/vm-clone/SKILL.md | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/rh-virt/skills/vm-clone/SKILL.md b/rh-virt/skills/vm-clone/SKILL.md
index 5bc3a990..e6d42788 100644
--- a/rh-virt/skills/vm-clone/SKILL.md
+++ b/rh-virt/skills/vm-clone/SKILL.md
@@ -275,8 +275,8 @@ Would you like help troubleshooting this error?
 
 ### Batch Cloning
 **User request:** "Create 3 copies of template-vm named web-01, web-02, web-03"
-**Workflow**: Validate source once, generate/check target names, present combined scope, ask storage strategy, confirm, execute sequentially
-**Batch confirmation**: Show source, targets list, strategy, total impact (VMs, storage, vCPU, memory), estimated time
+**Limit**: Maximum 5 clones per batch request. If user requests more, refuse and explain the limit exists to prevent resource exhaustion.
+**Workflow**: Validate source once, generate/check target names, ask storage strategy once, then process each clone individually through Steps 3-5 with separate confirmation per VM. Stop on first failure.
 
 ### Cross-Namespace Cloning
 **User request:** "Clone production-vm from production to staging namespace"
@@ -417,17 +417,22 @@ Agent: "✓ VM Cloned Successfully"
 ```
 User: "Create 3 copies of template-vm named web-01, web-02, web-03 in production"
 
-Agent: [Validates source, checks all names, presents batch review]
-       "Source: template-vm, Targets: 3 VMs (web-01, web-02, web-03)"
-       "Total Impact: 90Gi, 6 vCPU, 12Gi, ~20-30 min"
-       "Proceed? (yes/no)"
+Agent: [Validates source, checks all names, asks storage strategy once]
+       "Storage strategy for all clones: Clone Storage (1)"
 
+       ## Clone 1 of 3: web-01
+       "Source: template-vm → Target: web-01 (production), 30Gi clone"
+       "Proceed with VM cloning? (yes/no)"
+User: "yes"
+Agent: "✓ web-01 cloned"
+
+       ## Clone 2 of 3: web-02
+       "Source: template-vm → Target: web-02 (production), 30Gi clone"
+       "Proceed with VM cloning? (yes/no)"
 User: "yes"
+Agent: "✓ web-02 cloned"
 
-Agent: "📦 Cloning VM 1 of 3: web-01... ✓"
-       "📦 Cloning VM 2 of 3: web-02... ✓"
-       "📦 Cloning VM 3 of 3: web-03... ✓"
-       "✓ Batch Cloning Completed - 3 VMs, 90Gi storage, all Stopped"
+       [... repeats for each VM with individual confirmation ...]
 ```
 
 ### Example 4: Shared Storage Warning

From 8fbd9a52eefae689027901b03bcd276df9f21b3e Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 10:16:23 +0200
Subject: [PATCH 22/37] fix(rh-virt): RH-VIRT-040 add allowed-tools to
 vm-snapshot-restore frontmatter

---
 rh-virt/skills/vm-snapshot-restore/SKILL.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rh-virt/skills/vm-snapshot-restore/SKILL.md b/rh-virt/skills/vm-snapshot-restore/SKILL.md
index 05f70803..55145b82 100644
--- a/rh-virt/skills/vm-snapshot-restore/SKILL.md
+++ b/rh-virt/skills/vm-snapshot-restore/SKILL.md
@@ -15,6 +15,7 @@ description: |
 license: Apache-2.0
 model: inherit
 color: red
+allowed-tools: mcp__openshift-virtualization__resources_create_or_update mcp__openshift-virtualization__resources_get
 ---
 
 # /vm-snapshot-restore Skill

From 005cc00543f374d23e5ebbfa0a68cedb1b494159 Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 10:16:46 +0200
Subject: [PATCH 23/37] fix(rh-virt): RH-VIRT-041 narrow activation phrases to
 explicit snapshot restore

---
 rh-virt/skills/vm-snapshot-restore/SKILL.md | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/rh-virt/skills/vm-snapshot-restore/SKILL.md b/rh-virt/skills/vm-snapshot-restore/SKILL.md
index 55145b82..0c8fefd7 100644
--- a/rh-virt/skills/vm-snapshot-restore/SKILL.md
+++ b/rh-virt/skills/vm-snapshot-restore/SKILL.md
@@ -44,14 +44,11 @@ Restore virtual machines from snapshots in OpenShift Virtualization. **CRITICAL*
 ## When to Use This Skill
 
 **Trigger this skill when:**
-- User wants to restore a VM to a previous state
-- User wants to recover from failed changes/upgrades
-- User explicitly requests snapshot restore
+- User explicitly requests restoring a VM from a named snapshot
 
 **User phrases that trigger this skill:**
 - "Restore VM api-server from snapshot snapshot-20240115"
-- "Roll back database-01 to pre-upgrade snapshot"
-- "Recover VM web-server from backup"
+- "Roll back database-01 to snapshot pre-upgrade"
 
 **Do NOT use this skill when:**
 - User wants to create snapshots → Use `vm-snapshot-create` skill

From 33f6d333f12a22a6eb5207578c54c989c5989fbe Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 10:19:22 +0200
Subject: [PATCH 24/37] chore: make allowed-tools a required field in skill
 linter

---
 .../skill-linter/scripts/validate-skill.sh    | 23 +++++++++++--------
 rh-virt/skills/vm-clone/SKILL.md              |  1 +
 rh-virt/skills/vm-inventory/SKILL.md          |  1 +
 3 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/.claude/skills/skill-linter/scripts/validate-skill.sh b/.claude/skills/skill-linter/scripts/validate-skill.sh
index 34f014a4..80f46a77 100755
--- a/.claude/skills/skill-linter/scripts/validate-skill.sh
+++ b/.claude/skills/skill-linter/scripts/validate-skill.sh
@@ -158,9 +158,21 @@ if [ -n "$COMPAT" ]; then
   pass "Compatibility valid ($COMPAT_LEN chars)"
 fi
 
-# Check allowed-tools (if present)
+# Check allowed-tools (required)
 TOOLS=$(echo "$FRONTMATTER" | grep '^allowed-tools:' | sed 's/^allowed-tools:[[:space:]]*//' || true)
-if [ -n "$TOOLS" ]; then
+if [ -z "$TOOLS" ]; then
+  # Check for YAML multi-line array (allowed-tools:\n  - item)
+  if echo "$FRONTMATTER" | grep -q '^allowed-tools:$'; then
+    NEXT_LINE=$(echo "$FRONTMATTER" | grep -A1 '^allowed-tools:$' | sed -n '2p')
+    if echo "$NEXT_LINE" | grep -qE '^[[:space:]]*-[[:space:]]'; then
+      fail "allowed-tools must be space-delimited, not YAML array"
+    else
+      fail "Missing required field: allowed-tools (must list permitted tools)"
+    fi
+  else
+    fail "Missing required field: allowed-tools (must list permitted tools)"
+  fi
+else
   # FAIL if commas found (must be space-delimited)
   if echo "$TOOLS" | grep -qE ','; then
     fail "allowed-tools must be space-delimited, not comma-separated: $TOOLS"
@@ -171,13 +183,6 @@ if [ -n "$TOOLS" ]; then
     pass "Allowed-tools field valid"
   fi
 fi
-# FAIL if YAML multi-line array detected (allowed-tools:\n  - item)
-if echo "$FRONTMATTER" | grep -q '^allowed-tools:$'; then
-  NEXT_LINE=$(echo "$FRONTMATTER" | grep -A1 '^allowed-tools:$' | sed -n '2p')
-  if echo "$NEXT_LINE" | grep -qE '^[[:space:]]*-[[:space:]]'; then
-    fail "allowed-tools must be space-delimited, not YAML array"
-  fi
-fi
 
