Vigil

AI agent safety guardrails for tool calls. Use when (1) you want to validate agent tool calls before execution, (2) building agents that run shell commands, file operations, or API calls, (3) adding a safety layer to any MCP server or agent framework, (4) auditing what your agents are doing. Catches destructive commands, SSRF, SQL injection, path traversal, data exfiltration, prompt injection, and credential leaks. Zero dependencies, under 2ms.

This skill is internally consistent: it provides a small wrapper that calls an npm safety library to evaluate agent tool calls. Before installing or running it, review the vigil-agent-safety package and its GitHub repository (maintainers, recent commits, published code) because the runtime behavior depends entirely on that third‑party package. Pin a specific version, inspect its source code, and install in a sandboxed environment if possible. Note the registry metadata at the top of the skill listing lacked a source/homepage while SKILL.md and _meta.json reference hexitlabs — verify that the npm package and repository URLs match and are legitimate. If you cannot audit the package, avoid installing it on sensitive systems.

Type: OpenClaw Skill Name: vigil Version: 0.1.1 This skill bundle is designed to provide AI agent safety guardrails, detecting and blocking potentially malicious actions such as destructive commands, data exfiltration, SSRF, and prompt injection. The `SKILL.md` clearly documents its purpose and functionality, and the `scripts/vigil-check.js` wrapper simply integrates the `vigil-agent-safety` npm package to validate agent tool calls. There is no evidence of malicious intent, data exfiltration, unauthorized execution, or prompt injection against the OpenClaw agent within the provided files; instead, the skill actively aims to prevent such behaviors.