[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AD9JSZV0050S2AT91NWVS4":3,"skill-same:01M6AD9JSZV0050S2AT91NWVS4":77},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":53,"commitSha":54,"skillDirectory":55,"forksCount":56,"repositoryHtmlUrl":57,"repositoryHomepageUrl":58,"ownerHtmlUrl":59,"ownerBlogUrl":60,"ownerDescription":61,"updatedAt":62,"install":63,"resources":76},"01M6AD9JSZV0050S2AT91NWVS4","diagnose-awf",null,"Diagnose an AWF (Agentic Workflow Firewall) failure from an error, workflow run URL, or symptom. Covers auth (api-proxy, enterprise\u002FBYOK Copilot, OIDC, mcpg), ARC\u002FDinD and self-hosted runners, alternative runtimes (gVisor\u002FKata\u002Fchroot), Squid\u002FDNS\u002Fegress denials, CI and gh-aw safe-output failures, and suspected security regressions. Routes to the canonical diagnosis registry in docs\u002Fdiagnostics.","github\u002Fgh-aw-firewall","github","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","01M6AC83DS133TPXFSP1DHNCC6","GitHub","01M6AD985Y1G0AQ64JV7KPQWZ4",159,"MIT","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw-firewall\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdiagnose-awf\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"diagnose","diagnose awf","runners","URL","error","diagnosis","self","byok","read","Bash","api","firewall","dns","ci","proxy","docs","npm","registry","run","diagnostics","copilot","auth","workflow","agentic workflow","security","docker","agentic","safe","2026-11-10 10:12:30",false,"---\nname: diagnose-awf\ndescription: Diagnose an AWF (Agentic Workflow Firewall) failure from an error, workflow run URL, or symptom. Covers auth (api-proxy, enterprise\u002FBYOK Copilot, OIDC, mcpg), ARC\u002FDinD and self-hosted runners, alternative runtimes (gVisor\u002FKata\u002Fchroot), Squid\u002FDNS\u002Fegress denials, CI and gh-aw safe-output failures, and suspected security regressions. Routes to the canonical diagnosis registry in docs\u002Fdiagnostics.\nallowed-tools: Bash(docker:*), Bash(gh:*), Bash(npx:*), Bash(npm:*), Bash(grep:*), Read\n---\n\n# Diagnose AWF Failures\n\nSingle entry point for diagnosing AWF failures. The canonical knowledge lives in\nthe diagnosis registry — this skill only routes and reports.\n\n## Procedure\n\n1. **Read the index** — [`docs\u002Fdiagnostics\u002FREADME.md`](..\u002F..\u002F..\u002Fdocs\u002Fdiagnostics\u002FREADME.md)\n   for boundary routing and specialist references, and\n   [`docs\u002Fdiagnostics\u002Fagent-playbook.md`](..\u002F..\u002F..\u002Fdocs\u002Fdiagnostics\u002Fagent-playbook.md)\n   for the report shape and safety rules.\n2. **Fingerprint** the run: AWF version, runner type (GitHub-hosted \u002F\n   self-hosted \u002F ARC+DinD \u002F GHES \u002F GHEC), `DOCKER_HOST`, `GITHUB_SERVER_URL`,\n   container runtime, provider, auth mode. Use `unknown` where unverified.\n3. **Classify the failing boundary**: `runner`, `runtime`, `network`, `auth`,\n   `ci`, `security`.\n4. **Load only matching records**:\n\n   ```bash\n   npx tsx scripts\u002Fdiagnostics\u002Fcli.ts search \"\u003Credacted error string>\" --boundary \u003Cboundary>\n   ```\n\n   Without a clone, use the portable artifact\n   `.github\u002Fagents\u002Fdiagnose-awf.md` (prefer a tag matching your AWF version).\n5. **Probe** with the matched finding's read-only probe when the match is\n   ambiguous — one probe at a time.\n6. **Report**: observed symptom, matched finding ID and evidence, affected\n   version\u002Ftopology, safe next probe, fix\u002Fworkaround, citations.\n\n## Auth routing\n\n- **api-proxy sidecar \u002F provider token exchange** → `AUTH-001`, `AUTH-002`\n- **GitHub\u002FCopilot enterprise and BYOK routing** → `AUTH-001`, [`docs\u002Fauth-matrix.md`](..\u002F..\u002F..\u002Fdocs\u002Fauth-matrix.md)\n- **gh-aw-launched mcpg HTTP MCP GitHub OIDC** → `AUTH-003`\n\nCheck configuration presence\u002Fshape, route and health status, and redacted error\nclasses only.\n\n## Safety rules\n\n- Never request API keys, tokens, JWTs, `Authorization` headers, environment\n  dumps, inference probes, or token exchanges.\n- Never recommend `--env-all`, disabling isolation, or broadening the domain\n  allowlist by default.\n- Suspected isolation or credential-boundary regressions route to `SEC-001` and\n  the repository security review process.\n- If no record matches, say so, name the smallest missing evidence, and stop.\n  Never invent a fix.