[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6PQK7FZTR0702ATWHRTK0H5":3,"skill-same:01M6PQK7FZTR0702ATWHRTK0H5":97},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":44,"commitSha":45,"skillDirectory":46,"forksCount":14,"repositoryHtmlUrl":47,"repositoryHomepageUrl":6,"ownerHtmlUrl":48,"ownerBlogUrl":49,"ownerDescription":6,"updatedAt":50,"install":51,"resources":64},"01M6PQK7FZTR0702ATWHRTK0H5","nemoclaw-user-manage-policy",null,"Adds, removes, or modifies allowed endpoints in the sandbox policy. Use when customizing network policy, changing egress rules, or configuring sandbox endpoint access. Trigger keywords - customize nemoclaw network policy, sandbox egress policy configuration, nemoclaw integration policy examples, post-install policy setup, openshell approval workflow, policy preset, nemoclaw approve network requests, sandbox egress approval tui.","headmktlucca-ui\u002Fneuroads-lp","headmktlucca-ui","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F247379838?v=4","01M6PDVAV6M1W96D1SR1PDF8CS","NeuroAds","01M6PDVAZ4P281GNDKD45CYTF5",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fheadmktlucca-ui\u002Fneuroads-lp\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fnemoclaw-user-manage-policy\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"user","nemoclaw user manage policy","nemoclaw","manage","policy","preset","examples","network","endpoint","access","Rules","sandbox","install","use","approval workflow","customize","trigger","post","workflow","approve","2026-11-10 10:12:30",false,"---\nname: \"nemoclaw-user-manage-policy\"\ndescription: \"Adds, removes, or modifies allowed endpoints in the sandbox policy. Use when customizing network policy, changing egress rules, or configuring sandbox endpoint access. Trigger keywords - customize nemoclaw network policy, sandbox egress policy configuration, nemoclaw integration policy examples, post-install policy setup, openshell approval workflow, policy preset, nemoclaw approve network requests, sandbox egress approval tui.\"\nlicense: \"Apache-2.0\"\n---\n\n\u003C!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -->\n\u003C!-- SPDX-License-Identifier: Apache-2.0 -->\n\n# Customize the Sandbox Network Policy\n\n## Gotchas\n\n- Custom preset hosts bypass NemoClaw's review process and can widen sandbox egress to arbitrary destinations.\n\n## Prerequisites\n\n- A running NemoClaw sandbox for dynamic changes, or the NemoClaw source repository for static changes.\n- The OpenShell CLI on your `PATH`.\n\nAdd, remove, or modify the endpoints that the sandbox is allowed to reach.\n\nThe sandbox policy is defined in a declarative YAML file in the NemoClaw repository and enforced at runtime by [NVIDIA OpenShell](https:\u002F\u002Fgithub.com\u002FNVIDIA\u002FOpenShell).\nNemoClaw supports both static policy changes that persist across restarts and dynamic updates applied to a running sandbox through the OpenShell CLI.\n\n**Note:**\n\nIf the sandbox needs to reach an HTTP service running on the host, expose the service on a host IP that the OpenShell gateway can reach.\nApply a custom NemoClaw preset with `nemoclaw \u003Csandbox> policy-add --from-file`.\nDo not rely on `host.docker.internal` as a general host-service path because it bypasses the OpenShell policy path and may not be reachable in every sandbox runtime.\nSee Agent cannot reach a host-side HTTP service (use the `nemoclaw-user-reference` skill).\n\n## Static Changes\n\nStatic changes modify the baseline policy file and take effect after the next sandbox creation.\n\n### Edit the Policy File\n\nOpen `nemoclaw-blueprint\u002Fpolicies\u002Fopenclaw-sandbox.yaml` and add or modify endpoint entries.\n\nIf you want a built-in preset to be part of the baseline policy, merge its `network_policies` entries into this file and re-run `nemoclaw onboard`.\n\nIf you only need to apply a preset to a running sandbox, use `nemoclaw \u003Cname> policy-add` under [Dynamic Changes](#dynamic-changes).