# Orchestrator

> >-

- **Type:** Skill
- **Install:** `agentstack add skill-knoxops-open-devops-skills-orchestrator`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [KnoxOps](https://agentstack.voostack.com/s/knoxops)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [KnoxOps](https://github.com/KnoxOps)
- **Source:** https://github.com/KnoxOps/open-devops-skills/tree/master/plugins/ico/skills/orchestrator
- **Website:** https://knoxops.app?invite_token=GITHUB26

## Install

```sh
agentstack add skill-knoxops-open-devops-skills-orchestrator
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

## Input Parameters

| Name | Type | Required | Description |
|------|------|----------|-------------|
| run_dir | string | Yes | Workspace root directory |
| ssh_key_path | string | No | SSH key path for cloud API calls |
| task_id | string | Yes | Task ID for progress tracking |

## Execution Flow

### Task Context

Before starting execution, initialize `task_context.json`:

```json
{
  "task_id": "",
  "current_step": 0,
  "current_step_id": null,
  "status": "running",
  "steps": {
    "confirm_scope": "pending",
    "confirm_connection": "pending",
    "confirm_monitoring": "pending",
    "generate_intent": "pending",
    "generate_plan": "pending",
    "collect_metrics": "pending",
    "screen_resources": "pending",
    "review_gate": "pending",
    "deep_scan": "pending",
    "phase_e_report": "pending",
    "phase_e_select": "pending",
    "phase_f_isolation": "pending",
    "isolation_review_gate": "pending",
    "execute_isolation": "pending",
    "decision": "pending",
    "phase_j_delete_review": "pending",
    "final_report": "pending"
  },
  "updated_at": ""
}
```

Update this file after each step completes. On error, set step status to `"failed"` and overall `status` to `"failed"`.

### Step 1: confirm_scope

**Type:** inline
**Description:** Confirm scan scope with user

## Execution
Follow these instructions:

Ask the user what to scan. One question at a time.
1. What environment? (prod/staging/dev/all)
2. Any resource types to include or exclude?
Prefer multiple choice. Skip if user already specified.

### Progress Tracking

After completing this step, update `task_context.json`:
- Set `current_step_id` to `"confirm_scope"`
- Set `steps.confirm_scope` to `"completed"`
### Step 2: confirm_connection

**Type:** inline
**Description:** Collect concrete connection details

## Execution
Follow the instructions in the prompt file `$PLUGINS/ico/skills/orchestrator/prompts/confirm-connection.prompt.md`.

Write the output to the specified output file.

## Output
- **Schema:** schemas/connection-config.schema.json
  - **File:** connection_config.json

### Progress Tracking

After completing this step, update `task_context.json`:
- Set `current_step_id` to `"confirm_connection"`
- Set `steps.confirm_connection` to `"completed"`
### Step 3: confirm_monitoring

**Type:** inline
**Description:** Confirm monitoring and CI/CD data sources

## Execution
Follow these instructions:

Ask two questions:

1. "Do you have a monitoring system for historical metrics?"
   Options: Prometheus, Datadog, CloudWatch, Azure Monitor, GCP Monitoring, or none.
   If none — warn that only real-time snapshots will be used.

2. "Do you use a CI/CD or GitOps tool for deployments?"
   Options: ArgoCD, FluxCD, Jenkins, GitLab CI, GitHub Actions, other, or none.
   If they name one, ask how to access it (URL, token, namespace).

Record both in {run_dir}/connection_config.json under `monitoring` and `cicd`.

### Progress Tracking

After completing this step, update `task_context.json`:
- Set `current_step_id` to `"confirm_monitoring"`
- Set `steps.confirm_monitoring` to `"completed"`
### Step 4: generate_intent

**Type:** inline
**Description:** Generate intent_detection.json from user input

## Execution
Follow these instructions:

Write {run_dir}/intent_detection.json:
- entity_types: list of resource types to scan
- scope: {account, region, tag_filters}
- exclusions: list of excluded resource_ids or tags

Write the output to the specified output file.

