skills.rest
githubgithubOfficial·4 Agent Skills Included

gh-aw-firewall

Sandboxed network firewall with domain whitelisting for workflows

Runs any command inside a sandboxed Docker network that restricts outbound HTTP/HTTPS traffic to an approved domain allowlist. Keeps sensitive API keys out of the agent environment by injecting credentials through an isolated proxy sidecar. Includes debugging scripts and log parsers that quickly surface blocked domains, container health issues, and traffic statistics. Eliminates manual firewall tuning and verbose log digging when securing automated workflows.
123|45
↗
npx skills add github/gh-aw-firewall --all -g -y
Available:

Explains the firewall's container architecture, CLI workflow, and debugging procedures so the agent can operate, test, and troubleshoot the sandboxed network environment correctly.

All Skills in This Repository (4)

Pure Emerald Level Indicators
📦 In Repo
githubgithub

awf-skill

Enforce domain allowlists and host-level protections for AI agent network access.

Official
Advanced
📦 In Repo
githubgithub

debug-firewall

Inspect awf-squid and awf-agent containers, Squid logs, and iptables rules to diagnose AWF firewall issues.

Official
Intermediate
📦 In Repo
githubgithub

recompile-workflows

Regenerate and post-process agentic workflow lock files after gh-aw updates.

Official
Intermediate
📦 In Repo
githubgithub

awf-debug-tools

Parse AWF logs and container health to diagnose firewall problems.

Official
Intermediate

Frequently Asked Questions

FAQPage Schema
How to install gh-aw-firewall?▼

Run `npx skills add github/gh-aw-firewall --all -g -y` in your terminal to install all skills in this suite globally.

What does gh-aw-firewall do?▼

It runs any command inside a Docker sandbox where all outbound HTTP/HTTPS traffic passes through a Squid proxy that only allows whitelisted domains. This lets you run automated workflows and agents with strict network isolation.

How do I allow specific domains through the firewall?▼

Pass a comma-separated list with the --allow-domains flag, for example `sudo awf --allow-domains github.com,api.github.com -- curl https://api.github.com`. Subdomains of allowed domains are matched automatically.

How are API keys protected in gh-aw-firewall?▼

An optional API proxy sidecar holds the real credentials for OpenAI, Anthropic, Copilot, and Gemini, so keys never appear in the agent's environment. The agent calls the sidecar without auth and the sidecar injects the real key before forwarding.

How do I debug blocked domains in gh-aw-firewall?▼

Use the included debug skills and Python scripts to parse Squid logs, list blocked domains, and test domain reachability. Commands like `awf logs --format json` or the parse-squid-logs.py script show exactly which requests were denied.

Related Repositories in Software Engineering

View All in Software Engineering→
openclawopenclaw
388.4k

openclaw

Run a personal AI assistant across your devices and chat apps

Official📦 120 Skills
obraobra
280.0k

superpowers

Gives coding agents a disciplined workflow from idea to merged code

Community📦 15 Skills
facebookfacebook
248.4k

react

AI agent skills for building, testing, and porting React core

Official📦 14 Skills