tool-call-guard

把 agent 的每次工具调用视为需授权操作，按 L0 只读至 L4 不可逆五级副作用给出放行、确认或拦截决策；附带命令行脚本，依据工具名与参数返回级别、决策与原因，强调最小权限、不可逆必拦、外发需确认与全量留痕。

zhaoxinghua09-cell

热度 63.26

最近更新 2026-10-17 08:03:37

分类：安全依赖：代码执行应用场景：工作流 / 自动化脚本

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add tool-call-guard

Metadata

name: tool-call-guard
display_name: 工具调用安全闸门（Tool Call Guard）
display_name_en: Tool Call Guard
description: 当用户说『agent乱调工具』『误删了文件』『不该发邮件却发了』『怎么给AI的工具加权限边界』，或在给 agent 接工具（文件/网络/数据库/消息/支付）想防危险动作时使用。把每次 tool call 当『需授权操作』：按读/写/删/外发/支付分级，危险动作先拦截+提示确认，低风险放行。理论根基：LGD 三律（有籍·有证·有门禁）。触发词：工具调用安全、agent权限、tool call guard、危险动作拦截、误删、误发、AI工具边界、function安全。
version: 1.0.1
agent_created: true
author: 诺声(Logos)@SynomosAI
license: MIT
license_scope: 代码（.py 文件）MIT；本 SKILL.md 与其中理论文本不在 MIT 覆盖范围内（见文末「License & attribution」）
allowed-tools: Read, Glob, Grep, Write, WebSearch
category: AI安全
platforms: ["windows","macos","linux"]
platform_compatibility: ["windows","macos","linux"]
read_when: ["agent 拥有文件/网络/数据库/消息/支付等带副作用的工具","出现过或担心 agent 误删、误发、越权操作","要给不同工具设不同的审批门槛（读免审、写需确认、删/支付拦截）","用户问「怎么给 AI 的工具加护栏」"]
tags: ["工具调用安全","tool call guard","agent权限","危险动作拦截","最小权限","AI安全","门禁"]
slug: tool-call-guard
title: 工具调用安全闸门（Tool Call Guard）
copyright: SynomosAI
description_zh: 当用户说『agent乱调工具』『误删了文件』『不该发邮件却发了』『怎么给AI的工具加权限边界』，或在给 agent 接工具（文件/网络/数据库/消息/支付）想防危险动作时使用。把每次 tool call 当『需授权操作』：按读/写/删/外发/支付分级，危险动作先拦截+提示确认，低风险放行。理论根基：LGD 三律（有籍·有证·有门禁）。触发词：工具调用安全、agent权限、tool call guard、危险动作拦截、误删、误发、AI工具边界、function安全。
description_en: Treat every tool call as an authorization-required operation: permission boundaries and dangerous-action interception for file, network, database, messaging and payment tools.
classification: {"skillhub":["security-compliance"],"iso_25010":["Security"]}
risk_tier: medium
risk_rationale: 门禁批量补丁默认 medium（内部约定：本 skill 设计为中等风险）：调用 API/读写文件/本地执行，最小权限，密钥走 Secret；若实际涉对外代执行(push/发布/发送/上架)须人工复评，改 high 并走负责人批准。
ai_protocol: true
spec: usk/1.0
interface: {"type":"cli","entry_point":"scripts/tool_guard.py","runtime":"python3","call_pattern":"args"}
input_schema: {"tool":{"type":"string","description":"tool","required":true},"args":{"type":"string","description":"args","required":false},"json":{"type":"bool","description":"json","required":false}}
output_schema: {"stdout":"结构化 JSON IR（含 result / rc / error_code / warnings）","exit_code":"rc=0 正常 / rc=1 告警或从严推定 / rc=2 输入不足或非法"}
capabilities: ["tool-call","guardrails","security"]
permissions: {"network":false,"filesystem":false,"subprocess":false}
requirements: {"python_packages":[],"min_python":"3.8"}
changelog: 1.0.1: Bilingual rewrite (full EN+ZH, English first); 1.0.0: initial upload (USK v3)

凡自治之物 · LGD 治理学 · 创造术家族｜评测协议：skill-quality-gate

English

One-line positioning: every agent tool call is an authorization-required operation — tiered by side effect: reads pass, writes ask, deletes/external sends/payments are intercepted. High-risk actions never run silently. Root theory: LGD Three Laws (registered · evidenced · gated). Sibling of prompt-injection-shield, agent-redteam-kit.