 # 8. Check line count (max 500)
 LINE_COUNT=$(wc -l < "$SKILL_FILE" | tr -d ' ')
diff --git a/rh-virt/skills/vm-clone/SKILL.md b/rh-virt/skills/vm-clone/SKILL.md
index e6d42788..1df5e5e5 100644
--- a/rh-virt/skills/vm-clone/SKILL.md
+++ b/rh-virt/skills/vm-clone/SKILL.md
@@ -16,6 +16,7 @@ description: |
 license: Apache-2.0
 model: inherit
 color: blue
+allowed-tools: mcp__openshift-virtualization__resources_get mcp__openshift-virtualization__resources_create_or_update mcp__openshift-virtualization__resources_list
 ---
 
 # /vm-clone Skill
diff --git a/rh-virt/skills/vm-inventory/SKILL.md b/rh-virt/skills/vm-inventory/SKILL.md
index 28fdf90c..c3d2e9bb 100644
--- a/rh-virt/skills/vm-inventory/SKILL.md
+++ b/rh-virt/skills/vm-inventory/SKILL.md
@@ -16,6 +16,7 @@ description: |
 license: Apache-2.0
 model: inherit
 color: cyan
+allowed-tools: mcp__openshift-virtualization__resources_list mcp__openshift-virtualization__resources_get
 ---
 
 # /vm-inventory Skill

From 20cf8bd5a3259ae4123857243c9efca45d927f76 Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 10:33:10 +0200
Subject: [PATCH 25/37] fix(rh-virt): RH-VIRT-043 add missing vm_lifecycle to
 vm-rebalance allowed-tools

---
 rh-virt/skills/vm-rebalance/SKILL.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rh-virt/skills/vm-rebalance/SKILL.md b/rh-virt/skills/vm-rebalance/SKILL.md
index 7a7d5484..b68b209c 100644
--- a/rh-virt/skills/vm-rebalance/SKILL.md
+++ b/rh-virt/skills/vm-rebalance/SKILL.md
@@ -16,7 +16,7 @@ description: |
 license: Apache-2.0
 model: inherit
 color: yellow
-allowed-tools: mcp__openshift-virtualization__resources_list mcp__openshift-virtualization__resources_get mcp__openshift-virtualization__resources_create_or_update mcp__openshift-virtualization__nodes_top mcp__openshift-virtualization__pods_top mcp__openshift-virtualization__nodes_stats_summary
+allowed-tools: mcp__openshift-virtualization__resources_list mcp__openshift-virtualization__resources_get mcp__openshift-virtualization__resources_create_or_update mcp__openshift-virtualization__vm_lifecycle mcp__openshift-virtualization__nodes_top mcp__openshift-virtualization__pods_top mcp__openshift-virtualization__nodes_stats_summary
 ---
 
 # /vm-rebalance Skill

From 4355592e0de1c0cf386df75876c997c09f69b5db Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 10:36:07 +0200
Subject: [PATCH 26/37] fix(rh-virt): RH-VIRT-044 add quota check before
 cloning to prevent resource exhaustion

---
 rh-virt/skills/vm-clone/SKILL.md | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/rh-virt/skills/vm-clone/SKILL.md b/rh-virt/skills/vm-clone/SKILL.md
index 1df5e5e5..8e3e8136 100644
--- a/rh-virt/skills/vm-clone/SKILL.md
+++ b/rh-virt/skills/vm-clone/SKILL.md
@@ -152,7 +152,11 @@ Parse: Extract storage names, calculate size, determine DataSources vs container
 
 **Option 2 warning**: `⚠️ Shared Storage Dangerous - Both VMs share disk, data corruption risk. Only safe if source stopped. Use Option 1 instead. Proceed anyway? (yes/cancel)` Wait for explicit "yes".
 
-### Step 3: Present Clone Configuration for Confirmation
+### Step 3: Check Namespace Quota and Present Clone Configuration
+
+**3.0: Check ResourceQuota** (before presenting confirmation)
+
+Use `resources_list` (apiVersion="v1", kind="ResourceQuota", namespace=`<target-namespace>`) to check if quotas exist. If a quota is found, compare current usage against limits for CPU, memory, and storage. If the clone would push usage above 80% of any limit, include a warning in the confirmation summary.
 
 **Present configuration summary:**
 

From 1aac7d50ce1f608ef76ef9525d34e31eed732021 Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 10:37:38 +0200
Subject: [PATCH 27/37] fix(rh-virt): RH-VIRT-045 add missing vm_lifecycle to
 vm-snapshot-restore allowed-tools

---
 rh-virt/skills/vm-snapshot-restore/SKILL.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rh-virt/skills/vm-snapshot-restore/SKILL.md b/rh-virt/skills/vm-snapshot-restore/SKILL.md
index 0c8fefd7..9f4928e8 100644
--- a/rh-virt/skills/vm-snapshot-restore/SKILL.md
+++ b/rh-virt/skills/vm-snapshot-restore/SKILL.md
@@ -15,7 +15,7 @@ description: |
 license: Apache-2.0
 model: inherit
 color: red
-allowed-tools: mcp__openshift-virtualization__resources_create_or_update mcp__openshift-virtualization__resources_get
+allowed-tools: mcp__openshift-virtualization__resources_create_or_update mcp__openshift-virtualization__resources_get mcp__openshift-virtualization__vm_lifecycle
 ---
 
 # /vm-snapshot-restore Skill

From 815445cbf7659718770298b77903ae91325f28cb Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 10:38:29 +0200
Subject: [PATCH 28/37] fix(rh-virt): RH-VIRT-046 add missing vm_lifecycle to
 vm-lifecycle-manager allowed-tools

---
 rh-virt/skills/vm-lifecycle-manager/SKILL.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rh-virt/skills/vm-lifecycle-manager/SKILL.md b/rh-virt/skills/vm-lifecycle-manager/SKILL.md
index 9e1f9b68..9ef1c716 100644
--- a/rh-virt/skills/vm-lifecycle-manager/SKILL.md
+++ b/rh-virt/skills/vm-lifecycle-manager/SKILL.md
@@ -16,7 +16,7 @@ description: |
 license: Apache-2.0
 model: inherit
 color: blue
-allowed-tools: mcp__openshift-virtualization__resources_get
+allowed-tools: mcp__openshift-virtualization__resources_get mcp__openshift-virtualization__vm_lifecycle
 ---
 