## Output
- **Schema:** schemas/intent-detection.schema.json
  - **File:** intent_detection.json

### Progress Tracking

After completing this step, update `task_context.json`:
- Set `current_step_id` to `"generate_intent"`
- Set `steps.generate_intent` to `"completed"`
### Step 5: generate_plan

**Type:** inline
**Description:** Dispatch Plan Agent with the orchestration template, present plan, wait for confirmation

## Execution
Follow these instructions:

1. Read the orchestration plan template: `$PLUGINS/ico/skills/orchestrator/prompts/orchestration-plan.agent.md`
2. Fill in any placeholders with info from intent_detection.json and user discussion
3. Use the Agent tool (subagent_type=general-purpose) with the filled template to produce an execution plan
4. Save the plan output verbatim to {run_dir}/execution_plan.md
5. Present the plan to user using the Write tool as markdown. Show: phase overview table, estimated duration, review checkpoints
6. WAIT for user confirmation before proceeding to execution.

### Progress Tracking

After completing this step, update `task_context.json`:
- Set `current_step_id` to `"generate_plan"`
- Set `steps.generate_plan` to `"completed"`
### Step 6: collect_metrics

**Type:** agent
**Description:** Discover resources and apply 3-signal coarse filter

## Execution
Launch an independent agent with the following prompt file:

**Dispatch instruction:**

Use the Agent tool (subagent_type=general-purpose) to load the ico:metrics-collector skill.
Do NOT add extra commands, signal definitions, or thresholds.

Execute ico:metrics-collector with:
- run_dir: {run_dir}
- ssh_key_path: {ssh_key_path}
- task_id: {task_id}
- connection_config: read {run_dir}/connection_config.json

**Agent workflow:**

1. Prepare the execution environment

2. Execute the agent with the prompt

3. Complete execution

### Progress Tracking

After completing this step, update `task_context.json`:
- Set `current_step_id` to `"collect_metrics"`
- Set `steps.collect_metrics` to `"completed"`
### Step 7: screen_resources

**Type:** agent
**Description:** Score and rank zombie candidates

## Execution
Launch an independent agent with the following prompt file:

**Dispatch instruction:**

Use the Agent tool (subagent_type=general-purpose) to load the ico:resource-screener skill.

Execute ico:resource-screener with:
- run_dir: {run_dir}
- task_id: {task_id}

**Agent workflow:**

1. Prepare the execution environment

2. Execute the agent with the prompt

3. Complete execution

### Progress Tracking

After completing this step, update `task_context.json`:
- Set `current_step_id` to `"screen_resources"`
- Set `steps.screen_resources` to `"completed"`
### Step 8: review_gate

**Type:** inline
**Description:** Present results and wait for user (BLOCKING)

## Execution
Follow these instructions:

Read {run_dir}/analysis/suspect_assessment.json.

Present to user via the Write tool, sorted by estimated_monthly_cost descending:
- Total candidates, high/medium/low counts
- Top candidates: resource_id, suspect_level, zombie_score, cost, key signals

ASK: which resources should enter deep scan?

WAIT for user response. This is BLOCKING.

Write {run_dir}/phase1_review_decision.json:
- resources_for_deep_scan: [resource_ids]
- skip_resources: [resource_ids]

Write the output to the specified output file.

## Output
- **Schema:** schemas/phase1-review-decision.schema.json
  - **File:** phase1_review_decision.json

### Progress Tracking

After completing this step, update `task_context.json`:
- Set `current_step_id` to `"review_gate"`
- Set `steps.review_gate` to `"completed"`
### Step 9: deep_scan

**Type:** agent
**Description:** Deep scan approved candidates (one per machine, max 8 concurrent)

## Execution
Launch an independent agent with the following prompt file:

**Dispatch instruction:**

Read {run_dir}/phase1_review_decision.json.

Use the Agent tool (subagent_type=general-purpose) to load the ico:deep-scanner skill.
Do NOT add extra commands or collection steps -- the ico:deep-scanner skill defines the complete collection checklist.

Execute ico:deep-scanner for each resource in resources_for_deep_scan:
- run_dir: {run_dir}
- ssh_key_path: {ssh_key_path}
- Launch one agent per resource, max 8 concurrent
- Each writes analysis/deep_scan_{resource_id}.json

**Agent workflow:**

1. Prepare the execution environment

2. Execute the agent with the prompt

3. Complete execution

### Progress Tracking

After completing this step, update `task_context.json`:
- Set `current_step_id` to `"deep_scan"`
- Set `steps.deep_scan` to `"completed"`
### Step 10: phase_e_report

**Type:** agent
**Description:** Generate HTML report from deep scan data

## Execution
Launch an independent agent with the following prompt file:

**Dispatch instruction:**

Read `$PLUGINS/ico/skills/orchestrator/prompts/report.prompt.md`.
