hmbown/forcecage
generated/openclaw/forcecage/SKILL.md
Forcecage creates a pre-tested containment boundary around a subject that has not yet run. It is not about stopping, pausing, or muting something already in motion. The cage is built first, self-tested, then the subject enters. The operator watches from outside and decides whether to release.
$ install --global
skillsauthnpx skillsauth add hmbown/wizards-of-the-ghosts forcecageInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 24, 2026, 8:36 PM1.7s1 file scanned
SKILL.md
- name:
- forcecage
- description:
- Forcecage creates a pre-tested containment boundary around a subject that has not yet run. It is not about stopping, pausing, or muting something already in motion. The cage is built first, self-tested, then the subject enters. The operator watches from outside and decides whether to release.
- user-invocable:
- true
Forcecage
Contain untrusted code, agents, or operations inside a tested cage before anything leaves it.
Overview
Forcecage is interpreted here as a literal spell with a prototype execution model.
Canonical source: Forcecage (spell)
Provider target: OpenClaw
When To Use
- Trigger this spell when the user asks to contain, cage, sandbox, isolate, or box untrusted/experimental/dangerous code, agents, tools, or operations before they run. Look for:
- Explicit boundary requests: "only inside", "cannot reach", "blocked from", "disposable", "throwaway"
- Subject types: untrusted code, third-party binaries, experimental agents, red-team samples, vendor scripts, refactor tools
- Observation intent: "watch what it does", "log denied actions", "see what it reaches for", "observe from outside"
- Release conditions: "before we trust it", "prove itself first", "step-down after", "authorize descent"
Workflow
- Define the boundary: List exactly what the subject CAN access (specific files, URLs, namespaces) and what is BLOCKED (network egress, credential stores, process spawning, writes outside a target directory). Default to deny-all.
- Build and self-test the cage: Create the containment environment (disposable workspace, copied repo, fake namespace, egress-blocked container). Run probes to confirm blocked surfaces actually block. A cage that hasn't been challenged is not trusted.
- Run the subject inside, observe from outside: Execute the subject within the boundary. Collect audit logs of denied actions, attempted escapes, and resource access patterns. The operator stays outside the cage.
- Set release condition before descent: Define what must be true for the subject to leave the cage (e.g., zero unauthorized writes, specific test pass, operator sign-off). If the condition is not met, the subject stays cage-only. If met, authorize a single step-down to a less restricted environment.
Deliverables
- Containment boundary spec: allowed surfaces, blocked surfaces, resource limits
- Execution report: attempted violations, denied actions, escape telemetry
- Safety assessment: release condition stated, recommendation (stay caged vs. descend one layer)
Guardrails
- Do not use for: Freezing/pausing a running workflow → use a halt/interrupt spell
- Do not use for: Muting a specific stream or endpoint → use a filter/silence spell
- Do not use for: Editing CI/config to restrict a job → use a policy/config spell
- Do not use for: Inspecting existing sandbox logs → use an audit/inspect spell
- Do not use for: Disabling a feature temporarily → use a toggle/disable spell
- Do not use for: Forcecage is the only spell that combines: (1) pre-run boundary definition, (2) cage self-test, (3) outside observation with violation logging, and (4) explicit release authorization.
Default Invocation
Use $forcecage to run this inside a tested containment boundary, keep the dangerous parts sealed, and tell me the release condition before anything leaves the cage.
Related Skills
hmbown/zone-of-truth
testing
VerifiedTrustedCommunity
Enter a mode where every assertion is backed by evidence, confidence is calibrated, speculation is flagged, and hallucination is actively resisted.
55SKILL.mdUpdated Apr 5, 2026
hmbown/vicious-mockery
development
VerifiedTrustedCommunity
The bard's cantrip that deals psychic damage through insults. In practice this is adversarial review — the art of finding and articulating exactly what is wrong with something in a way that is impossible to ignore. Unlike polite feedback that gets filed and forgotten, vicious mockery lands. It is the red-team report that makes the PM cancel the launch, the code review that makes the author delete the PR, the roast that makes the founder pivot. The damage is the point.
55SKILL.mdUpdated Apr 5, 2026
hmbown/unseen-servant
tools
VerifiedTrustedCommunity
Use this spell when you need a tireless helper that organizes, tidies, triages, and maintains without requiring your constant attention.
55SKILL.mdUpdated Apr 5, 2026
hmbown/true-strike
testing
VerifiedTrustedCommunity
Use this spell for preflight certainty: dry runs, validation checks, dependency verification, and rehearsals that make the next deploy, query, or command much more likely to succeed. It trades a little time up front for fewer blind swings and fewer expensive misses.
55SKILL.mdUpdated Apr 5, 2026