Security Guardrails & Policy
Defines mandatory rules for offensive and defensive skills, including disclaimers, user confirmation, and safe design requirements.
What this file does
Defines mandatory rules for offensive and defensive skills, including disclaimers, user confirmation, and safe design requirements.
When to use it
- Contributing offensive security skills to a shared repository
- Establishing a policy for agent-based security tools
- Reviewing pull requests that add pentesting or red teaming capabilities
- Setting up guardrails for a multi-contributor agent skill hub
Security Guardrails & Policy
Agent Skills Hub is a powerful toolkit. With great power comes great responsibility. This document defines the Rules of Engagement for all security and offensive capabilities in this repository.
Offensive Skills Policy (The "Red Line")
What is an Offensive Skill? Any skill designed to penetrate, exploit, disrupt, or simulate attacks against systems. Examples: Pentesting, SQL Injection, Phishing Simulation, Red Teaming.
1. The "Authorized Use Only" Disclaimer
Every offensive skill MUST begin with this exact disclaimer in its SKILL.md:
⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.
2. Mandatory User Confirmation
Offensive skills must NEVER run fully autonomously.
- Requirement: The skill description/instructions must explicitly tell the agent to ask for user confirmation before executing any exploit or attack command.
- Agent Instruction: "Ask the user to verify the target URL/IP before running."
3. Safe by Design
- No Weaponized Payloads: Skills should not include active malware, ransomware, or non-educational exploits.
- Sandbox Recommended: Instructions should recommend running in a contained environment (Docker/VM).
Defensive Skills Policy
What is a Defensive Skill? Tools for hardening, auditing, monitoring, or protecting systems. Examples: Linting, Log Analysis, Configuration Auditing.
- Data Privacy: Defensive skills must not upload data to 3rd party servers without explicit user consent.
- Non-Destructive: Audits should be read-only by default.
Legal Disclaimer
By using this repository, you agree that:
- You are responsible for your own actions.
- The authors and contributors are not liable for any damage caused by these tools.
- You will comply with all local, state, and federal laws regarding cybersecurity.
What's inside
3 policy sections (offensive, defensive, legal) plus 3 sub-rules for offensive skills
Change this for your project
- Replace
Agent Skills Hubwith your repository name - Replace
SKILL.mdwith your skill metadata filename - Replace
Docker/VMwith your recommended sandbox environment
Where it goes
Load as policy context for the agent, or keep beside the code enforcing the rules.
Related Documents
DeepSeek R1: Case Study in Failed Extrinsic Alignment
Compiles public security research and independent findings to argue that extrinsic alignment methods are insufficient for AI safety, using DeepSeek R1 as a case study.
Guardrails, Safety & Content Filtering
Implements a layered guardrail system with input validation, output validation, and content filtering to protect LLM applications from prompt injection, jailbreaks, and data leaks.
My Hyprland Rice Setup - Context for Claude Code
Documents a Hyprland rice setup with system specs, aesthetic preferences, workflow safety practices, and a list of current issues to solve.
AI Safety & Guardrails for Voice Assistants
Defines a multi-layer safety architecture for voice assistants, covering input filtering, deterministic FAQ routing, RAG-grounded AI responses, and output guardrails.