 # /vm-lifecycle-manager Skill

From 9c06227bfa870d3b7ecfa0b01c0635295650c95d Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 10:41:16 +0200
Subject: [PATCH 29/37] fix(rh-virt): RH-VIRT-047 add missing vm_create and
 vm_lifecycle to vm-create allowed-tools

---
 rh-virt/skills/vm-create/SKILL.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rh-virt/skills/vm-create/SKILL.md b/rh-virt/skills/vm-create/SKILL.md
index 34ec1078..f1d5ec9f 100644
--- a/rh-virt/skills/vm-create/SKILL.md
+++ b/rh-virt/skills/vm-create/SKILL.md
@@ -16,7 +16,7 @@ description: |
 license: Apache-2.0
 model: inherit
 color: green
-allowed-tools: mcp__openshift-virtualization__resources_get mcp__openshift-virtualization__resources_list mcp__openshift-virtualization__resources_create_or_update mcp__openshift-virtualization__namespaces_list mcp__openshift-virtualization__events_list
+allowed-tools: mcp__openshift-virtualization__resources_get mcp__openshift-virtualization__resources_list mcp__openshift-virtualization__resources_create_or_update mcp__openshift-virtualization__namespaces_list mcp__openshift-virtualization__events_list mcp__openshift-virtualization__vm_create mcp__openshift-virtualization__vm_lifecycle
 ---
 
 # /vm-create Skill

From 8d61619ff14626208175bab467f1d8e92302d057 Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 10:41:53 +0200
Subject: [PATCH 30/37] fix(rh-virt): RH-VIRT-048 remove Read tool injection
 and fix relative paths in vm-create

---
 rh-virt/skills/vm-create/SKILL.md | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/rh-virt/skills/vm-create/SKILL.md b/rh-virt/skills/vm-create/SKILL.md
index f1d5ec9f..5e306d69 100644
--- a/rh-virt/skills/vm-create/SKILL.md
+++ b/rh-virt/skills/vm-create/SKILL.md
@@ -172,9 +172,7 @@ Confirm: yes/no/modify
 
 #### 5a. Diagnostic Workflow (ErrorUnschedulable)
 
-**CRITICAL: Document Consultation FIRST:**
-1. Read [scheduling-errors.md](../../docs/troubleshooting/scheduling-errors.md) using Read tool
-2. Output: "I detected ErrorUnschedulable. I consulted [scheduling-errors.md] to understand diagnosis strategies."
+**Reference**: See [scheduling-errors.md](rh-virt/docs/troubleshooting/scheduling-errors.md) for diagnosis strategies.
 
 **Gather diagnostics:**
 - List events: `events_list` (namespace=`<namespace>`) → Filter for VM/VMI
@@ -298,11 +296,11 @@ Troubleshooting: See Common Issues
 - `vm-lifecycle-manager` - Start VMs | `vm-inventory` - List VMs | `vm-delete` - Delete VMs | `vm-clone` - Clone VMs | `vm-snapshot-create` - Snapshot VMs
 
 ### Reference Documentation
-- [scheduling-errors.md](../../docs/troubleshooting/scheduling-errors.md) - ErrorUnschedulable (consulted Step 5a)
-- [storage-errors.md](../../docs/troubleshooting/storage-errors.md) - ErrorDataVolumeNotReady
-- [network-errors.md](../../docs/troubleshooting/network-errors.md) - Network failures
-- [runtime-errors.md](../../docs/troubleshooting/runtime-errors.md) - CrashLoopBackOff
-- [Troubleshooting INDEX](../../docs/troubleshooting/INDEX.md) - Full error index
+- [scheduling-errors.md](rh-virt/docs/troubleshooting/scheduling-errors.md) - ErrorUnschedulable (consulted Step 5a)
+- [storage-errors.md](rh-virt/docs/troubleshooting/storage-errors.md) - ErrorDataVolumeNotReady
+- [network-errors.md](rh-virt/docs/troubleshooting/network-errors.md) - Network failures
+- [runtime-errors.md](rh-virt/docs/troubleshooting/runtime-errors.md) - CrashLoopBackOff
+- [Troubleshooting INDEX](rh-virt/docs/troubleshooting/INDEX.md) - Full error index
 - [OpenShift Virt Docs](https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/virtualization/index)
 - [KubeVirt API](https://kubevirt.io/api-reference/)
 - [OpenShift MCP](https://github.com/openshift/openshift-mcp-server)

From 87dea0fb0dd497aaf4a3da0757e3be2255f971a9 Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 10:47:27 +0200
Subject: [PATCH 31/37] fix(rh-virt): RH-VIRT-050 restore Document Consultation
 pattern in vm-rebalance

---
 rh-virt/skills/vm-rebalance/SKILL.md | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/rh-virt/skills/vm-rebalance/SKILL.md b/rh-virt/skills/vm-rebalance/SKILL.md
index b68b209c..4db3b717 100644
--- a/rh-virt/skills/vm-rebalance/SKILL.md
+++ b/rh-virt/skills/vm-rebalance/SKILL.md
@@ -90,13 +90,19 @@ Orchestrate VM migrations across OpenShift cluster nodes for load balancing, mai
 
 **For Manual Mode:**
 
-Follow the workflow defined in [REBALANCE_MANUAL.md](rh-virt/skills/vm-rebalance/REBALANCE_MANUAL.md).
+**Document Consultation** (REQUIRED - Execute FIRST):
+1. **Action**: Read [REBALANCE_MANUAL.md](rh-virt/skills/vm-rebalance/REBALANCE_MANUAL.md) using Read tool
+2. **Output to user**: "I consulted [REBALANCE_MANUAL.md](rh-virt/skills/vm-rebalance/REBALANCE_MANUAL.md) to understand the manual migration workflow."
+3. **Then execute**: Follow workflow in REBALANCE_MANUAL.md
 
 ---
 
 **For Automatic Mode:**
 
-Follow the workflow defined in [REBALANCE_AUTOMATIC.md](rh-virt/skills/vm-rebalance/REBALANCE_AUTOMATIC.md).
+**Document Consultation** (REQUIRED - Execute FIRST):
+1. **Action**: Read [REBALANCE_AUTOMATIC.md](rh-virt/skills/vm-rebalance/REBALANCE_AUTOMATIC.md) using Read tool
+2. **Output to user**: "I consulted [REBALANCE_AUTOMATIC.md](rh-virt/skills/vm-rebalance/REBALANCE_AUTOMATIC.md) to understand the automatic rebalancing workflow."
+3. **Then execute**: Follow workflow in REBALANCE_AUTOMATIC.md
 
 ## Common Validation Logic
 

From 4e24523abaf88f209527b2e07a5f224371a8c02e Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 10:47:55 +0200
Subject: [PATCH 32/37] fix(rh-virt): RH-VIRT-051 align VMI query threshold to
 20 in vm-inventory

