version: "1.0.1" name: galileo-agent-control-setup description: >- Render, validate, and optionally apply Agent Control setup assets covering Docker or external server readiness, file-backed auth templates, policy controls, Python @control() snippets, TypeScript runtime snippets, OpenTelemetry and custom Splunk HEC event sinks, Splunk HEC and OTel Collector handoffs, and Splunk Observability dashboards/detectors. Use when the user asks to govern runtime agent behavior with Agent Control and wire control events to Splunk Platform or Splunk Observability Cloud. compatibility: "No direct Splunk Platform runtime dependency. This workflow can be used alongside Splunk Cloud Platform 10.5.2605 through its documented external APIs or handoffs." metadata: splunk_cloud_10_5: "not-applicable" compatibility_verified: "2026-07-02"

Galileo Agent Control Setup

This skill renders Agent Control setup assets without exposing secret values. It owns the Agent Control runtime and sink examples, and delegates Splunk-side HEC, OTel Collector, dashboard, and detector work to the existing Splunk skills.

Required Intake

Before rendering, validating, doctoring, probing, or applying this skill, ask the user for the Galileo instance console URL and record the exact value they provide, for example https://console.demo-v2.galileocloud.io/. Do not assume the default Galileo Cloud URL unless the user explicitly confirms it.

Pass the URL as --galileo-console-url "$GALILEO_CONSOLE_URL" or set galileo.console_url in the spec. This URL is separate from --server-url, which points to the standalone Agent Control server.

Use galileo-platform-setup instead when the user is asking about the Galileo Agent Observability Controls console tab, Log stream control attachment, or exported control-span evidence. This skill is for external/open-source Agent Control runtime and server assets.

The July 7, 2026 AI Assistant beta, global dashboards, generic alert webhooks, experiment groups, and large-dataset batching are Galileo Platform features; route those requests to galileo-platform-setup. They do not change this standalone Agent Control server contract.

Supported Paths

1. Server readiness: render Docker/external server readiness notes, health

endpoint checks, and auth expectations.

1. Auth templates: render file-backed Agent Control API and admin key env

templates.

1. Controls: render starter policy templates for observe-first and deny

controls.

1. Runtime snippets: render Python @control() and TypeScript skeleton

snippets for protected agents.

1. Event sinks: render the built-in OTel sink env and a custom Splunk HEC

event sink.

1. Splunk handoffs:

• HEC token/service: splunk-hec-service-setup
• Splunk OTel Collector: splunk-observability-otel-collector-setup
• Dashboards: splunk-observability-dashboard-builder
• Detectors/native ops: splunk-observability-native-ops

Safe First Command

bash skills/galileo-agent-control-setup/scripts/setup.sh --help

Primary Workflow

Render default artifacts first:

bash skills/galileo-agent-control-setup/scripts/setup.sh \
  --render \
  --output-dir galileo-agent-control-rendered

Render from the intake template:

bash skills/galileo-agent-control-setup/scripts/setup.sh \
  --render \
  --validate \
  --galileo-console-url "$GALILEO_CONSOLE_URL" \
  --spec skills/galileo-agent-control-setup/template.example \
  --output-dir galileo-agent-control-rendered

Apply only explicit sections:

bash skills/galileo-agent-control-setup/scripts/setup.sh \
  --apply splunk-hec,otel-collector,dashboards,detectors \
  --realm "$SPLUNK_O11Y_REALM" \
  --splunk-hec-url "$SPLUNK_HEC_URL" \
  --splunk-hec-token-file /tmp/splunk_hec_token \
  --o11y-token-file /tmp/splunk_o11y_token

CLI Contract

setup.sh supports --render, --validate, --doctor, --apply SECTIONS, --dry-run, and --json.

Apply sections:

• server
• auth
• controls
• python-runtime
• typescript-runtime
• otel-sink
• splunk-sink
• splunk-hec
• otel-collector
• dashboards
• detectors

Secret Handling

Use file-based flags only:

• --agent-control-api-key-file
• --agent-control-admin-key-file
• --splunk-hec-token-file
• --o11y-token-file

Never pass token values on the command line or in chat. Direct token/password flags such as --agent-control-api-key, --agent-control-admin-key, --splunk-hec-token, --o11y-token, --token, --api-key, --password, and --authorization are rejected.

Because Agent Control and HEC requests carry credentials, their URLs must not embed user information. --server-url accepts only an HTTP(S) origin (no path, query, or fragment), and --splunk-hec-url accepts an origin or the exact /services/collector[/event] path. Both require HTTPS outside loopback; the renderer normalizes the HEC destination to /services/collector/event.

Validation

bash skills/galileo-agent-control-setup/scripts/validate.sh \
  --output-dir galileo-agent-control-rendered

For code validation:

python3 -m py_compile \
  skills/galileo-agent-control-setup/scripts/render_assets.py

See reference.md for server, control, sink, and Splunk handoff notes.