Security

Runs a backend-backed live safety check for instructions that may trigger tool execution, external calls, file edits, permission changes, destructive or irre...

Security Scan

The skill's code, requirements, and runtime instructions are coherent with its stated purpose as a backend-backed live safety check, but it sends instruction/target data to a remote backend (configurable via SAFETY_API_URL) so you must trust the endpoint and avoid sending secrets.

Purpose & Capability

Name/description match the implementation: a Python CLI that posts an instruction + optional context/target to a safety backend. Required runtime (python3, requests, network) is appropriate for this purpose and no unrelated credentials or binaries are requested.

Instruction Scope

SKILL.md and the CLI only describe submitting the instruction, context, and target to the configured backend and returning a normalized success/error envelope. The instructions do not instruct reading unrelated files or system secrets, but callers are explicitly asked to provide concrete targets (paths, DB tables, URLs) which may contain sensitive data.

Install Mechanism

No install spec that downloads arbitrary code; code is included in the package and the runtime dependency is the widely used 'requests' Python package. No remote downloads or archive extraction are performed by an installer.

Credentials

The skill does not request credentials, which is appropriate, but it allows overriding the backend via SAFETY_API_URL and will POST instruction/context/target (potentially containing sensitive identifiers or even connection strings) to that endpoint. If SAFETY_API_URL is pointed at an untrusted endpoint, sensitive data can be exfiltrated. This is a functional necessity but increases risk and should be treated cautiously.

Persistence & Privilege

The skill does not request permanent system presence (always=false), does not modify other skills or system-wide settings, and is user-invocable. Autonomous invocation is allowed (platform default) but not an additional privilege requested by the skill.

Assessment

This skill appears to do what it says: send instructions and a small context/target object to a safety backend and return a decision. Before installing or using it, make sure you trust the backend endpoint (default: https://safety-cf.modeio.ai or any URL set via SAFETY_API_URL). Do not pass secrets or full connection strings as the --target or in the instruction/context unless you control or trust the backend. Ensure the 'requests' package is available in your runtime. If you need offline or local-only checks, consider running a local mock endpoint and set SAFETY_API_URL accordingly or avoid using the skill for highly sensitive targets.

Run backend-backed live safety checks

Use this skill to gate instructions that may trigger tools or state changes behind a backend-backed safety decision before execution.

This skill is for live instruction and operation safety only. For pre-install repository auditing, use skill-audit.

Maintainer-only validation assets are excluded from ClawHub uploads.

Scope

• Included:
  • live instruction safety checks through scripts/safety.py
  • backend-backed retry/error normalization for pre-execution decisions
• Not included:
  • pre-install repository auditing (skill-audit)
  • content masking or restoration workflows (privacy-protector)
  • request/response gateway routing (modeio-middleware)

Working directory

Run these commands from inside the security folder.

Requirements

• Hard requirement: python3
• Required package for successful live checks: requests
• Required runtime condition: network reachability to the safety backend
• Optional override: SAFETY_API_URL

Core commands

python3 scripts/safety.py -i "Delete /tmp/cache/build-123.log" \
  -c '{"environment":"local-dev","operation_intent":"cleanup","scope":"single-resource","data_sensitivity":"internal","rollback":"easy","change_control":"none"}' \
  -t "/tmp/cache/build-123.log" --json

python3 scripts/safety.py -i "DROP TABLE users" \
  -c '{"environment":"production","operation_intent":"destructive","scope":"broad","data_sensitivity":"regulated","rollback":"none","change_control":"ticket:DB-9021"}' \
  -t "postgres://prod/maindb.users" --json

Context contract

Pass --context as JSON with these keys when the instruction may change state:

{
  "environment": "local-dev|ci|staging|production|unknown",
  "operation_intent": "read-only|cleanup|maintenance|migration|permission-change|destructive|unknown",
  "scope": "single-resource|bounded-batch|broad|unknown",
  "data_sensitivity": "public|internal|sensitive|regulated|unknown",
  "rollback": "easy|partial|none|unknown",
  "change_control": "ticket:<id>|approved-manual|none|unknown"
}

--target should be a concrete resource identifier such as an absolute path, table name, service name, or URL.

Runtime notes

• Success envelope: success, tool, mode, data
• Error envelope: success, tool, mode, error
• Error types: validation_error, dependency_error, network_error, api_error
• For state-changing work, provide both --context and --target so the backend has enough context to judge risk
• If the check fails with network/API/dependency issues, do not silently proceed
• The CLI forwards the request and returns the backend result; it does not locally enforce caller policy

Caller policy guidance

approved	risk_level	Agent action
true	low	Proceed.
true	medium	Proceed and mention the risk.
false	medium	Require explicit confirmation before proceeding.
false	high	Block by default and require explicit override.
false	critical	Block and require explicit acknowledgement before any override.

Resources

• scripts/safety.py — live safety check entry point
• ARCHITECTURE.md — command-safety package boundaries

When not to use

• Pre-install or repository-level inspection that should happen before any execution attempt
• Pure planning, summarization, or clearly read-only analysis with no tool call or state-change path
• Data transformation tasks that need to rewrite or mask content rather than score runtime safety
• Local routing or middleware scenarios where you need to sit in front of upstream model traffic