A security and privacy toolkit for AI agents. It covers protected data, agent identity, information sharing, reputation, and checks of the agent’s security setup.

Auditing protection, encrypting agent state, creating a signed identity report, sharing selected information, and connecting agents securely.

It helps identify security gaps and protect an agent’s stored data, identity, and interactions.

sanctuary — Skill for Claude Code by eriknewton

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add eriknewton/sanctuary-framework --skill sanctuary

Clone the repo

git clone --depth 1 https://github.com/eriknewton/sanctuary-framework

Made for: Claude Code.

Or install sanctuary-framework, the plugin that ships this one along with the rest of its 1 skill, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/eriknewton/sanctuary-framework/sanctuary/github.svg)](https://agentmods.dev/skills/eriknewton/sanctuary-framework/sanctuary)

Your own site

<a href="https://agentmods.dev/skills/eriknewton/sanctuary-framework/sanctuary"><img src="https://agentmods.dev/badge/skills/eriknewton/sanctuary-framework/sanctuary/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/eriknewton/sanctuary-framework/sanctuary"><img src="https://agentmods.dev/badge/skills/eriknewton/sanctuary-framework/sanctuary.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 120 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 3,210 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 1 finding, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

high Memory Poisoning · line 133
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Fix: Protect agent memory and state from modification by untrusted content. Use read-only memory for critical instructions and validate all state changes.

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00120	$0.03210
Opus 5	$0.00060	$0.01605
Sonnet 5	$0.00024	$0.00642
Haiku 4.5	$0.00012	$0.00321

Measured 2d ago against content hash 72d1b3690fc4, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

sanctuary scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugin/skills/sanctuary/SKILL.md · 234 lines

How it starts

The opening of the file, as written. The whole thing — 234 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Sanctuary Framework

Sanctuary gives your agent protection it can prove: encrypted state, self-custodied identity, selective disclosure, portable reputation, zero-knowledge proofs, federation, posture auditing, and a verifiable security posture.

Quick Start

Get protected in three steps:

Audit your posture: Run sanctuary/sovereignty_audit to see your current protection score, gaps, and prioritized recommendations.
Create your identity: Run sanctuary/identity_create to establish a cryptographic Ed25519 identity. This is your agent's foundation for signing, verification, and non-repudiation.
Generate your SHR: Run sanctuary/shr_generate to create your first Sovereignty Health Report, a signed, machine-readable proof of your protection capabilities.

OpenClaw Users

If you're running OpenClaw (v2026.3.28+), Sanctuary adds four protections that OpenClaw doesn't provide:

What OpenClaw gives you:

requireApproval in before_tool_call hooks: binary approve/deny gating
tools.sandbox.tools.alsoAllow: sandbox tool allow/deny lists
Local agent execution

What Sanctuary adds on top:

Encrypted state: Your MEMORY.md, daily notes, and .env secrets are plaintext in OpenClaw. Sanctuary encrypts all state at rest with AES-256-GCM (Argon2id key derivation).
Cryptographic identity: OpenClaw has no agent identity. Sanctuary gives your agent an Ed25519 keypair for signing, verification, and handshakes.
Graduated approval: OpenClaw's requireApproval is binary. Sanctuary's three-tier Principal Policy auto-allows routine ops (Tier 3), escalates anomalies (Tier 2), and requires human approval for irreversible ops (Tier 1).
Selective disclosure: Prove facts about your state without revealing it. SHA-256 + Pedersen commitments, Schnorr ZK proofs, range proofs.
Portable reputation: Signed EAS-compatible attestations that you own and can export through current paths, with full exit still partial until IC-07, IC-08, IC-09 close.

Read the full file on GitHub · 234 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago Changed 72d1b3690fc4
3d ago Changed e9558b01aa33
4d ago Changed · +23 lines 744f7e5756a7
8d ago First seen · 211 lines · 120 tokens per session scan A ddc285e75bd5

Subscribe to this mod's changes

sanctuary is a skill published in the GitHub repository eriknewton/sanctuary-framework (8 stars, last pushed yesterday), licensed Apache-2.0. It adds 120 tokens to every session and 3,210 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Building agents Security agent-infrastructure ai-agent-security ai-agents decentralized-identity open-standard privacy

agent-reach

An internet-search and platform-access router for finding information across websites and services such as Reddit, X, GitHub, YouTube, and job sites.

Panniantong/Agent-Reach · 349 tokens

xiaohongshu-search-full

Search Xiaohongshu (XHS / RedNote) notes by keyword with full field extraction including body text, topics/tags, image list URLs, video stream URL, publish timestamp, and all engagement stats (likes, collects, comments, shares). Supports all page filter options: sort order (general, latest, most liked, most commented…

browser-act/skills · 254 tokens

youtube-channel-business-email

YouTube channel business email and contact extractor: accepts a channel id (UCxxx), handle (@name), or URL; navigates the channel About view; extracts the business email from the description text plus full channel metadata (name, id, country, subscriber count, view count, video count, joined date, external links…

browser-act/skills · 324 tokens

x-dm-auto-chat

X (Twitter) DM automated chat end-to-end Skill: scan DM inbox to identify pending-reply conversations, read message history, generate persona-based replies and send; also supports searching users and starting new conversations. Built-in E2E passcode unlock, DM permission filtering, and rate control. Use when user…

browser-act/skills · 128 tokens

1688-product-detail

Extracts comprehensive wholesale product data from 1688.com product detail pages: title, tiered pricing, SKU variants with dimensions/weight, product images, seller info, shop scores, buyer protection, cross-border flags, product attributes, coupon/promotion data, and review stats. Use when user mentions 1688…

browser-act/skills · 212 tokens

x-tweet-by-conversation

Collects every tweet in an X (Twitter) conversation thread given a conversation id (root tweet id) — the focal tweet plus all replies, sub-replies, and quote chains — and returns normalized per-tweet data with text, author, engagement counts, media, hashtags, mentions, inreplyto mapping, and cursor for pagination. Use…

browser-act/skills · 218 tokens