Install
$ agentstack add skill-devfile-claude-plugin-devfile ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Overview
A devfile is a YAML file defining containerized development environments — components, commands, events, and deployment flows. This skill covers the devfile v2.3.0 schema.
Schema reference: Read devfile-schema-reference.md when you need exact property names, types, defaults, or constraints.
Output format: Always output the full devfile YAML in a fenced code block. Add a brief explanation only for non-obvious choices.
Default Devfile
When starting from scratch, use this as the base:
schemaVersion: 2.3.0
metadata:
name: devfile
components:
- name: tools
container:
image: quay.io/devfile/universal-developer-image:latest
Language/Framework Requests
When asked about a devfile for a specific programming language or framework:
- Fetch the registry index via
WebFetchonhttps://registry.devfile.io/index— returns a JSON array of all stacks withname,language,projectType,tags, anddescriptionfields. - Pick the best match by language, framework, or tags.
- Fetch the devfile via
WebFetchonhttps://registry.devfile.io/devfiles/{name}— returns the raw devfile YAML. - Adapt the devfile to the user's needs (adjust image, add components, set resources).
- Link to
https://registry.devfile.io/devfiles/{name}as the source.
If no registry match exists, build the devfile from scratch using the default template and appropriate container image.
Guidelines
Container Component
- Include
mountSources: trueby default. Omit it only when the container usesdedicatedPod: true. - For non-UDI images (anything other than
quay.io/devfile/universal-developer-image), includecommand: ['sleep', 'infinity']to keep the container alive for exec commands.
Volume Component
When adding a volume mount to a container, always create a matching volume component with the same name and size. For ephemeral volumes, add ephemeral: true.
Image Component
When adding an image component, add buildContext: ..
Variable Substitution Rules
Syntax: {{variable-name}}
Cannot substitute in:
schemaVersion,metadata,parentsource- Element identifiers:
command.id,component.name,endpoint.name,project.name - References to identifiers: event bindings,
exec.component,volumeMounts.name - String enums:
group.kind,endpoint.exposure
Undefined variables: Non-blocking warning (devfile still processed).
Reserved Environment Variables
These cannot be overridden via container env:
$PROJECTS_ROOT— path where project sources are mounted (default/projects)$PROJECT_SOURCE— path to the default project source ($PROJECTS_ROOT/)
Pod & Container Overrides
# Top-level pod overrides
attributes:
pod-overrides:
spec:
__KUBERNETES_POD_SPEC_FIELDS_HERE__
# Component-level overrides
components:
- name: tools
attributes:
container-overrides:
__KUBERNETES_CONTAINER_FIELDS_HERE__
pod-overrides:
spec:
__KUBERNETES_POD_SPEC_FIELDS_HERE__
Merge strategy: devfile-level pod-overrides are applied first, then component-level, using Strategic Merge Patch.
| Override Type | Restricted Properties | |--------------|----------------------| | container-overrides | image, name, ports, env, volumeMounts, command, args | | pod-overrides | containers, initContainers, volumes |
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: devfile
- Source: devfile/claude-plugin
- License: Apache-2.0
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.