explain

Name: explain
Availability: InStock
Author: empathic

Explain which policy rule matches a given tool invocation.

33|5|Updated Jan 27, 2026

Search Tags:#policy #sandbox #rules #explain #tool-invocation #clash

Ready to run

npx skills add https://github.com/empathic/clash --skill explain-empathic

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: explain
Source: https://github.com/empathic/clash/tree/main/clash-plugin/skills/explain
Command: npx skills add https://github.com/empathic/clash --skill explain-empathic

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Helps users understand why a tool invocation is allowed, denied, or requires approval by identifying the matching policy rules and their rationale.

Core Features & Use Cases

Identify which policy rules match a specific tool invocation and why.
Show the resulting decision (ALLOW, DENY, or ASK) and any sandbox implications.
Provide both human-friendly guidance and machine-readable output (JSON) for automation.
Use cases include policy debugging, onboarding new team members, and refining tool safety.

Quick Start

Run the explain command with the tool type and a command, clash explain bash "git push".

Frequently Asked Questions about explain

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I check which policy rule matches a bash command?▼

To check which policy rule matches a bash command, use the explain tool to identify the matched rule, display the resulting ALLOW, DENY, or ASK decision, and reveal any skipped rules for that specific tool invocation.

Why does a tool invocation require approval in my sandbox?▼

A tool invocation requires approval in your sandbox because a specific policy rule matched the command and returned an ASK decision, which you can verify by running the explain command to see the matched rules and rationale.

Can I get machine-readable output for policy debugging?▼

Yes, you can get machine-readable output for policy debugging because the explain command produces a JSON result alongside human-friendly guidance, enabling automation for tool safety refinement and onboarding.

How do I find out why a write operation was denied by policy rules?▼

To find out why a write operation was denied by policy rules, run the explain command with the tool type and command to reveal the matching DENY decision, the specific rationale, and any skipped rules.

Does the explain tool work with read and write scenarios?▼

Yes, the explain tool works with read and write scenarios, applying to command-like invocations across bash, read, write, and sandbox scenarios to reveal matched rules and decisions.