\nThat updates the live policy and does not edit `openclaw-sandbox.yaml`.\n\nUse a manual YAML edit when you need to allow custom hosts that are not covered by a preset, such as an internal API or a weather service.\n\nEach entry in the `network` section defines an endpoint group with the following fields:\n\n`endpoints`\n: Host and port pairs that the sandbox can reach.\n\n`binaries`\n: Executables allowed to use this endpoint.\n\n`rules`\n: HTTP methods and paths that are permitted.\n\n### Re-Run Onboard\n\nApply the updated policy by re-running the onboard wizard:\n\n```console\n$ nemoclaw onboard\n```\n\nThe wizard picks up the modified policy file and applies it to the sandbox.\n\n### Verify the Policy\n\nCheck that the sandbox is running with the updated policy:\n\n```console\n$ nemoclaw \u003Cname> status\n```\n\n### Add Blueprint Policy Additions\n\nIf you maintain a custom blueprint, you can add extra policy entries under `components.policy.additions` in `nemoclaw-blueprint\u002Fblueprint.yaml`.\nNemoClaw validates those entries with the same policy schema used by preset files, fetches the live policy during sandbox creation, merges the additions into `network_policies`, and applies the merged policy through OpenShell.\nThe applied additions are recorded in the run metadata so you can audit which blueprint-level policy entries were active for that sandbox run.\n\n## Dynamic Changes\n\nDynamic changes apply a policy update to a running sandbox without restarting it.\n\n> [!WARNING]\n> `openshell policy set` **replaces** the sandbox's live policy with the contents of the file you provide; it does not merge.\n> A running sandbox's live policy is the baseline from `openclaw-sandbox.yaml` plus every preset that was layered on during onboarding.\n> Applying a file that contains only the baseline (or only a single preset) silently drops every other preset that was in effect.\n\n### Option 1: Drop a Preset File and Use `policy-add` (Recommended)\n\nThis is the non-destructive path and the only flow NemoClaw supports out of the box for merging new entries into a running policy.\n\n1. Create a preset-format YAML file under `nemoclaw-blueprint\u002Fpolicies\u002Fpresets\u002F`, for example `nemoclaw-blueprint\u002Fpolicies\u002Fpresets\u002Finfluxdb.yaml`:\n\n   ```yaml\n   preset:\n     name: influxdb\n     description: \"InfluxDB time-series database\"\n   network_policies:\n     influxdb:\n       name: influxdb\n       endpoints:\n         - host: influxdb.internal.example.com\n           port: 8086\n           protocol: rest\n           enforcement: enforce\n           rules:\n             - allow: { method: GET, path: \"\u002F**\" }\n             - allow: { method: POST, path: \"\u002Fapi\u002Fv2\u002Fwrite\" }\n       binaries:\n         - { path: \u002Fusr\u002Fbin\u002Fcurl }\n   ```\n\n2. Apply it to the running sandbox:\n\n   ```console\n   $ nemoclaw my-assistant policy-add\n   ```\n\n   NemoClaw reads the live policy via `openshell policy get --full`, structurally merges your preset's `network_policies` into it, and writes the merged result back.\n   Existing presets and the baseline remain in place.\n   The preset file under `presets\u002F` also persists across sandbox recreations.\n\n### Option 2: Snapshot, Edit, and Set via OpenShell\n\nUse this path only when you cannot add a file under the NemoClaw source tree.\nYou must start from the **live** policy, not from `openclaw-sandbox.yaml`, so the presets layered on at onboarding are preserved in the file you apply.\n\n```console\n$ openshell policy get --full my-assistant > live-policy.yaml\n```\n\nEdit `live-policy.yaml` to add your entries under `network_policies:`, keeping the existing `version` field intact, then apply:\n\n```console\n$ openshell policy set --policy live-policy.yaml my-assistant\n```\n\n### Scope of Dynamic Changes\n\nDynamic changes apply only to the current session.