\n\n## Specialist references\n\n- `.github\u002Fworkflows\u002Fshared\u002Fself-hosted-failure-modes.md` — full runner catalog\n- `.github\u002Fskills\u002Fdebug-firewall\u002FSKILL.md` — Squid, iptables, container state\n- `.github\u002Fskills\u002Fawf-debug-tools\u002FSKILL.md` — log parsing helpers\n- `.github\u002Fskills\u002Fdebugging-workflows\u002FSKILL.md` — GitHub Actions log retrieval\n- `docs\u002Fauth-matrix.md`, `docs\u002Fcompatibility.md`, `docs\u002Ftroubleshooting.md`\n\n## Updating knowledge\n\nFollow [`docs\u002Fdiagnostics\u002Fpatterns.md`](..\u002F..\u002F..\u002Fdocs\u002Fdiagnostics\u002Fpatterns.md).\nEdit the canonical record, run `npm run diagnostics:render`, and open a reviewed\nPR. Never edit generated artifacts or `.lock.yml` files by hand.\n","# Diagnose AWF Failures\n\nSingle entry point for diagnosing AWF failures. The canonical knowledge lives in\nthe diagnosis registry — this skill only routes and reports.\n\n## Procedure\n\n1. **Read the index** — [`docs\u002Fdiagnostics\u002FREADME.md`](..\u002F..\u002F..\u002Fdocs\u002Fdiagnostics\u002FREADME.md)\n   for boundary routing and specialist references, and\n   [`docs\u002Fdiagnostics\u002Fagent-playbook.md`](..\u002F..\u002F..\u002Fdocs\u002Fdiagnostics\u002Fagent-playbook.md)\n   for the report shape and safety rules.\n2. **Fingerprint** the run: AWF version, runner type (GitHub-hosted \u002F\n   self-hosted \u002F ARC+DinD \u002F GHES \u002F GHEC), `DOCKER_HOST`, `GITHUB_SERVER_URL`,\n   container runtime, provider, auth mode. Use `unknown` where unverified.\n3. **Classify the failing boundary**: `runner`, `runtime`, `network`, `auth`,\n   `ci`, `security`.\n4. **Load only matching records**:\n\n   ```bash\n   npx tsx scripts\u002Fdiagnostics\u002Fcli.ts search \"\u003Credacted error string>\" --boundary \u003Cboundary>\n   ```\n\n   Without a clone, use the portable artifact\n   `.github\u002Fagents\u002Fdiagnose-awf.md` (prefer a tag matching your AWF version).\n5. **Probe** with the matched finding's read-only probe when the match is\n   ambiguous — one probe at a time.\n6. **Report**: observed symptom, matched finding ID and evidence, affected\n   version\u002Ftopology, safe next probe, fix\u002Fworkaround, citations.\n\n## Auth routing\n\n- **api-proxy sidecar \u002F provider token exchange** → `AUTH-001`, `AUTH-002`\n- **GitHub\u002FCopilot enterprise and BYOK routing** → `AUTH-001`, [`docs\u002Fauth-matrix.md`](..\u002F..\u002F..\u002Fdocs\u002Fauth-matrix.md)\n- **gh-aw-launched mcpg HTTP MCP GitHub OIDC** → `AUTH-003`\n\nCheck configuration presence\u002Fshape, route and health status, and redacted error\nclasses only.\n\n## Safety rules\n\n- Never request API keys, tokens, JWTs, `Authorization` headers, environment\n  dumps, inference probes, or token exchanges.\n- Never recommend `--env-all`, disabling isolation, or broadening the domain\n  allowlist by default.\n- Suspected isolation or credential-boundary regressions route to `SEC-001` and\n  the repository security review process.\n- If no record matches, say so, name the smallest missing evidence, and stop.\n  Never invent a fix.\n\n## Specialist references\n\n- `.github\u002Fworkflows\u002Fshared\u002Fself-hosted-failure-modes.md` — full runner catalog\n- `.github\u002Fskills\u002Fdebug-firewall\u002FSKILL.md` — Squid, iptables, container state\n- `.github\u002Fskills\u002Fawf-debug-tools\u002FSKILL.md` — log parsing helpers\n- `.github\u002Fskills\u002Fdebugging-workflows\u002FSKILL.md` — GitHub Actions log retrieval\n- `docs\u002Fauth-matrix.md`, `docs\u002Fcompatibility.md`, `docs\u002Ftroubleshooting.md`\n\n## Updating knowledge\n\nFollow [`docs\u002Fdiagnostics\u002Fpatterns.md`](..\u002F..\u002F..\u002Fdocs\u002Fdiagnostics\u002Fpatterns.md).\nEdit the canonical record, run `npm run diagnostics:render`, and open a reviewed\nPR. Never edit generated artifacts or `.lock.yml` files by hand.\n",{"name":5,"description":7,"allowed-tools":52},"Bash(docker:*), Bash(gh:*), Bash(npx:*), Bash(npm:*), Bash(grep:*), Read","main","564491e648e022be04aa96b73c1681f13f7544f8",".claude\u002Fskills\u002Fdiagnose-awf",83,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw-firewall","https:\u002F\u002Fgithub.github.com\u002Fgh-aw-firewall\u002F","https:\u002F\u002Fgithub.com\u002Fgithub","https:\u002F\u002Fgithub.com\u002Fabout","How people build software.","2026-11-12 03:12:21",{"source":8,"skillName":5,"commands":64,"prompt":74,"zipAvailable":75},[65,68,71],{"tool":66,"command":67},"npx","npx skills add github\u002Fgh-aw-firewall --skill diagnose-awf",{"tool":69,"command":70},"bunx","bunx skills add github\u002Fgh-aw-firewall --skill diagnose-awf",{"tool":72,"command":73},"pnpm","pnpm dlx skills add github\u002Fgh-aw-firewall --skill diagnose-awf","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw-firewall\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdiagnose-awf\u002FSKILL.md",true,[],[78,109,123,139,163,185],{"skillNo":79,"name":80,"nameZh":6,"description":81,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":95,"publishedAt":47},"01M6AD9DV31R7XRJ0QZR1MYQPS","awf-skill","Use the AWF (Agentic Workflow Firewall) to run commands with network isolation and domain whitelisting. Provides L7 HTTP\u002FHTTPS egress control for AI agents.