---
 rh-virt/skills/vm-inventory/SKILL.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rh-virt/skills/vm-inventory/SKILL.md b/rh-virt/skills/vm-inventory/SKILL.md
index c3d2e9bb..9553a043 100644
--- a/rh-virt/skills/vm-inventory/SKILL.md
+++ b/rh-virt/skills/vm-inventory/SKILL.md
@@ -91,7 +91,7 @@ List and inspect virtual machines in OpenShift Virtualization clusters. This ski
 
 **Large cluster safeguard**: If Step 1 returned more than 20 VMs, skip VMI queries entirely. Display a summary table using only VM resource data (Name, Namespace, Status) and suggest the user narrow down by namespace: `⚠️ Found <N> VMs across all namespaces. Showing summary view. Use "List VMs in namespace <ns>" for full details.`
 
-To display complete VM information (when 50 or fewer VMs), query VirtualMachineInstance (VMI) resources:
+To display complete VM information (when 20 or fewer VMs), query VirtualMachineInstance (VMI) resources:
 
 **MCP Tool**: `resources_list` (apiVersion="kubevirt.io/v1", kind="VirtualMachineInstance")
 

From e9a498c05c89cd62ba72197bea62bbba379b46d1 Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 11:00:31 +0200
Subject: [PATCH 33/37] feat(workflows): add iteration history and thumbs
 up/down reactions

---
 .github/workflows/skill-code-review.yml   | 56 +++++++++++++----
 .github/workflows/skill-security-scan.yml | 73 +++++++++++++++++++----
 2 files changed, 109 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/skill-code-review.yml b/.github/workflows/skill-code-review.yml
index 88f8d228..cc2a1367 100644
--- a/.github/workflows/skill-code-review.yml
+++ b/.github/workflows/skill-code-review.yml
@@ -297,9 +297,28 @@ jobs:
           set -euo pipefail
           MARKER="<!-- gemini-code-review -->"
           WORKFLOW_URL="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+          TIMESTAMP=$(date -u '+%Y-%m-%d %H:%M UTC')
+
+          EXISTING_COMMENT_ID=$(gh api --paginate \
+            "/repos/${{ github.repository }}/issues/${PR_NUMBER}/comments" \
+            --jq ".[] | select(.body | startswith(\"$MARKER\")) | .id" \
+            | head -1)
+
+          EXISTING_BODY=""
+          RUN_NUMBER=1
+          if [ -n "$EXISTING_COMMENT_ID" ]; then
+            EXISTING_BODY=$(gh api \
+              "/repos/${{ github.repository }}/issues/comments/$EXISTING_COMMENT_ID" \
+              --jq '.body')
+            RUN_NUMBER=$(( $(echo "$EXISTING_BODY" | grep -c '### 🔄 Run #' || true) + 1 ))
+          fi
 
           {
-            echo "$MARKER"
+            if [ "$RUN_NUMBER" -eq 1 ]; then
+              echo "$MARKER"
+            fi
+            echo "### 🔄 Run #${RUN_NUMBER} — ${TIMESTAMP}"
+            echo ""
             echo "## Gemini Code Review"
             echo ""
 
@@ -317,21 +336,38 @@ jobs:
             fi
 
             echo ""
-            echo "---"
             echo "> [Workflow run]($WORKFLOW_URL)"
-          } > /tmp/comment.md
-
-          EXISTING_COMMENT_ID=$(gh api --paginate \
-            "/repos/${{ github.repository }}/issues/${PR_NUMBER}/comments" \
-            --jq ".[] | select(.body | startswith(\"$MARKER\")) | .id" \
-            | head -1)
+          } > /tmp/new_report.md
 
           if [ -n "$EXISTING_COMMENT_ID" ]; then
-            gh api --method PATCH \
+            {
+              echo "$EXISTING_BODY"
+              echo ""
+              echo "---"
+              echo ""
+              cat /tmp/new_report.md
+            } > /tmp/comment.md
+            gh api \
+              --method PATCH \
               "/repos/${{ github.repository }}/issues/comments/$EXISTING_COMMENT_ID" \
               -f body="$(cat /tmp/comment.md)"
           else
             gh pr comment "$PR_NUMBER" \
               --repo "${{ github.repository }}" \
-              --body-file /tmp/comment.md
+              --body-file /tmp/new_report.md
           fi
+
+      - name: React to PR
+        if: always()
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const result = '${{ job.status }}';
+            const prNumber = Number('${{ steps.inputs.outputs.pr_number }}');
+            await github.rest.reactions.createForIssue({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: prNumber,
+              content: result === 'success' ? '+1' : '-1'
+            });
+
diff --git a/.github/workflows/skill-security-scan.yml b/.github/workflows/skill-security-scan.yml
index 81333e3d..64d2c265 100644
--- a/.github/workflows/skill-security-scan.yml
+++ b/.github/workflows/skill-security-scan.yml
@@ -220,6 +220,7 @@ jobs:
               --recursive \
               --use-behavioral \
               --use-llm \
+              --llm-consensus-runs 3 \
               --check-overlap \
               --enable-meta \
               --fail-on-severity medium \
@@ -237,6 +238,7 @@ jobs:
           fi
 
       - name: Upload security reports
+        id: upload
         if: steps.detect.outputs.pack_count != '0' && steps.creds.outputs.available == 'true' && always()
         uses: actions/upload-artifact@v4
         with:
@@ -257,6 +259,8 @@ jobs:
           set -euo pipefail
           MARKER="<!-- skill-security-scan -->"
           SCAN_RESULT="${{ steps.scan.outputs.scan_result }}"
+          ARTIFACT_URL="${{ steps.upload.outputs.artifact-url }}"
+          TIMESTAMP=$(date -u '+%Y-%m-%d %H:%M UTC')
 
           if [ "$SCAN_RESULT" = "passed" ]; then
             ICON="✅"
@@ -264,8 +268,26 @@ jobs:
             ICON="❌"
           fi
 
+          EXISTING_COMMENT_ID=$(gh api --paginate \
+            "/repos/${{ github.repository }}/issues/${PR_NUMBER}/comments" \
+            --jq ".[] | select(.body | startswith(\"$MARKER\")) | .id" \
+            | head -1)
+
+          EXISTING_BODY=""
+          RUN_NUMBER=1
+          if [ -n "$EXISTING_COMMENT_ID" ]; then
+            EXISTING_BODY=$(gh api \
+              "/repos/${{ github.repository }}/issues/comments/$EXISTING_COMMENT_ID" \
+              --jq '.body')
+            RUN_NUMBER=$(( $(echo "$EXISTING_BODY" | grep -c '### 🔄 Run #' || true) + 1 ))
+          fi
+
           {
-            echo "$MARKER"
+            if [ "$RUN_NUMBER" -eq 1 ]; then
+              echo "$MARKER"
+            fi
+            echo "### 🔄 Run #${RUN_NUMBER} — ${TIMESTAMP}"
+            echo ""
             echo "## $ICON Skill Security Scan"
             echo ""
 
