Self-evolving security system for agent skills enforcing risk assessment, audit logging, tiered approvals, and continuous rule updates on all skill commands.
A self-evolving security system for agent skills. Wraps all skill command execution with risk assessment, audit logging, tiered approval, and continuous rule learning.
brew install jq or apt install jqThis is a cross-skill security guard. By design, it needs read access to other skills' directories to:
guard-exec.sh: read target scripts for static risk analysis before executioncapability-diff.sh: compare a skill's SKILL.md declarations against its actual scriptsThe guard does not write to other skills' directories. All writes (audit logs, rules) stay within its own reports/ and rules/ directories.
The runbook (docs/runbook.md) documents emergency bypass procedures (circuit-break, manual script execution, log reset). These are human-operator-only actions for when the guard itself malfunctions. The agent must never execute bypass procedures autonomously.
ALL skill script executions MUST go through guard-exec.sh. Never call skill scripts directly. Always use:
bash {baseDir}/scripts/guard-exec.sh exec <script-path> [args...]
Example:
bash {baseDir}/scripts/guard-exec.sh exec {workspaceDir}/skills/<other-skill>/scripts/<script>.sh <command> [args...]
When guard-exec.sh returns exit code 10 (prompt), present the warning to the user and wait for confirmation. On "确认"/"confirm", re-run with confirm instead of exec.
bash {baseDir}/scripts/guard-exec.sh exec <script> [args...]
bash {baseDir}/scripts/guard-exec.sh confirm <script> [args...]
bash {baseDir}/scripts/guard-exec.sh dry-run <script> [args...]
bash {baseDir}/scripts/guard-exec.sh check <script> [args...]
bash {baseDir}/scripts/capability-diff.sh check --skill-dir <skill-path>
bash {baseDir}/scripts/audit.sh stats
bash {baseDir}/scripts/weekly-report.sh generate [days]
bash {baseDir}/scripts/promote-rule.sh list
bash {baseDir}/scripts/promote-rule.sh add --rule <name> --pattern <regex> --level <low|medium|high|critical>
bash {baseDir}/scripts/promote-rule.sh promote --rule <name>
bash {baseDir}/scripts/promote-rule.sh demote --rule <name>
bash {baseDir}/scripts/replay-verify.sh test --rule <name>
bash {baseDir}/scripts/replay-verify.sh test-all
| Level | Examples |
|---|---|
| low | read-only: list, view, status check |
| medium | single-item mutation: add, update status |
| high | delete, bulk mutation, file write outside data/ |
| critical | network access, secret exposure, system commands |
reports/audit-events.jsonl — audit log (auto-created)reports/failure-dataset.json — failure samples for evolutionrules/active/*.rule — active custom rulesrules/candidates/*.rule — candidate rules pending promotion面向 Agent Skill 的自进化安全系统。为所有技能命令提供风险评估、审计日志、分级审批和持续规则进化。
brew install jq 或 apt install jq 安装这是一个跨技能安全卫士。按设计,它需要读取其他技能目录的权限:
guard-exec.sh:执行前读取目标脚本做静态风险分析capability-diff.sh:对比技能的 SKILL.md 声明与实际脚本行为卫士不会写入其他技能的目录。所有写入(审计日志、规则)都在自身的 reports/ 和 rules/ 目录内。
运行手册(docs/runbook.md)记录了紧急绕过操作(熔断、直接执行脚本、日志重置)。这些是仅限人工操作员的紧急措施,用于卫士本身出故障的情况。Agent 绝对不可以自主执行绕过操作。
所有技能脚本执行必须通过 guard-exec.sh。 不要直接调用技能脚本,始终使用:
bash {baseDir}/scripts/guard-exec.sh exec <脚本路径> [参数...]
当 guard-exec.sh 返回退出码 10(提示)时,向用户展示警告并等待确认。用户回复"确认"后,用 confirm 替代 exec 重新执行。
bash {baseDir}/scripts/guard-exec.sh exec <脚本> [参数...]
bash {baseDir}/scripts/guard-exec.sh confirm <脚本> [参数...]
bash {baseDir}/scripts/guard-exec.sh dry-run <脚本> [参数...]
bash {baseDir}/scripts/guard-exec.sh check <脚本> [参数...]
bash {baseDir}/scripts/capability-diff.sh check --skill-dir <技能路径>
bash {baseDir}/scripts/audit.sh stats
bash {baseDir}/scripts/weekly-report.sh generate [天数]
bash {baseDir}/scripts/promote-rule.sh list
bash {baseDir}/scripts/promote-rule.sh add --rule <名称> --pattern <正则> --level <low|medium|high|critical>
bash {baseDir}/scripts/promote-rule.sh promote --rule <名称>
bash {baseDir}/scripts/promote-rule.sh demote --rule <名称>
bash {baseDir}/scripts/replay-verify.sh test --rule <名称>
bash {baseDir}/scripts/replay-verify.sh test-all
| 级别 | 示例 |
|---|---|
| low | 只读操作:列表、查看、状态检查 |
| medium | 单项变更:新增、更新状态 |
| high | 删除、批量变更、数据目录外写文件 |
| critical | 网络访问、密钥暴露、系统命令 |
reports/audit-events.jsonl — 审计日志(自动创建)reports/failure-dataset.json — 失败样本(用于进化)rules/active/*.rule — 活跃自定义规则rules/candidates/*.rule — 候选规则(待晋升)ZIP package — ready to use