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw-firewall\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fawf-skill\u002FSKILL.md",[84,89,92],{"categoryNo":85,"categoryName":86,"taxonomyType":87,"taxonomyTypeDesc":88},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":90,"categoryName":91,"taxonomyType":87,"taxonomyTypeDesc":88},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":93,"categoryName":94,"taxonomyType":87,"taxonomyTypeDesc":88},"01JBSEEDCAT000000000000023","Skill与智能体开发",[96,42,44,97,41,45,98,37,99,30,27,100,101,102,103,104,105,28,106,107,108],"awf skill","http","ai agents","https","sudo","isolation","domain","for","use","false","commands","network","with",{"skillNo":110,"name":80,"nameZh":6,"description":81,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":111,"sourceHtmlUrl":112,"categories":113,"keywords":122,"publishedAt":47},"01M6ADA1AXWT8GAAAZ2MJV1YF1","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw-firewall\u002Fblob\u002Fmain\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw-firewall\u002Fblob\u002Fmain\u002Fskill.md",[114,115,116,117],{"categoryNo":85,"categoryName":86,"taxonomyType":87,"taxonomyTypeDesc":88},{"categoryNo":90,"categoryName":91,"taxonomyType":87,"taxonomyTypeDesc":88},{"categoryNo":93,"categoryName":94,"taxonomyType":87,"taxonomyTypeDesc":88},{"categoryNo":118,"categoryName":119,"taxonomyType":120,"taxonomyTypeDesc":121},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[96,42,44,97,41,45,98,37,99,30,27,100,101,102,103,104,105,28,106,107,108],{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":129,"publishedAt":47},"01M6AD9ZKQJBHWBVNQEERBCT0V","sandbox-filesystem-access","Configure or diagnose file and directory access, mounts, and host ACLs for AWF sandboxes.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw-firewall\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fsandbox-filesystem-access\u002FSKILL.md",[],[130,131,132,133,19,134,135,103,136,137,138],"sandbox","sandbox filesystem access","filesystem","access","file","directory","sandboxes","host","configure",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":145,"publishedAt":47},"01M6AD9XDE32KBEV4V8SXVXQ0D","pr-finisher","Prepare an open pull request for merge from a GitHub Copilot cloud agent. Drives Reviews, local validation, and Mergeable to a ready state. Does not merge, and cannot trigger CI.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw-firewall\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fpr-finisher\u002FSKILL.md",[],[146,147,148,149,150,9,151,152,32,153,39,154,155,156,157,158,103,159,160,161,162],"pr finisher","pr","pull","state","github copilot","pull request","merge","validation","open pull request","cloud","prepare","ready","reviews","trigger","local","open","request",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":169,"publishedAt":47},"01M6AD9TTKQEWT03YCAPEK28HK","debugging-workflows","Debug GitHub Actions workflows by downloading logs, analyzing summaries, and understanding how agentic workflows and the AWF firewall work together.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw-firewall\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fdebugging-workflows\u002FSKILL.md",[],[170,171,172,9,173,174,175,176,45,177,178,30,28,179,180,27,181,182,183,66,184],"debugging workflows","debugging","workflows","actions","github actions","agentic workflows","debug","logs","ls","work","how","node","analyzing","gh","cat",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":191,"publishedAt":47},"01M6AD9S2GXF6T58BMN1X7PRHM","agentic-workflows","Route gh-aw design, creation, diagnosis, patching, active debugging, upgrades, and local SDLC issue requests to the right strategies.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw-firewall\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fagentic-workflows\u002FSKILL.md",[],[175,172,45,192,171,193,194,195,196,197,24,183,198,199],"design","route","strategies","requests","creation","active","upgrade","patching"]