@@ -286,20 +308,51 @@ jobs:
             fi
 
             echo ""
-            echo "> [Workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})"
-          } > /tmp/comment.md
-
-          EXISTING_COMMENT_ID=$(gh api --paginate \
-            "/repos/${{ github.repository }}/issues/${PR_NUMBER}/comments" \
-            --jq ".[] | select(.body | startswith(\"$MARKER\")) | .id" \
-            | head -1)
+            if [ -n "$ARTIFACT_URL" ]; then
+              echo "> 📦 [Download security reports]($ARTIFACT_URL) | [Workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})"
+            else
+              echo "> [Workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})"
+            fi
+          } > /tmp/new_report.md
 
           if [ -n "$EXISTING_COMMENT_ID" ]; then
-            gh api --method PATCH \
+            {
+              echo "$EXISTING_BODY"
+              echo ""
+              echo "---"
+              echo ""
+              cat /tmp/new_report.md
+            } > /tmp/comment.md
+            gh api \
+              --method PATCH \
               "/repos/${{ github.repository }}/issues/comments/$EXISTING_COMMENT_ID" \
               -f body="$(cat /tmp/comment.md)"
           else
             gh pr comment "$PR_NUMBER" \
               --repo "${{ github.repository }}" \
-              --body-file /tmp/comment.md
+              --body-file /tmp/new_report.md
+          fi
+
+      - name: Check scan results
+        if: steps.detect.outputs.pack_count != '0' && steps.creds.outputs.available == 'true'
+        run: |
+          if [ "${{ steps.scan.outputs.scan_result }}" = "failed" ]; then
+            echo "❌ Security scan found MEDIUM or higher severity issues — blocking merge"
+            exit 1
+          else
+            echo "✅ Security scan passed — no MEDIUM or higher severity issues found"
           fi
+
+      - name: React to PR
+        if: always()
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const result = '${{ job.status }}';
+            const prNumber = Number('${{ steps.inputs.outputs.pr_number }}');
+            await github.rest.reactions.createForIssue({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: prNumber,
+              content: result === 'success' ? '+1' : '-1'
+            });

From e305fe27fcb6cc9c3ec7f0b73b8d28cdb6d52ee2 Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 11:18:43 +0200
Subject: [PATCH 34/37] fix(rh-virt): RH-VIRT-052 add missing vm_lifecycle to
 vm-delete allowed-tools

---
 rh-virt/skills/vm-delete/SKILL.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rh-virt/skills/vm-delete/SKILL.md b/rh-virt/skills/vm-delete/SKILL.md
index d512a1cd..84fe31a1 100644
--- a/rh-virt/skills/vm-delete/SKILL.md
+++ b/rh-virt/skills/vm-delete/SKILL.md
@@ -16,7 +16,7 @@ description: |
 license: Apache-2.0
 model: inherit
 color: red
-allowed-tools: mcp__openshift-virtualization__resources_get mcp__openshift-virtualization__resources_delete mcp__openshift-virtualization__resources_list mcp__openshift-virtualization__resources_create_or_update mcp__openshift-virtualization__pods_list_in_namespace
+allowed-tools: mcp__openshift-virtualization__resources_get mcp__openshift-virtualization__resources_delete mcp__openshift-virtualization__resources_list mcp__openshift-virtualization__resources_create_or_update mcp__openshift-virtualization__pods_list_in_namespace mcp__openshift-virtualization__vm_lifecycle
 ---
 
 # /vm-delete Skill

From 1bb07c97af5e557d1b4b7a5bcc4cce4619a86183 Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 17:42:03 +0200
Subject: [PATCH 35/37] chore(rh-virt): Returned back to ecosystem-eng
 Openshift MCP server version

Signed-off-by: r2dedios <alex.ansi.c@gmail.com>
---
 rh-virt/mcps.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rh-virt/mcps.json b/rh-virt/mcps.json
index 22f6d970..74a95e99 100644
--- a/rh-virt/mcps.json
+++ b/rh-virt/mcps.json
@@ -9,8 +9,8 @@
         "--network=host",
         "--userns=keep-id:uid=65532,gid=65532",
         "-v", "${KUBECONFIG}:/kubeconfig:ro,Z",
-        "--entrypoint", "/openshift-mcp-server",
-        "quay.io/redhat-user-workloads/crt-nshift-lightspeed-tenant/openshift-mcp-server@sha256:2f52c860f91ab3c8a5129b727bdef0d620e733013f073b10355866c45eafd053",
+        "--entrypoint", "/app/kubernetes-mcp-server",
+        "quay.io/ecosystem-appeng/openshift-mcp-server@sha256:3531cb78f51f8c7ebcdb21adc21358ab8924116994848a3ce1ff542b3fc23742",
         "--kubeconfig", "/kubeconfig",
         "--toolsets", "core,kubevirt"
       ],

From 8aa94be5eaef2ddf8d3f55a5377a1ee8439898de Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Thu, 7 May 2026 17:52:12 +0200
Subject: [PATCH 36/37] revert(rh-virt): temporarily remove allowed-tools from
 all skills

---
 .claude/skills/skill-linter/scripts/validate-skill.sh | 6 +-----
 rh-virt/skills/vm-clone/SKILL.md                      | 1 -
 rh-virt/skills/vm-create/SKILL.md                     | 1 -
 rh-virt/skills/vm-delete/SKILL.md                     | 1 -
 rh-virt/skills/vm-inventory/SKILL.md                  | 1 -
 rh-virt/skills/vm-lifecycle-manager/SKILL.md          | 1 -
 rh-virt/skills/vm-rebalance/SKILL.md                  | 1 -
 rh-virt/skills/vm-snapshot-create/SKILL.md            | 1 -
 rh-virt/skills/vm-snapshot-delete/SKILL.md            | 1 -
 rh-virt/skills/vm-snapshot-list/SKILL.md              | 1 -
 rh-virt/skills/vm-snapshot-restore/SKILL.md           | 1 -
 11 files changed, 1 insertion(+), 15 deletions(-)

diff --git a/.claude/skills/skill-linter/scripts/validate-skill.sh b/.claude/skills/skill-linter/scripts/validate-skill.sh
index 80f46a77..1d3fe00e 100755
--- a/.claude/skills/skill-linter/scripts/validate-skill.sh
+++ b/.claude/skills/skill-linter/scripts/validate-skill.sh
@@ -158,7 +158,7 @@ if [ -n "$COMPAT" ]; then
   pass "Compatibility valid ($COMPAT_LEN chars)"
 fi
 
