skills.rest
zxc1a1a1
zxc1a1a1COMMUNITY
Explore all skills by this author →
GitHub

security-boundary-contract

Define security boundary contracts for agent-collaboration platforms.

Updated May 19, 2026
Search Tags:#authorization#secret management#security policy#iframe sandbox#audit testing#tool safety#error redaction
One-click install
npx skills add https://github.com/zxc1a1a1/Multi_Agent-AgentHub --skill security-boundary-contract
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-boundary-contract
Source: https://github.com/zxc1a1a1/Multi_Agent-AgentHub/tree/main/.agents/skills/security-boundary-contract
Command: npx skills add https://github.com/zxc1a1a1/Multi_Agent-AgentHub --skill security-boundary-contract

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It defines AgentHub’s end-to-end security boundary so engineers, reviewers, and AI agents can consistently decide what is untrusted, what must be authorized, and what must never be leaked.

Core Features & Use Cases

  • Trust boundary model: Establishes which inputs and outputs (user, Frontend fields, LLM/Planner, Agent outputs, AgentCards, artifacts, tool call parameters) are untrusted and must be validated before execution.
  • Security contract for each layer: Specifies public API rules for Frontend→Gateway, service-to-service constraints for Gateway↔Orchestrator, orchestration guardrails, and Child/User Agent trust levels.
  • High-risk action governance: Enforces confirm_action for dangerous capabilities (run_command, deploy, file_overwrite, external_publish, etc.) plus requirements for schema validation, permission checks, timeouts, and auditing.
  • Data protection and rendering safety: Provides artifact/runtime capability risk levels, iframe sandbox/CSP/XSS defenses, and strict error redaction to stop secret leakage.
  • Security testing & review checklist: Includes minimal contract tests and a structured review checklist to verify the boundary stays intact across v1.0 evolution.

Quick Start

Ask an AI reviewer to use security-boundary-contract to produce an audit plan for your Gateway and Orchestrator changes, including required confirm_action gates, object-level authorization checks, and redaction rules for errors and artifacts.

Frequently Asked Questions about security-boundary-contract

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent unauthorized execution and secret leakage in agent collaboration platforms?▼

To prevent unauthorized execution and secret leakage, you need a security boundary contract that applies trust modeling, object-level authorization, and strict redaction across frontend, gateway, orchestrator, and runtime layers.

What is a trust boundary model for AI agents and when do I need it?▼

A trust boundary model identifies untrusted inputs like user fields, LLM outputs, and tool parameters for validation before execution. You need it when building agent platforms to prevent untrusted data from triggering insecure actions.

How do I enforce confirm_action gates for high-risk agent capabilities like deploy or file_overwrite?▼

You enforce confirm_action gates by applying schema validation, permission checks, timeouts, and auditing to high-risk capabilities. A security boundary contract requires these governance controls for dangerous actions like run_command and external_publish.

Does iframe sandbox with CSP prevent XSS in agent artifact rendering?▼

Iframe sandbox combined with CSP and XSS defenses protects artifact and runtime rendering. The security boundary contract specifies these defenses and strict error redaction to stop secrets from leaking through rendered outputs.

How do I write security contract tests for gateway and orchestrator changes?▼

Write security contract tests by verifying boundary integrity through object-level authorization checks, confirm_action gates, and redaction rules. Use a structured review checklist to validate trust boundaries stay intact across deployment updates.

What service-to-service authentication constraints apply between gateway and orchestrator?▼

Service-to-service constraints require explicit authorization and structured validation between gateway and orchestrator. The security contract specifies orchestration guardrails and child agent trust levels to prevent unauthorized execution paths.

Related Skills

Explore More Legal & Compliance Skills→
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

security-audit-context-building

Map architecture, trust boundaries, and data flows for security audit scoping.

Official
Advanced
protofireprotofire
3

protofire-qa-agent

Audit smart contracts with Slither, Echidna, and Foundry fuzz testing.

Official
Advanced
JuanTaco4YouJuanTaco4You

security-secrets-and-logging

Enforce redaction and safe logging to prevent credential and PII leakage.

Community
Basic
WbunkerWbunker

api-architecture

Guide API architecture design across REST, gRPC, and GraphQL.

Community
Advanced