A2WF — Agent-to-Web Framework

围绕 A2WF 的 siteai.json 提供三项能力：本地校验政策文件的规范符合性并输出错误、警告与提示；按参数或交互方式生成可部署的 siteai.json；抓取目标网站审计其 A2WF 合规状况并给出 0–100 评分报告。校验与生成在本地完成，审计需要网络访问目标站点。

wolfuser45

热度 79.57

最近更新 2026-05-11 17:35:07

分类：安全依赖：代码执行 / 读写文件 / 联网浏览搜索应用场景：自动化脚本 / 工作流 / 报告撰写 / 法律文档 ...

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add a2wf

Metadata

name: a2wf
description: Validate, generate, and audit A2WF siteai.json files — the open standard for AI agent governance on websites. Use when working with siteai.json policies, checking website A2WF compliance, generating agent permission files, or auditing how a site controls AI agent behavior. TRIGGER "a2wf", "siteai.json", "agent governance", "website ai policy", "agent permissions", "a2wf validate", "a2wf generate", "a2wf audit"
metadata: {"openclaw":{"emoji":"🛡️","homepage":"https://a2wf.org","requires":{"tools":["web_fetch","exec"]}}}

A2WF — Agent-to-Web Framework

A2WF is an open standard that defines what AI agents can and cannot do on a website via a machine-readable siteai.json file at the site root. Think of it as a legally actionable robots.txt for AI agents.

Spec: https://a2wf.org/specification/
GitHub: https://github.com/a2wf/spec
Schema: https://a2wf.org/schema/core-v1.0.json

Commands

1. Validate — Check a siteai.json

Validate a siteai.json file against the A2WF v1.0 spec. The validator is local-only (no network requests).

# Validate a local file
node {baseDir}/scripts/validate.mjs /path/to/siteai.json

# Validate from stdin
echo '{"specVersion":"1.0",...}' | node {baseDir}/scripts/validate.mjs --stdin

To validate a live website: Use web_fetch to download https://example.com/siteai.json, save to a temp file, then validate it.

Output: errors (must fix), warnings (should fix), info (suggestions). Exit 0 = valid, exit 1 = invalid.

If the user pastes raw JSON instead of a file path, save it to a temp file first, then validate.

2. Generate — Create a siteai.json

Build a spec-compliant siteai.json interactively or from parameters.

node {baseDir}/scripts/generate.mjs \
  --domain "https://example.com" \
  --name "Example Store" \
  --language "en" \
  --category "e-commerce" \
  --jurisdiction "EU"

When used interactively (no flags), ask the user:

Domain and site name
Category (e-commerce, news, healthcare, banking, restaurant, saas, other)
Jurisdiction and applicable laws
For each permission group (read/action/data): which operations to allow/deny
Rate limits, agent identification requirements, scraping policy

Output is a complete, validated siteai.json ready to deploy at the site root.

3. Audit — Analyze a website's A2WF posture

node {baseDir}/scripts/validate.mjs https://example.com --audit

Performs:

Discovery check: Does /siteai.json exist? Correct content-type?
Schema validation against core v1.0
Permission completeness: Are critical permissions (scraping, account creation, data access) explicitly set?
Legal coverage: Are jurisdiction and applicable laws declared?
Extension check: Are companion extensions present and valid?

Outputs a structured report with a compliance score (0–100).

Quick Reference

siteai.json structure (v1.0)

{
  "specVersion": "1.0",
  "identity": {
    "domain": "https://example.com",
    "name": "Site Name",
    "inLanguage": "en",
    "jurisdiction": "EU",
    "applicableLaw": ["GDPR", "EU AI Act"]
  },
  "permissions": {
    "read":   { "productCatalog": {"allowed": true, "rateLimit": 60} },
    "action": { "createAccount":  {"allowed": false} },
    "data":   { "customerRecords": {"allowed": false} }
  }
}

Permission groups

Group	Controls	Key examples
`read`	What agents can read	productCatalog, pricing, reviews, faq, contactInfo
`action`	What agents can do	search, addToCart, checkout, createAccount, submitContactForm
`data`	What data agents can access	customerRecords, orderHistory, paymentInfo, employeeData

Category templates

Use --category with generate to start from a template: ecommerce, banking, healthcare, news-media, restaurant, saas.

For agent developers

When browsing a website, check for siteai.json at the domain root before taking actions. Respect the declared permissions — violations are documented and legally actionable under the declared jurisdiction.

See the full Agent Implementer Guide: {baseDir}/references/implementer-guide.md