Borrowing it
Nothing to install: this file belongs to schmitthub/clawker. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/schmitthub/clawker/main/.agents/skills/firewall-uat/SKILL.mdgit clone --depth 1 https://github.com/schmitthub/clawkerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/schmitthub/clawker/firewall-uat)<a href="https://agentmods.dev/skills/schmitthub/clawker/firewall-uat"><img src="https://agentmods.dev/badge/skills/schmitthub/clawker/firewall-uat/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/schmitthub/clawker/firewall-uat"><img src="https://agentmods.dev/badge/skills/schmitthub/clawker/firewall-uat.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00060 | $0.01631 |
| Opus 5.5 | $0.00024 | $0.00652 |
| Sonnet 5.5 | $0.00012 | $0.00326 |
| Haiku 4.5 | $0.00006 | $0.00163 |
Grade A, and why
firewall-uat scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
`curl`, `ssh` (+ forwarded host agent), `nghttp` + `h2load` (HTTP/2 + h2 WS; How it starts
The opening of the file, as written. The whole thing — 99 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Firewall Runtime UAT
Golden files + envoy --mode validate prove the generated config is valid.
They do NOT prove behavior. Behavior is verified live, and you are the
vehicle: when $CLAWKER_AGENT is set, this agent session runs inside a
clawker agent container whose egress is routed through the live firewall
stack (eBPF redirect → Envoy → CoreDNS). Exercising egress from this shell IS
the behavioral test.
Roles
- You (in-container): exercise egress with the probe tools below. You
CANNOT run host
clawker; the CLI runs on the host only. - User (host operator): mutates rules host-side —
clawker firewall add <host> [--proto https|http|ssh|tcp|wss|...] [--port N|lo-hi] [--path /p --action allow|deny]. Ask them to add/remove rules; then you re-probe. To live-apply aclawker.yamlegress edit (security.firewall.add_domains/security.firewall.rules) without a restart, have them runclawker firewall refresh(global, no--agent; add/update only — deletes still go throughclawker firewall remove).
clawker firewall add flags: --proto (default https), --port (default
proto-specific; single port 443 or inclusive range 9000-9100), --path + --action (path-scoped rule, required together).
Probe tools available in-container
curl, ssh (+ forwarded host agent), nghttp + h2load (HTTP/2 + h2 WS;
h2load also does h3 — useful for the QUIC/alt-svc sibling), websocat,
wscat, python3, openssl, gh, git. nc is absent. The SSH agent is
the host's, live-mirrored through the socketbridge (fresh net.Dial per
connection — no cache; ssh-add -l reflects host agent state at that instant).
No tool here drives an h2/h3 Extended CONNECT WebSocket (websocat = h1.1
only; nghttp -u = h2c upgrade, not WS). So WS-over-h1.1 is runtime-testable
(websocat wss://…/ws/echo → C2 echoes the frame back through the MITM), but
the h2 (allow_connect) / h3 (allow_extended_connect) WS paths are only
config-confirmable (grep -c allow_connect), not live-drivable in-container.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 99 lines · 60 tokens per session scan A ff4a0c2886e3
firewall-uat is a skill published in the GitHub repository schmitthub/clawker (58 stars, last pushed today), licensed MIT. It adds 60 tokens to every session and 1,631 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-08.
Other skills, from other repositories
hardening-docker-containers-for-production
Hardening Docker containers for production involves applying security best practices aligned with CIS Docker Benchmark v1.8.0 to minimize attack surface, prevent privilege escalation, and enforce leas.
implementing-container-image-minimal-base-with-distroless
Reduce container attack surface by building application images on Google distroless base images that contain only the application runtime with no shell, package manager, or unnecessary OS utilities.
scanning-docker-images-with-trivy
Trivy is a comprehensive open-source vulnerability scanner by Aqua Security that detects vulnerabilities in OS packages, language-specific dependencies, misconfigurations, secrets, and license violati.
release-ota-promote
Publish signed Electron UI/daemon bundles to a local OTA feed with atomic manifest switch and digest readback, while dry-running the K8s drainrespawn rollout. Prod is refused before writes; feed publication is not client apply.
ecspresso
ECS deployment tool - deploy, manage, and troubleshoot ECS services.
docker-local-build
Build and test Kurtosis from source on local Docker. Compiles all components (engine, core, files-artifacts-expander), builds Docker images, installs the CLI, and restarts the engine. Use when developing Kurtosis and testing changes locally with Docker.