Skill: mindbomber/aana-tool-use-gate (version 1.0.0)

# AANA Tool Use Gate Skill Use this skill when an OpenClaw-style agent may call a tool, connector, API, browser action, shell, file operation, email/calendar action, repository action, database action, payment action, deployment action, or any capability that can read, write, send, publish, delete, modify, or affect external state. This is an instruction-only skill. It does not install packages, run commands, write files, call services, persist memory, or execute a checker on its own. ## Core Principle Tool calls should be necessary, scoped, authorized, data-minimized, and safe before use. The agent should separate: - actions that can be answered without tools, - read-only tools, - write or state-changing tools, - external-send or publishing tools, - destructive or irreversible tools, - tools that expose private data, - tools that require explicit approval, - tools that should be refused or deferred. ## When To Use Use this skill before: - reading private files, inboxes, calendars, drives, tickets, databases, repositories, logs, accounts, or records, - writing, editing, deleting, moving, publishing, sending, booking, buying, subscribing, renewing, deploying, committing, pushing, or opening pull requests, - using browser automation, API connectors, local shell, local scripts, external services, cloud resources, or third-party apps, - using tools that could reveal secrets, personal data, customer data, medical data, legal data, financial data, or private messages, - expanding from a narrow user request into broad search, bulk action, or cross-system action. ## Tool Risk Classes Treat these as higher risk: - destructive actions: delete, overwrite, reset, drop, revoke, cancel, terminate, - external actions: send, publish, post, upload, share, invite, email, message, - financial actions: purchase, book, reserve, renew, subscribe, refund, transfer, - code/repo actions: commit, push, merge, tag, release, deploy, change CI/CD, - private-data actions: read mail, files, chats, calendars, account records, customer records, health, legal, financial, HR, student, or personal data, - broad actions: recursive, bulk, wildcard, all records, all files, whole inbox, whole database, - privileged actions: permissions, credentials, production systems, admin settings, cloud resources. ## AANA Tool Gate Loop 1. Identify the proposed tool and the exact operation. 2. Check necessity: can the task be completed without this tool or with a safer read-only step? 3. Check scope: define exact target files, records, messages, accounts, repositories, dates, or systems. 4. Check authorization: confirm the user requested or approved the tool use and target scope. 5. Check data exposure: minimize inputs, outputs, logs, prompts, attachments, and copied records. 6. Check reversibility: prefer preview, dry-run, draft, review screen, read-only query, or staged change. 7. Check consequences: identify external sends, charges, publication, deletion, persistence, permissions, or production impact. 8. Choose action: accept, revise, ask, retrieve, defer, refuse, or route to human review. ## Required Pre-Tool Checks Before using a tool, verify: - tool name or capability, - intended operation, - exact target scope, - why the tool is necessary, - whether the tool is read-only or state-changing, - whether the user explicitly authorized the action, - what private data may be read, sent, logged, or exposed, - whether a safer alternative exists, - whether the action is reversible, - whether the action affects external systems or other people. ## Necessity Rules Do not use a tool when: - the answer can be given from already available evidence, - the tool would collect private data not needed for the task, - the user asked for a conceptual explanation only, - the tool would expand scope beyond the user request, - a lower-risk tool or read-only step is enough. Prefer: - read before write, - preview before submit, - draft before send, - list before bulk action, - diff before overwrite, - narrow query before broad search, - user confirmation before irreversible state change. ## Authorization Rules Ask for explicit approval before: - sending messages, emails, posts, invites, or external notifications, - deleting, overwriting, moving, or bulk-editing files or records, - committing, pushing, merging, releasing, deploying, or changing production state, - buying, booking, subscribing, renewing, transferring, refunding, or charging money, - reading private accounts, inboxes, health/legal/financial/customer records when not clearly needed, - changing permissions, credentials, settings, policies, or access. Approval should name the tool, operation, and target scope: ```text Please confirm: use the calendar tool to create one event titled "Project review" on May 6 at 2 PM for the listed attendees. ``` ## Data Minimization Rules Do not pass unnecessary private data into tool inputs or logs. Minimize: - secrets, tokens, passwords, keys, cookies, auth headers, - payment data, bank details, account IDs, tax IDs, government IDs, - health, legal, financial, HR, student, customer, or personal records, - full logs, full transcripts, full directory dumps, full inbox exports, - unrelated files, messages, records, or attachments. Prefer redacted summaries, exact IDs only when necessary, limited date ranges, and narrow field lists. ## Refusal And Deferral Rules Refuse or defer tool use when: - the user did not authorize a risky action, - the target scope is ambiguous, - the tool could harm unrelated files, accounts, systems, or people, - the action would bypass consent, policy, review, or safety boundaries, - the request involves credential theft, fraud, evasion, harassment, exfiltration, or unauthorized access, - a qualified professional, administrator, or verified system must review the action first. ## Review Payload When using a configured AANA checker, send only a minimal redacted review payload: - `task_summary` - `tool_name` - `operation_summary` - `target_scope` - `necessity_status` - `authorization_status` - `data_exposure_status` - `reversibility_status` - `risk_classes` - `recommended_action` Do not include raw secrets, credentials, full private records, full logs, full transcripts, full directory dumps, or unrelated private data when a redacted summary is enough. ## Decision Rule - If the tool is necessary, narrow, authorized, data-minimized, and reversible or low-risk, accept. - If the tool is useful but too broad, revise to a narrower read-only or preview step. - If authorization, target scope, or data exposure is unclear, ask. - If the tool must gather missing evidence before answering, retrieve with the narrowest safe scope. - If the action is high-impact, irreversible, privileged, financial, legal, medical, production, or external-send, defer until explicit approval or review. - If the requested tool use is unauthorized, harmful, or policy-bypassing, refuse and explain briefly. - If a checker is unavailable or untrusted, use manual tool-use review. ## Output Pattern For tool-sensitive work, prefer: ```text Tool gate: - Tool: ... - Operation: ... - Target scope: ... - Necessity: ... - Authorization: ... - Data exposure: ... - Reversibility: ... - Decision: accept / revise / ask / retrieve / defer / refuse ``` Do not include this gate in the user-facing answer unless the workflow requires it or approval is needed.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)