Vigil
v0.1.1AI agent safety guardrails for tool calls. Use when (1) you want to validate agent tool calls before execution, (2) building agents that run shell commands, file operations, or API calls, (3) adding a safety layer to any MCP server or agent framework, (4) auditing what your agents are doing. Catches destructive commands, SSRF, SQL injection, path traversal, data exfiltration, prompt injection, and credential leaks. Zero dependencies, under 2ms.
⭐ 0· 964·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the actual contents: a small CLI wrapper and instructions that call the npm package vigil-agent-safety to evaluate agent tool calls. The dependency on an npm safety library is coherent with the stated purpose.
Instruction Scope
SKILL.md instructs the user to install and use the vigil-agent-safety npm package and shows example usage. The included script only parses args and forwards them to checkAction; it does not read unrelated system files or environment variables. Note: the skill requires the external package to be installed for runtime behavior—if missing the wrapper will error out.
Install Mechanism
No automated install spec is provided; SKILL.md asks you to run npm install for a public npm package. Using a public npm package is a moderate supply-chain risk (expected here), so review the package and its GitHub repo before installing. The install is not via an opaque URL or archive.
Credentials
The skill requests no environment variables, credentials, or config paths. The wrapper and documentation do not reference secrets or unrelated credentials.
Persistence & Privilege
always is false and the skill is user-invocable. The skill does not request permanent presence or modify other skills' configs. It does not attempt to persist credentials or change system-wide settings.
Assessment
This skill is internally consistent: it provides a small wrapper that calls an npm safety library to evaluate agent tool calls. Before installing or running it, review the vigil-agent-safety package and its GitHub repository (maintainers, recent commits, published code) because the runtime behavior depends entirely on that third‑party package. Pin a specific version, inspect its source code, and install in a sandboxed environment if possible. Note the registry metadata at the top of the skill listing lacked a source/homepage while SKILL.md and _meta.json reference hexitlabs — verify that the npm package and repository URLs match and are legitimate. If you cannot audit the package, avoid installing it on sensitive systems.Like a lobster shell, security has layers — review code before you run it.
agentsvk97efnyztn9sfd15pp0fm20fz5811f67guardrailsvk97efnyztn9sfd15pp0fm20fz5811f67latestvk97efnyztn9sfd15pp0fm20fz5811f67mcpvk97efnyztn9sfd15pp0fm20fz5811f67safetyvk97efnyztn9sfd15pp0fm20fz5811f67securityvk97efnyztn9sfd15pp0fm20fz5811f67
License
MIT-0
Free to use, modify, and redistribute. No attribution required.