[danielle-mustillo]

Why

A new kagent install has no example agent and no skills to start from, and the UI has no way to add a skill to an agent. Today skills can only be set with kubectl.

What changed

Built-ins in the chart. A new builtins values group gives a new install a starting point:

• builtins.k8sAgent: an Agent named k8s-agent. It uses the kagent-tools Kubernetes tools and the k8s-troubleshooting skill. Tools that change the cluster wait for approval.
• builtins.platformAgent: an example Agent named platform-agent for workloads, Helm releases, Istio traffic and Argo Rollouts.
• builtins.skills: the skills the UI offers. builtins.skills.image with builtins.skills.list offers skills from another image instead.
• builtins.enabled: false turns all three off. Each also has its own enabled.

Both Agents run on the kagent-default Harness from #3566, so they appear only when harnesses.enabled is on. That is off in the chart and on in kagent install.

Skills come from kagent-tools. kagent does not build a skills image of its own.

• The kagent-tools dependency goes from 0.3.0 to 0.3.1, the first release that ships skills, so the skills match the tool server the chart deploys.
• The UI offers three of them: k8s-troubleshooting, helm-release-management and istio-traffic-debugging. The image's other skills need Argo Rollouts, Cilium, Kubescape or Prometheus, so the list leaves them out.
• helm/kagent/files/builtin-skills.json holds the list and the kagent-tools image pinned by digest. make builtin-skills-catalog regenerates it from the image.
• The chart passes the list to the UI as KAGENT_UI_BUILTIN_SKILLS. global.imageRegistry mirrors the image.

Skills in the agent template form.

• A user can pick a built-in skill, or add their own from an OCI image (pinned by digest), Git (URL and full commit) or S3 (with object version), with an optional path.
• Saving writes spec.skills. The form rejects what the CRD or the runtime would reject, and each message names the skill.
• A built-in skill saved from an older kagent-tools image shows "Older version" and an Update button.
• plugins and promptTemplate, which the form does not show, are kept on save.

Limits

• A Git or S3 skill source keeps an Agent from becoming Ready until fix(substrate): let the golden actor fetch git and S3 skill sources #3435 merges. The form offers them anyway.
• A skill only names tools. An Agent a user builds must also bind the tools its skills use.
• helm upgrade --reuse-values from an older release keeps the old chart's defaults, which have no builtins values. The chart then renders no built-ins instead of failing. --reset-then-reuse-values picks up the new defaults and turns them on.
• CI turns kagent-tools off, so CI does not run the built-in Agents.

Testing

• helm unittest helm/kagent: 398 tests pass.
• yarn typecheck, vitest (850 tests), the UI entrypoint Go tests and the mock Playwright agent-templates journey pass.
• On a Kind cluster running this chart:
  • The UI serves the three skills, and the agent template form lists them.
  • k8s-agent is Ready with its skill from ghcr.io/kagent-dev/kagent/tools@sha256:607cb0ac…. Asked about a crash-looping pod, it called load_skill for k8s-troubleshooting and got the kagent-tools text back.
  • builtins.enabled=false removed the Agent and the UI skill list. Turning it back on restored them, and k8s-agent became Ready again.
  • After kagent install, k8s-agent and platform-agent became Ready on kagent-default. harnesses.enabled=false removed both Agents, their AgentTemplates and the three default Harnesses.
  • An upgrade from main with --reuse-values succeeded with no built-ins. A following --reset-then-reuse-values upgrade brought them back, and k8s-agent became Ready.

[danielle-mustillo]

• Agent template form: before, there is no way to add a skill. After, a Skills field adds a built-in kagent skill (k8s-troubleshooting) from the chart's catalog, or your own OCI, Git or S3 skill.
• Agent template details: before, a template's skills are hidden behind a notice saying to use kubectl. After, each skill is listed with its full source.
• Fresh Helm install: before, there is no Harness and no Agent. After, the chart ships Harness kagent and a Ready k8s-agent with the k8s-troubleshooting skill from the kagent-tools image.

pr3554-reel.mp4

Screenshots

Before: new template form has no Skills field

After: Skills field with a kagent skill

Before: template's skills hidden behind a notice

After: template details list both skills in full

---

Written by 🤖

[Charlesthebird]

This automated review is a first pass. A manual review will follow once the blockers are addressed.

---

Nothing blocks merge. One non-blocking gap: the skill form accepts an OCI image the controller rejects.

