Security Model

Security Model

Read this before enabling execution.

SkynetClaw runs autonomous agents that can read and write files, execute shell commands, and reach the network. That is what it is for, and it is also the risk. This page states the boundaries plainly rather than leaving them to be discovered.

---

What protects you

The GPS-2 gate — deny-by-default

[Governance] GPS-2 gate armed — deny-by-default · human gate on irreversible tools

Rule	Meaning
Deny-by-default	anything not explicitly allowed is denied
Pre-execution	the gate runs before the tool call, not after the effect
Irreversible ⇒ human	irreversible actions need an explicit grant and a human gate
Every decision logged	allow, deny, escalate — all audited
No self-widening	an agent cannot grant itself permissions

The policy stack

Seven policies at three hooks, most-restrictive-wins, fail-closed (an error denies):

PRE_ACT       governance.gps2 · shadow.fabrication · approvals.prior_deny · run.tool_allow
PRE_VALIDATE  cvl.quality_gate
PRE_COMMIT    guidance.g1 · warrant.cee_c1

Only the four PRE_ACT policies stand between a decision and a side effect on your machine — that is the gate this page is about. shadow.fabrication refuses an action whose intent is to invent evidence; run.tool_allow limits which tools a given run may use at all.

The other three guard truthfulness rather than the filesystem: cvl.quality_gate before output is accepted as valid, and guidance.g1 / warrant.cee_c1 before a claim is committed as belief. They are load-bearing, but they will not stop a destructive tool call — do not count them twice.

Do not disable these. They are what makes autonomy survivable, and turning them off removes the only thing standing between a confused model and your filesystem.

---

What does not protect you

Not protected	Reality
Sandboxing	there is none by default. Point it at a workspace you are willing to lose.
API authentication	none. Port 8766 binds to loopback for this reason.
Model truthfulness	model output is not verified truth. See Outcome Tracking.
Prompt injection	content the agent reads — a web page, a document, a tool result — can attempt to redirect it. Treat everything it fetches as untrusted.
Network egress	not restricted. If that matters, restrict it at the OS or container level.

---

Practical guidance

Do

• keep the GPS-2 gate and the human gate on
• run it against a scratch workspace, not your main projects, until you trust it
• use a dedicated unprivileged user (see Linux for a systemd unit)
• read /api/router/audit and the governance log to see what it actually did
• keep the backend on 127.0.0.1

Do not

• expose port 8766 to a LAN or the internet without an authenticating proxy
• run it as root or as an administrator
• point it at a directory containing credentials, keys, or production data
• paste a real API key into the chamber — put it in .env

---

Reporting a vulnerability

Use GitHub Security Advisories rather than a public issue. The most serious class is anything that bypasses the PRE_ACT gate or lets an agent widen its own permissions — that inverts the safety model rather than merely degrading it.

→ Next: Troubleshooting