\nWhen the sandbox stops, the running policy resets to the baseline composed from `openclaw-sandbox.yaml` plus the presets recorded for the sandbox.\nTo make a custom policy survive a sandbox recreation, ship the preset file in the repository (Option 1 above — the file under `presets\u002F` persists) or edit `openclaw-sandbox.yaml` and re-run `nemoclaw onboard`.\n\n### Approve Requests Interactively\n\nFor one-off access, you can approve blocked requests in the OpenShell TUI instead of editing the baseline policy:\n\n```console\n$ openshell term\n```\n\nThis is useful when you want to test a destination before deciding whether it belongs in a permanent preset or custom policy file.\n\n## Policy Presets\n\nNemoClaw ships preset policy files for common integrations in `nemoclaw-blueprint\u002Fpolicies\u002Fpresets\u002F`.\nApply a preset as-is or use it as a starting template for a custom policy.\nFor guided post-install examples, see [Common Integration Policy Examples](references\u002Fintegration-policy-examples.md).\n\nDuring onboarding, the policy tier (use the `nemoclaw-user-reference` skill) you select determines which presets are enabled by default.\nYou can add or remove individual presets in the interactive preset screen that follows tier selection.\n\nAvailable presets:\n\n| Preset | Endpoints |\n|--------|-----------|\n| `brave` | Brave Search API |\n| `brew` | Homebrew (Linuxbrew) package manager |\n| `discord` | Discord API, gateway, and CDN access |\n| `github` | GitHub and GitHub REST API |\n| `huggingface` | Hugging Face Hub (download-only) and inference router |\n| `jira` | Atlassian Jira API |\n| `local-inference` | Local Ollama and vLLM through the host gateway |\n| `npm` | npm and Yarn registries |\n| `openclaw-pricing` | OpenClaw model-pricing reference fetch (LiteLLM and OpenRouter) |\n| `outlook` | Microsoft 365 and Outlook |\n| `pypi` | Python Package Index |\n| `slack` | Slack API and webhooks |\n| `telegram` | Telegram Bot API |\n| `wechat` | WeChat (personal) iLink Bot API (experimental) |\n| `whatsapp` | WhatsApp Web messaging (experimental) |\n\nTo apply a preset to a running sandbox:\n\n```console\n$ nemoclaw \u003Cname> policy-add\n```\n\n**Note:**\n\nPreset selection is interactive when you omit a preset name.\nPass a preset name with `--yes` for scripted workflows.\n\nFor example, to interactively add PyPI access to a running sandbox:\n\n```console\n$ nemoclaw my-assistant policy-add\n```\n\nTo list which presets are applied to a sandbox:\n\n```console\n$ nemoclaw \u003Cname> policy-list\n```\n\nTo include a preset in the baseline, merge its entries into `openclaw-sandbox.yaml` and re-run `nemoclaw onboard`.\n\n**Note:**\n\nThe `openshell policy set --policy \u003Cfile> \u003Csandbox-name>` command operates on raw policy files and does not\naccept the `preset:` metadata block used in preset YAML files. Use `nemoclaw \u003Cname> policy-add` for\npresets.\n\nFor scripted workflows, `policy-add` and `policy-remove` accept the preset name as a positional argument:\n\n```console\n$ nemoclaw my-assistant policy-add pypi --yes\n$ nemoclaw my-assistant policy-remove pypi --yes\n```\n\nSet `NEMOCLAW_NON_INTERACTIVE=1` instead of `--yes` to drive the same flow from an environment variable.\nSee Commands (use the `nemoclaw-user-reference` skill) for the full flag reference.\n\n`nemoclaw \u003Cname> rebuild` reapplies every policy preset to the recreated sandbox, so presets survive an agent-version upgrade without manual reapplication.\n\n## Custom Preset Files\n\nApply a user-authored preset YAML to a running sandbox without editing the baseline or dropping to `openshell policy set`.