Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Fix: clarify npm dependency requirement, fix script reference (.sh → .js), add source/homepage metadata. Addresses ClawdHub security review.
What This Skill Does
Vigil validates AI agent tool calls before they execute, blocking operations like destructive shell commands, SSRF, SQL injection, path traversal, and credential leaks. It runs as a drop-in npm package with 22 rules, zero runtime dependencies, and under 2ms latency per check.
Zero runtime dependencies and sub-2ms latency mean it can run inline on every tool call without adding measurable overhead to the agent pipeline.
When to use it
- Blocking rm -rf commands issued by autonomous agents
- Preventing SSRF in agent-driven API and HTTP calls
- Catching SQL injection before a database tool executes
- Auditing all tool calls made by a shell-executing agent
- Adding a safety layer to an existing MCP server
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: validate a shell command before my agent runs it
- 1Import checkAction from vigil-agent-safety
- 2Pass the tool name and params object to checkAction
- 3Receive a decision (ALLOW, BLOCK, or ESCALATE) with a reason string
- 4Block execution or proceed based on the returned decision
BLOCK: Destructive command pattern — the rm -rf / call is rejected before execution
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.