✅ What I checked

• ✅ --reuse-values from a release without builtins: every read goes through dig on .Values.AsMap
• ✅ global.imageRegistry: the catalog and k8s-agent both use the mirrored image, so "Older version" compares like with like
• ✅ Git, S3, path, 50-skill limit and duplicate-name checks against the v1alpha3 CRD and the translator
• ✅ plugins and promptTemplate on save: specFromDraft replaces only spec.skills
• ✅ KAGENT_UI_BUILTIN_SKILLS escaping through the entrypoint into JSON.parse
• ✅ CI: only the Harness named kagent clashes with the lifecycle suite, and k8s-agent drops out with kagent-tools off
• ✅ Default s3://ate-snapshots/kagent/ matches the RustFS store in setup-cluster.sh
• ✅ No internal brand terms in the diff

---

Written by 🤖

[Charlesthebird]

On second review, this LGTM overall. Couple notes:

• Could /improve-ui for both of these areas. Specifically, it could be clearer what skill the delete button is for, and the link could look more like a link.

[younsl]

The kagent-tools bump to 0.3.1 in this PR also fixes a downgrade for users upgrading from 0.10.x. The v0.10.6 chart depends on kagent-tools 0.3.1, while v1.0.0 pins 0.3.0, so moving from 0.10.6 to 1.0.0 rolls kagent-tools back.

Keeping this dependency on the latest tools release matters because operational fixes land there. For example, kagent-dev/tools#84 (the Streamable HTTP server leaking heap on every MCP initialize request) was fixed in 0.3.0 by kagent-dev/tools#85. Users only get fixes like that without overriding the subchart when the chart tracks the current release.

Changes between kagent-tools 0.3.0 and 0.3.1:

• CVE fixes in the bundled CLIs and Go dependencies (kagent-dev/tools#99)
• The kagent 1.x skills bundle in the tools image (kagent-dev/tools#91)

If the rest of this PR needs more review time, landing the dependency bump on its own would keep the next 1.0.x release from shipping the older tools chart.

[danielle-mustillo]

Before/after demo

Before is main, after is this PR. Both ran on one Kind cluster with the same AgentTemplates.

• Chart built-ins: a new install now gets the kagent-builtin Harness, k8s-agent and platform-agent, all Ready.
• platform-agent: Kubernetes, Helm, Istio and Argo Rollouts skills; tools that change things wait for approval.
• Skills field: the template form now offers 5 built-in skills from kagent-tools.
• Prometheus skill: offered only when kagent-tools.tools.prometheus.url is set.
• Your own skills: add one from an OCI image, Git or S3, with a path.
• Validation: each message names the skill, and an uppercase image path is rejected.
• Skill rows: a line between skills; the remove tooltip names the skill.
• Template page: skills are listed instead of hidden, and a Git repository is a link.
• Older skill: a built-in skill from an older image shows "Older version" and an Update button.
• builtins.enabled=false: removes the Harness, templates and Agents.

pr-3554-verify.mp4

Agents list

Before	After

Skills in the agent template form

Before	After

Skills on the agent template page

Before	After

Built-in skill from an older image

Before	After

Prometheus skill

Both columns run this PR: before has no Prometheus URL, after sets one.

Before	After

platform-agent template

Add your own skill

Skill validation

Divider and remove tooltip

---

🤖 written by Claude

[Charlesthebird]

Thanks for the updates!

Couple of small notes:

1. For this list of skills, it would be nice if:

• The skill name and other fields here had labels
• The delete icon buttons were red
• Each row was in a card and had a slightly different background/elevation to make it clear that it is a single item.

2. I like the updates to this section. Something that could improve it is if each skill here was a card and had a slightly different background/elevation to make it clear that it is a single item.

3. I think the platform agent name doesn't sound right here. Some ideas are:
   a. One built-in (or example or quickstart) agent with all the skills (showing what's possible), and one k8s agent with just the "k8s" skills.
   b. Only one built-in agent, with all the skills and no k8s agent.
   c. One AgentTemplate per example agent from v0.x with the relevant skills attached, and one root AgentTemplate that references all these example agents as child templates. Then the built-in Agent could use the root AgentTemplate and the kagent harness.

I think option (c) might show off what kagent can do the best because it would show a single Agent attached to a root AgentTemplate and one level of child AgentTemplates with skills working.

[Charlesthebird]

This automated review is a first pass. A manual review will follow once the blockers are addressed.

---

Nothing blocks merge. The description lags the code on which skills the UI offers.

---

Written by 🤖

[Charlesthebird]

Level: 🟠 Medium · Not Blocking

The description says the UI offers three skills and leaves out Argo Rollouts and Kubescape, but this list includes both. "What changed" also doesn't mention platform-agent. Update the description (five skills, plus platform-agent), or drop those skills here and regenerate the catalog.

---

Written by 🤖

[Charlesthebird]

I think this could be simplified - less comments, no name override. Also I think the skills should just be enabled if builtin.enabled=true and not configurable. If builtin.enabled=true, at least some of the skills would need to be available for the built in agent(s), so having an extra set here is a bit confusing.