-# Check allowed-tools (required)
+# Check allowed-tools (optional)
 TOOLS=$(echo "$FRONTMATTER" | grep '^allowed-tools:' | sed 's/^allowed-tools:[[:space:]]*//' || true)
 if [ -z "$TOOLS" ]; then
   # Check for YAML multi-line array (allowed-tools:\n  - item)
@@ -166,11 +166,7 @@ if [ -z "$TOOLS" ]; then
     NEXT_LINE=$(echo "$FRONTMATTER" | grep -A1 '^allowed-tools:$' | sed -n '2p')
     if echo "$NEXT_LINE" | grep -qE '^[[:space:]]*-[[:space:]]'; then
       fail "allowed-tools must be space-delimited, not YAML array"
-    else
-      fail "Missing required field: allowed-tools (must list permitted tools)"
     fi
-  else
-    fail "Missing required field: allowed-tools (must list permitted tools)"
   fi
 else
   # FAIL if commas found (must be space-delimited)
diff --git a/rh-virt/skills/vm-clone/SKILL.md b/rh-virt/skills/vm-clone/SKILL.md
index 8e3e8136..f19f3719 100644
--- a/rh-virt/skills/vm-clone/SKILL.md
+++ b/rh-virt/skills/vm-clone/SKILL.md
@@ -16,7 +16,6 @@ description: |
 license: Apache-2.0
 model: inherit
 color: blue
-allowed-tools: mcp__openshift-virtualization__resources_get mcp__openshift-virtualization__resources_create_or_update mcp__openshift-virtualization__resources_list
 ---
 
 # /vm-clone Skill
diff --git a/rh-virt/skills/vm-create/SKILL.md b/rh-virt/skills/vm-create/SKILL.md
index 5e306d69..b39c9256 100644
--- a/rh-virt/skills/vm-create/SKILL.md
+++ b/rh-virt/skills/vm-create/SKILL.md
@@ -16,7 +16,6 @@ description: |
 license: Apache-2.0
 model: inherit
 color: green
-allowed-tools: mcp__openshift-virtualization__resources_get mcp__openshift-virtualization__resources_list mcp__openshift-virtualization__resources_create_or_update mcp__openshift-virtualization__namespaces_list mcp__openshift-virtualization__events_list mcp__openshift-virtualization__vm_create mcp__openshift-virtualization__vm_lifecycle
 ---
 
 # /vm-create Skill
diff --git a/rh-virt/skills/vm-delete/SKILL.md b/rh-virt/skills/vm-delete/SKILL.md
index 84fe31a1..e6d2d5f2 100644
--- a/rh-virt/skills/vm-delete/SKILL.md
+++ b/rh-virt/skills/vm-delete/SKILL.md
@@ -16,7 +16,6 @@ description: |
 license: Apache-2.0
 model: inherit
 color: red
-allowed-tools: mcp__openshift-virtualization__resources_get mcp__openshift-virtualization__resources_delete mcp__openshift-virtualization__resources_list mcp__openshift-virtualization__resources_create_or_update mcp__openshift-virtualization__pods_list_in_namespace mcp__openshift-virtualization__vm_lifecycle
 ---
 
 # /vm-delete Skill
diff --git a/rh-virt/skills/vm-inventory/SKILL.md b/rh-virt/skills/vm-inventory/SKILL.md
index 9553a043..8a292540 100644
--- a/rh-virt/skills/vm-inventory/SKILL.md
+++ b/rh-virt/skills/vm-inventory/SKILL.md
@@ -16,7 +16,6 @@ description: |
 license: Apache-2.0
 model: inherit
 color: cyan
-allowed-tools: mcp__openshift-virtualization__resources_list mcp__openshift-virtualization__resources_get
 ---
 
 # /vm-inventory Skill
diff --git a/rh-virt/skills/vm-lifecycle-manager/SKILL.md b/rh-virt/skills/vm-lifecycle-manager/SKILL.md
index 9ef1c716..b7f8ed71 100644
--- a/rh-virt/skills/vm-lifecycle-manager/SKILL.md
+++ b/rh-virt/skills/vm-lifecycle-manager/SKILL.md
@@ -16,7 +16,6 @@ description: |
 license: Apache-2.0
 model: inherit
 color: blue
-allowed-tools: mcp__openshift-virtualization__resources_get mcp__openshift-virtualization__vm_lifecycle
 ---
 
 # /vm-lifecycle-manager Skill
diff --git a/rh-virt/skills/vm-rebalance/SKILL.md b/rh-virt/skills/vm-rebalance/SKILL.md
index 4db3b717..de3b62dc 100644
--- a/rh-virt/skills/vm-rebalance/SKILL.md
+++ b/rh-virt/skills/vm-rebalance/SKILL.md
@@ -16,7 +16,6 @@ description: |
 license: Apache-2.0
 model: inherit
 color: yellow
-allowed-tools: mcp__openshift-virtualization__resources_list mcp__openshift-virtualization__resources_get mcp__openshift-virtualization__resources_create_or_update mcp__openshift-virtualization__vm_lifecycle mcp__openshift-virtualization__nodes_top mcp__openshift-virtualization__pods_top mcp__openshift-virtualization__nodes_stats_summary
 ---
 
 # /vm-rebalance Skill
diff --git a/rh-virt/skills/vm-snapshot-create/SKILL.md b/rh-virt/skills/vm-snapshot-create/SKILL.md
index 855d3d43..1f3fe984 100644
--- a/rh-virt/skills/vm-snapshot-create/SKILL.md
+++ b/rh-virt/skills/vm-snapshot-create/SKILL.md
@@ -15,7 +15,6 @@ description: |
 license: Apache-2.0
 model: inherit
 color: green
-allowed-tools: mcp__openshift-virtualization__resources_create_or_update mcp__openshift-virtualization__resources_get mcp__openshift-virtualization__resources_list
 ---
 
 # /vm-snapshot-create Skill
diff --git a/rh-virt/skills/vm-snapshot-delete/SKILL.md b/rh-virt/skills/vm-snapshot-delete/SKILL.md
index 30d26931..f7c292ad 100644
--- a/rh-virt/skills/vm-snapshot-delete/SKILL.md
+++ b/rh-virt/skills/vm-snapshot-delete/SKILL.md
@@ -15,7 +15,6 @@ description: |
 license: Apache-2.0
 model: inherit
 color: yellow
-allowed-tools: mcp__openshift-virtualization__resources_get mcp__openshift-virtualization__resources_list mcp__openshift-virtualization__resources_delete
 ---
 
 # /vm-snapshot-delete Skill
diff --git a/rh-virt/skills/vm-snapshot-list/SKILL.md b/rh-virt/skills/vm-snapshot-list/SKILL.md
index 3e87d30a..e8f52b6b 100644
--- a/rh-virt/skills/vm-snapshot-list/SKILL.md
+++ b/rh-virt/skills/vm-snapshot-list/SKILL.md
@@ -15,7 +15,6 @@ description: |
 license: Apache-2.0
 model: inherit
 color: cyan
-allowed-tools: mcp__openshift-virtualization__resources_list mcp__openshift-virtualization__resources_get
 ---
 