Use the Agent tool (subagent_type=general-purpose) and pass the EXACT content of
report.prompt.md as the prompt. Do NOT write your own prompt — send the file content
verbatim. The sub-agent must write {run_dir}/reports/report.html.

**Agent workflow:**

1. Prepare the execution environment

2. Execute the agent with the prompt

3. Complete execution

### Progress Tracking

After completing this step, update `task_context.json`:
- Set `current_step_id` to `"phase_e_report"`
- Set `steps.phase_e_report` to `"completed"`
### Step 11: phase_e_select

**Type:** inline
**Description:** Present deep scan report + ask user which resources to isolate (BLOCKING)

## Execution
Follow these instructions:

Verify `{run_dir}/reports/report.html` exists. If not, go back to phase_e_report.

Open the HTML report and present it. Do NOT summarize deep scan findings yourself —
the report IS the summary. Do NOT change the verdict, suspect_level, or zombie_score
from suspect_assessment.json.

ASK: which resources should proceed to isolation planning?
WAIT for user. BLOCKING.

Write {run_dir}/isolation_selection.json

### Progress Tracking

After completing this step, update `task_context.json`:
- Set `current_step_id` to `"phase_e_select"`
- Set `steps.phase_e_select` to `"completed"`
### Step 12: phase_f_isolation

**Type:** agent
**Description:** Generate isolation plans

## Execution
Launch an independent agent with the following prompt file:

**Dispatch instruction:**

Use the Agent tool (subagent_type=general-purpose) to load the ico:isolation-planner skill.

Execute ico:isolation-planner with:
- run_dir: {run_dir}
- task_id: {task_id}
- ssh_key_path: {ssh_key_path}

**Agent workflow:**

1. Prepare the execution environment

2. Execute the agent with the prompt

3. Complete execution

### Progress Tracking

After completing this step, update `task_context.json`:
- Set `current_step_id` to `"phase_f_isolation"`
- Set `steps.phase_f_isolation` to `"completed"`
### Step 13: isolation_review_gate

**Type:** inline
**Description:** Present isolation plan, wait for approval (BLOCKING)

## Execution
Follow these instructions:

Read {run_dir}/analysis/isolation_batch_plan.json.

Compile the isolation plan as MARKDOWN via the Write tool. The markdown must include:

## Isolation Plan for [hostname] ([IP])
- **Method**: iptables DROP (description)
- **Rollback**: iptables-restore, estimated  label="IP:port process_name", type=src_service_type
  - Only port known -> label="IP:port", type=service
  - Client IP only -> label="IP (client)", type=gateway
  - Unmapped -> label="IP:port", type=service, status=degraded
- Edge: from=src node id, to=dst node id, label="{rate_kbps} Kb/s", throughput="{rate_kbps} Kb/s"
- Edge status: "healthy" for business, null for infra, "warning" for unmapped

**Tab 1 "Services"** -- with:
- Table: processes[] (PID, user, CPU%, MEM%, command), filter out systemd/sshd/kthread
- List: listening_ports[] as items {name: "{port} {process}", status: "ok"}
- Callout if local_databases non-empty: "Local databases: ..."

**Tab 2 "Scheduled Tasks"** -- with:
- Table: crontab_entries[] (user, schedule, command)
- Table: systemd_timers[] (unit, next, schedule)

**Tab 3 "Storage"** -- with:
- List: disk_partitions[] {key: mount, value: "used/size (use%)"}
- Callout if disk_usage has results with top-5 large directories

**Tab 4 "Ownership"** -- with:
- List: business.owner, business.team, business.environment, etc.
- Table: estimated_monthly_cost, spec.cpu_cores, spec.memory_gb, spec.disk_gb

Phase 2 -- Summary:
Compile final summary: scanned count, deleted count, cost savings, kept/exempt.
Deliver via the Write tool with a summary dashboard. Include recommended next steps.

### Progress Tracking

After completing this step, update `task_context.json`:
- Set `current_step_id` to `"final_report"`
- Set `steps.final_report` to `"completed"`

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [KnoxOps](https://github.com/KnoxOps)
- **Source:** [KnoxOps/open-devops-skills](https://github.com/KnoxOps/open-devops-skills)
- **License:** Apache-2.0
- **Homepage:** https://knoxops.app?invite_token=GITHUB26

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-knoxops-open-devops-skills-orchestrator
- Seller: https://agentstack.voostack.com/s/knoxops
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.