awf-skill

Name: awf-skill
Availability: InStock
Author: GitHub

Enforce domain allowlists and host-level protections for AI agent network access.

123|45|Updated Oct 16, 2025

Search Tags:#cli #docker #firewall #sandbox #awf #iptables #domain-whitelisting

Ready to run

npx skills add https://github.com/github/gh-aw-firewall --skill awf-skill

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: awf-skill
Source: https://github.com/github/gh-aw-firewall/tree/main
Command: npx skills add https://github.com/github/gh-aw-firewall --skill awf-skill

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

AWF enables AI agents to run commands while enforcing a strict domain allowlist and host-level protections, removing the risk of uncontrolled network access.

Core Features & Use Cases

Domain whitelisting for HTTP/HTTPS traffic with host-level enforcement
Optional chroot mode to access host binaries securely while maintaining isolation
Docker-based container orchestration to run commands in a sandboxed environment (e.g., Copilot CLI, Playwright tests)

Quick Start

Run a simple command through AWF to verify that only the allowed domains can be reached.

Frequently Asked Questions about awf-skill

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I restrict AI agent network access to a specific domain allowlist?▼

AWF enforces a strict domain allowlist for AI agents by combining iptables-based host-level protections with Squid proxy configurations, blocking all non-whitelisted HTTP and HTTPS egress traffic.

Can I run Playwright tests in a Docker sandbox with network isolation?▼

Yes, AWF orchestrates Docker-based container configurations to run Playwright tests in a network-isolated sandbox, enforcing predictable egress behavior through strict domain whitelisting and iptables rules.

What is the best way to secure Copilot CLI egress traffic in automated workflows?▼

AWF secures Copilot CLI egress traffic by running commands in a sandboxed Docker environment with strict domain whitelisting and host-level iptables protections, ensuring predictable network behavior across heterogeneous environments.

Does AWF support chroot access to host binaries while maintaining network isolation?▼

Yes, AWF offers an optional chroot mode that securely accesses host binaries while maintaining network isolation through its strict domain allowlist and iptables-based host-level enforcement.

How do I configure iptables and Squid for MCP server network sandboxing?▼

AWF configures iptables and Squid for MCP server network sandboxing by deploying Docker container orchestration with carefully scoped configurations to enforce strict domain whitelisting and host-level protections.

What are the limitations of using Docker for domain whitelisting in AI agent workflows?▼

Limitations of using Docker for domain whitelisting include managing heterogeneous environment configurations and ensuring host-level iptables rules align with Squid proxy settings, which AWF addresses through carefully scoped container configurations.