\n\n### Authoring\n\nA custom preset follows the same shape as the built-in ones under `nemoclaw-blueprint\u002Fpolicies\u002Fpresets\u002F`:\n\n```yaml\npreset:\n  name: my-internal-api\n  description: \"Internal service\"\nnetwork_policies:\n  my-internal-api:\n    name: my-internal-api\n    endpoints:\n      - host: api.example.internal\n        port: 443\n        protocol: rest\n        enforcement: enforce\n        rules:\n          - allow: { method: GET, path: \"\u002F**\" }\n    binaries:\n      - { path: \u002Fusr\u002Flocal\u002Fbin\u002Fnode }\n```\n\nThe top-level `preset.name` must be a lowercase RFC 1123 label (letters, digits, hyphens) and must not collide with a built-in preset name such as `slack` or `pypi`.\nRename `preset.name` if NemoClaw refuses to apply the file because of a collision.\n\n### Apply a Single File\n\n```console\n$ nemoclaw my-assistant policy-add --from-file .\u002Fpresets\u002Fmy-internal-api.yaml\n```\n\nPreview the endpoints without applying with `--dry-run`, and skip the confirmation prompt with `--yes` or by exporting `NEMOCLAW_NON_INTERACTIVE=1`.\n\n### Apply Every File in a Directory\n\n```console\n$ nemoclaw my-assistant policy-add --from-dir .\u002Fpresets\u002F --yes\n```\n\nFiles are processed in lexicographic order.\nProcessing stops at the first failure; presets already applied are not rolled back.\nFix the failing file and re-run the command to continue.\n\n**Warning:**\n\nCustom preset hosts bypass NemoClaw's review process and can widen sandbox egress to arbitrary destinations.\nReview every host in a custom preset before applying it, especially when the file originates outside your team.\n\nLoad [references\u002Fcustomize-network-policy-details.md](references\u002Fcustomize-network-policy-details.md) for detailed steps on Remove a Custom Preset.\n\n## References\n\n- **[references\u002Fintegration-policy-examples.md](references\u002Fintegration-policy-examples.md)** — Guides users through common post-install integration policy setup for maintained NemoClaw policy presets, including Outlook, messaging channels, GitHub, Jira, Brave Search, package managers, Hugging Face, local inference, and OpenShell approval workflows.\n- **Load [references\u002Fapprove-network-requests.md](references\u002Fapprove-network-requests.md)** when approving or denying sandbox egress requests, managing blocked network calls, or using the approval TUI. Reviews and approves blocked agent network requests in the TUI.\n- **Load [references\u002Fcustomize-network-policy-details.md](references\u002Fcustomize-network-policy-details.md)** when you need detailed steps for Remove a Custom Preset.\n\n## Related Skills\n\n- [Approve or Deny Agent Network Requests](references\u002Fapprove-network-requests.md) for real-time operator approval.\n- [Common Integration Policy Examples](references\u002Fintegration-policy-examples.md) for maintained preset examples such as Outlook, messaging, GitHub, Jira, Brave Search, package managers, Hugging Face, and local inference.\n- `nemoclaw-user-reference` — Network Policies (use the `nemoclaw-user-reference` skill) for the full baseline policy reference\n- OpenShell [Policy Schema](https:\u002F\u002Fdocs.nvidia.com\u002Fopenshell\u002Flatest\u002Freference\u002Fpolicy-schema.html) for the full YAML policy schema reference.\n- OpenShell [Sandbox Policies](https:\u002F\u002Fdocs.nvidia.com\u002Fopenshell\u002Flatest\u002Fsandboxes\u002Fpolicies.html) for applying, iterating, and debugging policies at the OpenShell layer.\n","\u003C!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -->\n\u003C!-- SPDX-License-Identifier: Apache-2.0 -->\n\n# Customize the Sandbox Network Policy\n\n## Gotchas\n\n- Custom preset hosts bypass NemoClaw's review process and can widen sandbox egress to arbitrary destinations.\n\n## Prerequisites\n\n- A running NemoClaw sandbox for dynamic changes, or the NemoClaw source repository for static changes.\n- The OpenShell CLI on your `PATH`.\n\nAdd, remove, or modify the endpoints that the sandbox is allowed to reach.\n\nThe sandbox policy is defined in a declarative YAML file in the NemoClaw repository and enforced at runtime by [NVIDIA OpenShell](https:\u002F\u002Fgithub.com\u002FNVIDIA\u002FOpenShell).