Audit Log Firewall

这是自主代理的安全管控技能，核心含两种模式：拦截模式检查命令是否在本地白名单，高风险命令触发「暂停询问」；取证日志模式将所有终端活动哈希后存入日志，含时间戳等字段，便于事后溯源。适用于代理高危操作防范、安全事件取证场景，输入为终端命令，输出拦截提示或日志记录，可通过clawhub命令安装。

热度 60.31

最近更新 2026-05-11 17:27:54

分类：安全依赖：代码执行 / 读写文件应用场景：DevOps / 报告撰写

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add audit-log-firewall

Metadata

name: audit-log-firewall
description: Policy-based monitoring and command-line enforcement for high-risk agent operations. Intercepts sensitive commands and logs them for human auditing.

Security is a non-negotiable protocol for autonomous agents. This skill acts as a dynamic guardrail.

Every command is checked against a local allowlist (config/allowlist.json).

High Risk: commands like rm -rf, sudo, or direct curl to unknown external IPs.
Protocol: If a high-risk command is detected, the agent triggers a mandatory 'Pause and Ask' state.

All terminal activity is hashed and stored in .logs/SECURITY.json.

Fields: Timestamp, Command, User, Working Directory, and Hash.
Utility: Allows humans to reconstruct the agent's actions in case of a breach or error.

clawhub install audit-log-firewall