 # /vm-snapshot-list Skill
diff --git a/rh-virt/skills/vm-snapshot-restore/SKILL.md b/rh-virt/skills/vm-snapshot-restore/SKILL.md
index 9f4928e8..cd3f395f 100644
--- a/rh-virt/skills/vm-snapshot-restore/SKILL.md
+++ b/rh-virt/skills/vm-snapshot-restore/SKILL.md
@@ -15,7 +15,6 @@ description: |
 license: Apache-2.0
 model: inherit
 color: red
-allowed-tools: mcp__openshift-virtualization__resources_create_or_update mcp__openshift-virtualization__resources_get mcp__openshift-virtualization__vm_lifecycle
 ---
 
 # /vm-snapshot-restore Skill

From 2ec70bbb612b5a17e7f3474fc425561b0c5ebe1a Mon Sep 17 00:00:00 2001
From: r2dedios <alex.ansi.c@gmail.com>
Date: Fri, 8 May 2026 14:38:30 +0200
Subject: [PATCH 37/37] revert(rh-virt): restore relative paths in skill
 documentation links

---
 rh-virt/skills/vm-create/SKILL.md    | 12 ++++----
 rh-virt/skills/vm-rebalance/SKILL.md | 46 ++++++++++++++--------------
 2 files changed, 29 insertions(+), 29 deletions(-)

diff --git a/rh-virt/skills/vm-create/SKILL.md b/rh-virt/skills/vm-create/SKILL.md
index b39c9256..8afe1430 100644
--- a/rh-virt/skills/vm-create/SKILL.md
+++ b/rh-virt/skills/vm-create/SKILL.md
@@ -171,7 +171,7 @@ Confirm: yes/no/modify
 
 #### 5a. Diagnostic Workflow (ErrorUnschedulable)
 
-**Reference**: See [scheduling-errors.md](rh-virt/docs/troubleshooting/scheduling-errors.md) for diagnosis strategies.
+**Reference**: See [scheduling-errors.md](../../docs/troubleshooting/scheduling-errors.md) for diagnosis strategies.
 
 **Gather diagnostics:**
 - List events: `events_list` (namespace=`<namespace>`) → Filter for VM/VMI
@@ -295,11 +295,11 @@ Troubleshooting: See Common Issues
 - `vm-lifecycle-manager` - Start VMs | `vm-inventory` - List VMs | `vm-delete` - Delete VMs | `vm-clone` - Clone VMs | `vm-snapshot-create` - Snapshot VMs
 
 ### Reference Documentation
-- [scheduling-errors.md](rh-virt/docs/troubleshooting/scheduling-errors.md) - ErrorUnschedulable (consulted Step 5a)
-- [storage-errors.md](rh-virt/docs/troubleshooting/storage-errors.md) - ErrorDataVolumeNotReady
-- [network-errors.md](rh-virt/docs/troubleshooting/network-errors.md) - Network failures
-- [runtime-errors.md](rh-virt/docs/troubleshooting/runtime-errors.md) - CrashLoopBackOff
-- [Troubleshooting INDEX](rh-virt/docs/troubleshooting/INDEX.md) - Full error index
+- [scheduling-errors.md](../../docs/troubleshooting/scheduling-errors.md) - ErrorUnschedulable (consulted Step 5a)
+- [storage-errors.md](../../docs/troubleshooting/storage-errors.md) - ErrorDataVolumeNotReady
+- [network-errors.md](../../docs/troubleshooting/network-errors.md) - Network failures
+- [runtime-errors.md](../../docs/troubleshooting/runtime-errors.md) - CrashLoopBackOff
+- [Troubleshooting INDEX](../../docs/troubleshooting/INDEX.md) - Full error index
 - [OpenShift Virt Docs](https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/virtualization/index)
 - [KubeVirt API](https://kubevirt.io/api-reference/)
 - [OpenShift MCP](https://github.com/openshift/openshift-mcp-server)
diff --git a/rh-virt/skills/vm-rebalance/SKILL.md b/rh-virt/skills/vm-rebalance/SKILL.md
index de3b62dc..af1e04ee 100644
--- a/rh-virt/skills/vm-rebalance/SKILL.md
+++ b/rh-virt/skills/vm-rebalance/SKILL.md
@@ -90,8 +90,8 @@ Orchestrate VM migrations across OpenShift cluster nodes for load balancing, mai
 **For Manual Mode:**
 
 **Document Consultation** (REQUIRED - Execute FIRST):
-1. **Action**: Read [REBALANCE_MANUAL.md](rh-virt/skills/vm-rebalance/REBALANCE_MANUAL.md) using Read tool
-2. **Output to user**: "I consulted [REBALANCE_MANUAL.md](rh-virt/skills/vm-rebalance/REBALANCE_MANUAL.md) to understand the manual migration workflow."
+1. **Action**: Read [REBALANCE_MANUAL.md](./REBALANCE_MANUAL.md) using Read tool
+2. **Output to user**: "I consulted [REBALANCE_MANUAL.md](./REBALANCE_MANUAL.md) to understand the manual migration workflow."
 3. **Then execute**: Follow workflow in REBALANCE_MANUAL.md
 
 ---
@@ -99,8 +99,8 @@ Orchestrate VM migrations across OpenShift cluster nodes for load balancing, mai
 **For Automatic Mode:**
 
 **Document Consultation** (REQUIRED - Execute FIRST):
-1. **Action**: Read [REBALANCE_AUTOMATIC.md](rh-virt/skills/vm-rebalance/REBALANCE_AUTOMATIC.md) using Read tool
-2. **Output to user**: "I consulted [REBALANCE_AUTOMATIC.md](rh-virt/skills/vm-rebalance/REBALANCE_AUTOMATIC.md) to understand the automatic rebalancing workflow."
+1. **Action**: Read [REBALANCE_AUTOMATIC.md](./REBALANCE_AUTOMATIC.md) using Read tool
+2. **Output to user**: "I consulted [REBALANCE_AUTOMATIC.md](./REBALANCE_AUTOMATIC.md) to understand the automatic rebalancing workflow."
 3. **Then execute**: Follow workflow in REBALANCE_AUTOMATIC.md
 
 ## Common Validation Logic
@@ -133,7 +133,7 @@ Orchestrate VM migrations across OpenShift cluster nodes for load balancing, mai
 
 **Error for live migration**: If RWO → "Cannot live migrate. Use cold migration (brief downtime ~30-60s)."
 
-**Reference**: [references/live-migration-best-practices.md](rh-virt/skills/vm-rebalance/references/live-migration-best-practices.md)
+**Reference**: [references/live-migration-best-practices.md](./references/live-migration-best-practices.md)
 
 ### Validation 4: Verify Target Node Exists
 
@@ -143,7 +143,7 @@ Orchestrate VM migrations across OpenShift cluster nodes for load balancing, mai
 
 **Errors**: Not found → "Node doesn't exist" | Not Ready → "Choose different target" | Cordoned → "Uncordon or choose different target"
 
-**Reference**: [rh-virt/docs/troubleshooting/scheduling-errors.md](rh-virt/docs/troubleshooting/scheduling-errors.md)
+**Reference**: [scheduling-errors.md](../../docs/troubleshooting/scheduling-errors.md)
 