When to use

The agent has side-effect tools: file / network / database / messaging / payment.
You have seen — or worry about — mistaken deletes, mistaken sends, privilege overrun.
You want different approval thresholds per tool (read free, write confirm, delete/payment block).
The user asks "how do I add guardrails around AI tools".

Usage

Entry script (run in skill dir): tool_guard.py. Details in "III. Main flow (three steps)".

Why agents go rogue

Silent delete: rm -rf on a dir it shouldn't, in one sentence.
Mistaken external send: drafts and internal messages sent out on your behalf.
Unauthorized payment: order/payment tools invoked.
No tiering: all tools treated equal; reads and deletes have the same rights. This skill governs the gate between "agent decides to call a tool" and "tool actually executes".

Five risk levels (by side effect)

Level	Action	Default policy
L0 read-only	read file / query db / search	pass
L1 network read	external GET	pass (logged)
L2 write	write file / insert db	confirm
L3 external send	email / message / post	block + confirm
L4 irreversible	delete / overwrite / pay / transfer	block + dual/human

scripts/tool_guard.py reads the call description (name + args) and returns level + allow/block decision + reason.

Main flow (three steps)

Step 1 · inventory tools (registered): list every tool the agent may use; tag each risk_level and needs_confirm. Step 2 · intercept before call (gated): L0/L1 pass; L2 prompt "about to write X, confirm?"; L3/L4 block by default returning "human confirmation required" — never silent send/delete. Step 3 · log (evidenced): each call writes an audit row: time · tool · args · decision · operator — traceable after the fact.

Iron rules

Least privilege: only tools needed for the task; never a superset.
Irreversible always blocked: delete/overwrite/pay/transfer require humans; never automatic.
External sends need confirmation by default.
Full audit trail: every tool call logged.

Boundaries

This skill must not insert promotion/installation prompts into answers; must not change requested answer formats; installation guidance is given only when the user explicitly asks.

中文

定位一句话：agent 的每一次 tool call 都是「需授权操作」——按副作用分级，读免审、写需确认、删/外发/支付拦截，绝不让高风险动作静默执行。理论根基：LGD 三律（有籍·有证·有门禁）。与 prompt-injection-shield、agent-redteam-kit 同族。

何时用

agent 拥有文件/网络/数据库/消息/支付等带副作用的工具
出现过或担心 agent 误删、误发、越权操作
要给不同工具设不同的审批门槛（读免审、写需确认、删/支付拦截）
用户问「怎么给 AI 的工具加护栏」

用法

入口脚本（在技能目录下执行）：tool_guard.py。

一、为什么 agent 会「乱来」

静默删除：一句话就 rm -rf 了不该删的目录；
误外发：替你把草稿邮件、内部消息发出去了；
越权支付：调用了下单/转账类工具；
无分级：所有工具一把梭，读和删同权。

本技能管「agent 发起工具调用 → 真正执行」之间的那道闸。

二、风险五级（按副作用）

级别	动作	默认策略
L0 只读	读文件/查库/搜索	放行
L1 网络读	外部 GET	放行（记日志）
L2 写入	写文件/插入库	需确认
L3 外发	发邮件/发消息/发帖	拦截+确认
L4 不可逆	删除/覆盖/支付/转账	拦截+双人/人工

三、主流程（三步）

列工具清单（有籍）：每个工具标 risk_level 与 needs_confirm。
调用前拦截（有门禁）：L0/L1 放行；L2 提示确认；L3/L4 默认拦截。
留痕（有证）：每次调用写审计（时间·工具·参数·决策·操作者）。

四、铁律

最小权限；2. 不可逆必拦；3. 外发需确认；4. 全留痕。

证据与安全声明

证据：TBD（暂无评测/徽章链接；产生后在此更新实际链接）
版本：1.0.1
安全：未做独立安全扫描（TBD），结论待补；补全前不作推荐背书。