bianhaifeng789-hue/guardrails
skills-experimental/guardrails/SKILL.md
Pre-tool-call authorization for security (borrowed from DeerFlow) Use when [guardrails] is needed.
tools
Updated Apr 21, 2026
$ install --global
skillsauthnpx skillsauth add bianhaifeng789-hue/openclaw-config guardrailsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 21, 2026, 5:12 AM56.7s1 file scanned
SKILL.md
- name:
- guardrails
- description:
- Pre-tool-call authorization for security (borrowed from DeerFlow) Use when [guardrails] is needed.
Guardrails - 工具调用授权
来源: DeerFlow Guardrails Middleware
核心概念
Pre-tool-call Authorization
用途: 工具执行前检查是否允许，防止危险操作
机制:
- Policy-driven authorization (ALLOW/DENY)
- DENY返回错误消息给Agent → Agent自适应
关键参数
denied_tools: 禁止的工具列表allowed_tools: 白名单工具（优先级高于denied）blocked_patterns: 禁止的命令模式
实现
脚本: impl/bin/guardrails-provider.js
状态文件: state/guardrails-config.json
使用方法
评估工具调用
node impl/bin/guardrails-provider.js evaluate exec "rm -rf /"
# Result: { allow: false, reason: "Command contains blocked pattern: 'rm -rf'" }
配置管理
# 查看配置
node impl/bin/guardrails-provider.js config
# 禁止工具
node impl/bin/guardrails-provider.js deny-tool bash
# 添加白名单
node impl/bin/guardrails-provider.js allow-tool read
# 添加禁止模式
node impl/bin/guardrails-provider.js add-pattern "curl | bash"
默认禁止模式
[
"rm -rf",
"sudo",
"chmod 777",
"curl | sh",
"mkfs",
"dd if="
]
默认危险路径
[
"/etc/",
"/var/",
"/usr/",
"/bin/",
"/sbin/",
".ssh/",
".env"
]
借鉴要点
DeerFlow Guardrails特点
-
AllowlistProvider（零依赖）
- 最简单，内置
- 按工具名阻止或允许
-
OAP Passport Provider（政策驱动）
- Open Agent Passport标准
- 动态政策更新
-
Custom Provider（自定义）
- 任何实现evaluate/aevaluate的类
-
Fail-closed（默认拒绝）
- Provider错误时阻止调用
与OpenClaw集成
Hooks系统（PreToolUse）
hooks:
PreToolUse:
- command: "node impl/bin/guardrails-provider.js evaluate {tool_name} {tool_input}"
onError: "return error to agent"
创建时间: 2026-04-15
Related Skills
bianhaifeng789-hue/iaa-feishu-reporting
business
VerifiedTrustedCommunity
IAA 日报飞书输出能力。 支持把固定 CSV 模板一键转换成： - 中文运营结论 - 飞书卡片 JSON - 飞书发送载荷 Use when: - 需要把 IAA 日报直接发到飞书 - 需要从 CSV 一键生成运营日报
SKILL.mdUpdated Apr 21, 2026
bianhaifeng789-hue/iaa-daily-report-model
data-ai
VerifiedTrustedCommunity
IAA日报分析模型 功能： - 渠道日报自动分析 - 小时级+日级ROI联动判断 - 按地区输出加量/降量/停投建议 - 按产品类型输出阈值 - 自动识别利润区/观察区/止损区 Use when: - 分析每天投放数据 - 生成运营日报结论 - 判断是否加量/降量/停投 - 对比美加澳/日韩表现 Keywords: - 日报模型, 投放日报, 加量, 降量, 停投, ROI日报, 分地区分析
SKILL.mdUpdated Apr 21, 2026
bianhaifeng789-hue/iaa-daily-fixed-template
data-ai
VerifiedTrustedCommunity
IAA固定日报分析模板 功能： - 固定字段模板（可直接贴每天数据） - 自动输出总盘结论 - 自动输出美加澳/日韩结论 - 自动给出加量/降量/停投建议 - 适配文件修复/清理两类产品 Use when: - 需要固定日报格式 - 每天复盘渠道表现 - 给运营团队出统一结论 Keywords: - 固定模板, 日报模板, ROI模板, IAA日报, 运营模板
SKILL.mdUpdated Apr 21, 2026
bianhaifeng789-hue/skills-experimental/hyperlink-pool-pattern
development
VerifiedTrustedCommunity
# HyperlinkPool Pattern Skill HyperlinkPool Pattern - HyperlinkPool class + strings array + stringMap + Index 0 no hyperlink + intern(hyperlink) + get(id) + undefined handling + 5-minute reset + OSC8 hyperlink interning。 ## 功能概述 从Claude Code的ink/screen.ts提取的HyperlinkPool模式，用于OpenClaw的OSC8超链接池管理。 ## 核心机制 ### HyperlinkPool Class ```typescript export class HyperlinkPool { private strings: string[] = [''] // Index 0 = no hyperlink private stringMap = new Map<string, number>() // strings
SKILL.mdUpdated Apr 21, 2026