skills.rest
mathematic-inc
mathematic-incOFFICIAL
Explore all skills by this author →
GitHub

secure-agent

Configures agent permissions and restricts network access via NACL rules.

112|7|Updated Feb 22, 2026
Search Tags:#security#access control#agent#earl#tool restriction#network egress
One-click install
npx skills add https://github.com/mathematic-inc/earl --skill secure-agent-mathematic-inc
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: secure-agent
Source: https://github.com/mathematic-inc/earl/tree/main/skills/development/secure-agent
Command: npx skills add https://github.com/mathematic-inc/earl --skill secure-agent-mathematic-inc

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill prevents an AI agent from bypassing its intended tools and making unauthorized direct API or CLI calls, ensuring that all interactions are mediated and logged through secure channels like Earl.

Core Features & Use Cases

  • Tool Restriction: Blocks specific bash commands (e.g., curl, gh) at the platform level for AI agents.
  • Network Egress Control: Restricts the URLs that Earl templates can contact, preventing its use as an open proxy.
  • Use Case: After setting up Earl to manage API interactions for your agent, you can use this skill to enforce that the agent must use Earl for all network requests and CLI operations, rather than attempting to execute them directly.

Quick Start

Use the secure-agent skill to add curl and gh to the denied tools list for your agent.

Frequently Asked Questions about secure-agent

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent an AI agent from running unauthorized bash commands like curl or gh?▼

AI agent access control blocks specific bash commands such as curl and gh at the platform level using tool restriction denylists. This prevents the agent from bypassing intended tools and making unauthorized direct CLI calls.

What is network egress control for AI agents and how does it work?▼

Network egress control restricts the URLs that Earl templates can contact, preventing their use as open proxies. It enforces secure agent operation by applying network allowlists to all outgoing requests.

How do I force an AI agent to route all API requests through a secure proxy?▼

To force API requests through a secure proxy, configure tool restrictions to block direct network access and apply Earl network egress rules. This ensures all interactions are mediated and logged through Earl.

Can I use Earl to restrict my agent's access to external services?▼

Yes, Earl can restrict agent access to external services. After setting up Earl to manage API interactions, you configure network egress allowlists to control which URLs the agent is permitted to contact.

What are the limitations of using tool denylists for agent security?▼

Tool denylists only block specific bash commands at the platform level. They do not inherently restrict network access unless paired with network egress rules, meaning agents could still bypass blocked commands using alternative tools.

Why does my AI agent bypass Earl and attempt direct API calls?▼

An AI agent attempts direct API calls when tool restrictions are not enforced. Adding commands like curl and gh to a denied tools list forces the agent to use Earl for all network requests and CLI operations.

Related Skills

Explore More Software Engineering Skills→
brwsebrwse
112

secure-agent

Generate deniedTools and network.allow rules to block agent CLI and HTTP access.

Official
Intermediate
gke-labsgke-labs
42

review-security-k8s-agents-firewall

Audit Kubernetes network policies and firewall rules for AI agent sandboxes.

Official
Intermediate
brwsebrwse
112

create-template

Create Earl HCL templates for external services and commands.

Official
Advanced
TheophilusChinomonaTheophilusChinomona
2

openclaw-sandboxing

Manage Docker-based sandboxing for tool execution with configurable isolation modes and network policies.

Community
Advanced