\nNemoClaw supports both static policy changes that persist across restarts and dynamic updates applied to a running sandbox through the OpenShell CLI.\n\n**Note:**\n\nIf the sandbox needs to reach an HTTP service running on the host, expose the service on a host IP that the OpenShell gateway can reach.\nApply a custom NemoClaw preset with `nemoclaw \u003Csandbox> policy-add --from-file`.\nDo not rely on `host.docker.internal` as a general host-service path because it bypasses the OpenShell policy path and may not be reachable in every sandbox runtime.\nSee Agent cannot reach a host-side HTTP service (use the `nemoclaw-user-reference` skill).\n\n## Static Changes\n\nStatic changes modify the baseline policy file and take effect after the next sandbox creation.\n\n### Edit the Policy File\n\nOpen `nemoclaw-blueprint\u002Fpolicies\u002Fopenclaw-sandbox.yaml` and add or modify endpoint entries.\n\nIf you want a built-in preset to be part of the baseline policy, merge its `network_policies` entries into this file and re-run `nemoclaw onboard`.\n\nIf you only need to apply a preset to a running sandbox, use `nemoclaw \u003Cname> policy-add` under [Dynamic Changes](#dynamic-changes).\nThat updates the live policy and does not edit `openclaw-sandbox.yaml`.\n\nUse a manual YAML edit when you need to allow custom hosts that are not covered by a preset, such as an internal API or a weather service.\n\nEach entry in the `network` section defines an endpoint group with the following fields:\n\n`endpoints`\n: Host and port pairs that the sandbox can reach.\n\n`binaries`\n: Executables allowed to use this endpoint.\n\n`rules`\n: HTTP methods and paths that are permitted.\n\n### Re-Run Onboard\n\nApply the updated policy by re-running the onboard wizard:\n\n```console\n$ nemoclaw onboard\n```\n\nThe wizard picks up the modified policy file and applies it to the sandbox.\n\n### Verify the Policy\n\nCheck that the sandbox is running with the updated policy:\n\n```console\n$ nemoclaw \u003Cname> status\n```\n\n### Add Blueprint Policy Additions\n\nIf you maintain a custom blueprint, you can add extra policy entries under `components.policy.additions` in `nemoclaw-blueprint\u002Fblueprint.yaml`.\nNemoClaw validates those entries with the same policy schema used by preset files, fetches the live policy during sandbox creation, merges the additions into `network_policies`, and applies the merged policy through OpenShell.\nThe applied additions are recorded in the run metadata so you can audit which blueprint-level policy entries were active for that sandbox run.\n\n## Dynamic Changes\n\nDynamic changes apply a policy update to a running sandbox without restarting it.\n\n> [!WARNING]\n> `openshell policy set` **replaces** the sandbox's live policy with the contents of the file you provide; it does not merge.\n> A running sandbox's live policy is the baseline from `openclaw-sandbox.yaml` plus every preset that was layered on during onboarding.\n> Applying a file that contains only the baseline (or only a single preset) silently drops every other preset that was in effect.\n\n### Option 1: Drop a Preset File and Use `policy-add` (Recommended)\n\nThis is the non-destructive path and the only flow NemoClaw supports out of the box for merging new entries into a running policy.\n\n1. Create a preset-format YAML file under `nemoclaw-blueprint\u002Fpolicies\u002Fpresets\u002F`, for example `nemoclaw-blueprint\u002Fpolicies\u002Fpresets\u002Finfluxdb.yaml`:\n\n   ```yaml\n   preset:\n     name: influxdb\n     description: \"InfluxDB time-series database\"\n   network_policies:\n     influxdb:\n       name: influxdb\n       endpoints:\n         - host: influxdb.internal.example.com\n           port: 8086\n           protocol: rest\n           enforcement: enforce\n           rules:\n             - allow: { method: GET, path: \"\u002F**\" }\n             - allow: { method: POST, path: \"\u002Fapi\u002Fv2\u002Fwrite\" }\n       binaries:\n         - { path: \u002Fusr\u002Fbin\u002Fcurl }\n   ```\n\n2. Apply it to the running sandbox:\n\n   ```console\n   $ nemoclaw my-assistant policy-add\n   ```\n\n   NemoClaw reads the live policy via `openshell policy get --full`, structurally merges your preset's `network_policies` into it, and writes the merged result back.