 ## Node Selection for Automatic Rebalancing
 
@@ -166,7 +166,7 @@ Filter where ALL true:
 
 **Cold Migration**: Brief downtime (~30-60s). Works with any storage. Stop VM → Update placement → Start on target.
 
-**Reference**: [references/live-migration-best-practices.md](rh-virt/skills/vm-rebalance/references/live-migration-best-practices.md)
+**Reference**: [references/live-migration-best-practices.md](./references/live-migration-best-practices.md)
 
 ## Common Plan Visualization
 
@@ -272,22 +272,22 @@ If any node's CPU or Memory percentage **exceeds 100%** after rebalancing:
 ### Error 1: Live Migration Fails - Storage Not RWX
 **Symptom**: "Cannot live migrate: PVC access mode is ReadWriteOnce"
 **Solution**: Use cold migration OR convert PVC to RWX
-**Reference**: [rh-virt/docs/troubleshooting/storage-errors.md](rh-virt/docs/troubleshooting/storage-errors.md)
+**Reference**: [storage-errors.md](../../docs/troubleshooting/storage-errors.md)
 
 ### Error 2: VM Stuck ErrorUnschedulable After Cold Migration
 **Symptom**: "VM cannot be scheduled: ErrorUnschedulable"
 **Solution**: Check node capacity (`nodes_top`), verify no blocking taints (`resources_get` Node), add tolerations, choose different target, remove nodeSelector
-**Reference**: [rh-virt/docs/troubleshooting/scheduling-errors.md](rh-virt/docs/troubleshooting/scheduling-errors.md)
+**Reference**: [scheduling-errors.md](../../docs/troubleshooting/scheduling-errors.md)
 
 ### Error 3: Live Migration Times Out
 **Symptom**: "Migration exceeded timeout: 150s per GiB"
 **Solution**: Retry migration, reduce VM workload, use cold migration, increase timeout in HyperConverged CR
-**Reference**: [references/performance-tuning.md](rh-virt/skills/vm-rebalance/references/performance-tuning.md)
+**Reference**: [references/performance-tuning.md](./references/performance-tuning.md)
 
 ### Error 4: Migration Rejected - Cluster Limit Reached
 **Symptom**: "Migration rejected: cluster limit reached (5 concurrent)"
 **Solution**: Wait for migrations to complete (`resources_list` VirtualMachineInstanceMigration), retry, migrate sequentially, increase limit
-**Reference**: [references/performance-tuning.md](rh-virt/skills/vm-rebalance/references/performance-tuning.md)
+**Reference**: [references/performance-tuning.md](./references/performance-tuning.md)
 
 ### Error 5: RBAC Permission Denied
 **Symptom**: "Forbidden: User cannot create VirtualMachineInstanceMigration"
@@ -296,13 +296,13 @@ If any node's CPU or Memory percentage **exceeds 100%** after rebalancing:
 ### Error 6: Network Saturation
 **Symptom**: Multiple migrations slow/fail, high network utilization
 **Solution**: Reduce concurrent migrations, set bandwidth limit, use dedicated migration network
-**Reference**: [references/performance-tuning.md](rh-virt/skills/vm-rebalance/references/performance-tuning.md)
+**Reference**: [references/performance-tuning.md](./references/performance-tuning.md)
 
 ### Error 7: Resource Version Conflict During Cold Migration
 **Symptom**: "Apply failed: conflict with 'kubernetes-mcp-server' using .spec.runStrategy"
 **Solution**: After `vm_lifecycle` stop, re-read VM using `resources_get` before updating nodeAffinity (gets fresh resourceVersion)
 **Workflow**: Stop → Wait → Re-read → Update nodeAffinity → Start
-**Reference**: [REBALANCE_MANUAL.md - Sub-step 4b.2.5](rh-virt/skills/vm-rebalance/REBALANCE_MANUAL.md)
+**Reference**: [REBALANCE_MANUAL.md - Sub-step 4b.2.5](./REBALANCE_MANUAL.md)
 
 ## Dependencies
 
@@ -321,20 +321,20 @@ If any node's CPU or Memory percentage **exceeds 100%** after rebalancing:
 ### Reference Documentation
 
 **Skill Strategy Files**:
-- [REBALANCE_MANUAL.md](rh-virt/skills/vm-rebalance/REBALANCE_MANUAL.md) - User-driven migration
-- [REBALANCE_AUTOMATIC.md](rh-virt/skills/vm-rebalance/REBALANCE_AUTOMATIC.md) - AI-driven rebalancing
+- [REBALANCE_MANUAL.md](./REBALANCE_MANUAL.md) - User-driven migration
+- [REBALANCE_AUTOMATIC.md](./REBALANCE_AUTOMATIC.md) - AI-driven rebalancing
 
 **Performance and Best Practices**:
-- [references/live-migration-best-practices.md](rh-virt/skills/vm-rebalance/references/live-migration-best-practices.md) - Configuration, requirements, networks
-- [references/performance-tuning.md](rh-virt/skills/vm-rebalance/references/performance-tuning.md) - Right-sizing, overcommit, bandwidth
-- [references/anti-patterns.md](rh-virt/skills/vm-rebalance/references/anti-patterns.md) - Common mistakes
-- [references/production-considerations.md](rh-virt/skills/vm-rebalance/references/production-considerations.md) - HA, capacity, security
+- [references/live-migration-best-practices.md](./references/live-migration-best-practices.md) - Configuration, requirements, networks
+- [references/performance-tuning.md](./references/performance-tuning.md) - Right-sizing, overcommit, bandwidth
+- [references/anti-patterns.md](./references/anti-patterns.md) - Common mistakes
+- [references/production-considerations.md](./references/production-considerations.md) - HA, capacity, security
 
 **Troubleshooting**:
-- [rh-virt/docs/troubleshooting/INDEX.md](rh-virt/docs/troubleshooting/INDEX.md) - Master index
-- [rh-virt/docs/troubleshooting/scheduling-errors.md](rh-virt/docs/troubleshooting/scheduling-errors.md) - ErrorUnschedulable, taints
-- [rh-virt/docs/troubleshooting/storage-errors.md](rh-virt/docs/troubleshooting/storage-errors.md) - PVC access modes
-- [rh-virt/docs/troubleshooting/lifecycle-errors.md](rh-virt/docs/troubleshooting/lifecycle-errors.md) - VM start/stop
+- [Troubleshooting INDEX](../../docs/troubleshooting/INDEX.md) - Master index
+- [scheduling-errors.md](../../docs/troubleshooting/scheduling-errors.md) - ErrorUnschedulable, taints
+- [storage-errors.md](../../docs/troubleshooting/storage-errors.md) - PVC access modes
+- [lifecycle-errors.md](../../docs/troubleshooting/lifecycle-errors.md) - VM start/stop
 
 **Official Documentation**:
 - [OpenShift Virt - Live Migration](https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/virtualization/index#virt-live-migration)