Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
**Summary: Documentation and metadata cleanup for clarity and maintainability.** - Streamlined and condensed the documentation for easier readability. - Clarified usage instructions, modes, environment variables, and default protections. - Updated metadata and skill description for accuracy and consistency. - Removed redundant and verbose sections; replaced with concise tables and quick links. - Maintained all critical setup, usage, and troubleshooting information.
What This Skill Does
Pre-action authorization layer for AI agents running under OpenClaw. Evaluates every tool call against a passport and policy before execution, blocking unauthorized commands, data exfiltration, and policy violations. Enforcement runs in the hook layer, not in agent prompts.
Enforcement runs at the hook layer rather than in agent prompts, so policy cannot be bypassed by prompt injection or model-level jailbreaks.
When to use it
- Blocking destructive shell commands before an agent executes them
- Restricting which file paths an agent can read or write
- Limiting agent web requests to an approved domain allowlist
- Enforcing rate limits on agent messaging actions like email or Slack
- Auditing every tool call an AI agent makes for compliance review
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: add guardrails to my agent to prevent it from running dangerous shell commands or accessing sensitive files
- 1Run npx @aporthq/aport-agent-guardrails to launch the setup wizard
- 2Configure passport with allowed shell command patterns and permitted file paths
- 3Wizard registers the before_tool_call hook as an OpenClaw plugin under ~/.openclaw/
- 4Test the hook by calling a blocked command pattern and verifying it returns DENY
Hook is active on every tool call; rm -rf and similar patterns are blocked, permitted commands execute normally, and all decisions are logged to ~/.openclaw/aport/audit.log
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.