\n   Existing presets and the baseline remain in place.\n   The preset file under `presets\u002F` also persists across sandbox recreations.\n\n### Option 2: Snapshot, Edit, and Set via OpenShell\n\nUse this path only when you cannot add a file under the NemoClaw source tree.\nYou must start from the **live** policy, not from `openclaw-sandbox.yaml`, so the presets layered on at onboarding are preserved in the file you apply.\n\n```console\n$ openshell policy get --full my-assistant > live-policy.yaml\n```\n\nEdit `live-policy.yaml` to add your entries under `network_policies:`, keeping the existing `version` field intact, then apply:\n\n```console\n$ openshell policy set --policy live-policy.yaml my-assistant\n```\n\n### Scope of Dynamic Changes\n\nDynamic changes apply only to the current session.\nWhen the sandbox stops, the running policy resets to the baseline composed from `openclaw-sandbox.yaml` plus the presets recorded for the sandbox.\nTo make a custom policy survive a sandbox recreation, ship the preset file in the repository (Option 1 above — the file under `presets\u002F` persists) or edit `openclaw-sandbox.yaml` and re-run `nemoclaw onboard`.\n\n### Approve Requests Interactively\n\nFor one-off access, you can approve blocked requests in the OpenShell TUI instead of editing the baseline policy:\n\n```console\n$ openshell term\n```\n\nThis is useful when you want to test a destination before deciding whether it belongs in a permanent preset or custom policy file.\n\n## Policy Presets\n\nNemoClaw ships preset policy files for common integrations in `nemoclaw-blueprint\u002Fpolicies\u002Fpresets\u002F`.\nApply a preset as-is or use it as a starting template for a custom policy.\nFor guided post-install examples, see [Common Integration Policy Examples](references\u002Fintegration-policy-examples.md).\n\nDuring onboarding, the policy tier (use the `nemoclaw-user-reference` skill) you select determines which presets are enabled by default.\nYou can add or remove individual presets in the interactive preset screen that follows tier selection.\n\nAvailable presets:\n\n| Preset | Endpoints |\n|--------|-----------|\n| `brave` | Brave Search API |\n| `brew` | Homebrew (Linuxbrew) package manager |\n| `discord` | Discord API, gateway, and CDN access |\n| `github` | GitHub and GitHub REST API |\n| `huggingface` | Hugging Face Hub (download-only) and inference router |\n| `jira` | Atlassian Jira API |\n| `local-inference` | Local Ollama and vLLM through the host gateway |\n| `npm` | npm and Yarn registries |\n| `openclaw-pricing` | OpenClaw model-pricing reference fetch (LiteLLM and OpenRouter) |\n| `outlook` | Microsoft 365 and Outlook |\n| `pypi` | Python Package Index |\n| `slack` | Slack API and webhooks |\n| `telegram` | Telegram Bot API |\n| `wechat` | WeChat (personal) iLink Bot API (experimental) |\n| `whatsapp` | WhatsApp Web messaging (experimental) |\n\nTo apply a preset to a running sandbox:\n\n```console\n$ nemoclaw \u003Cname> policy-add\n```\n\n**Note:**\n\nPreset selection is interactive when you omit a preset name.\nPass a preset name with `--yes` for scripted workflows.\n\nFor example, to interactively add PyPI access to a running sandbox:\n\n```console\n$ nemoclaw my-assistant policy-add\n```\n\nTo list which presets are applied to a sandbox:\n\n```console\n$ nemoclaw \u003Cname> policy-list\n```\n\nTo include a preset in the baseline, merge its entries into `openclaw-sandbox.yaml` and re-run `nemoclaw onboard`.\n\n**Note:**\n\nThe `openshell policy set --policy \u003Cfile> \u003Csandbox-name>` command operates on raw policy files and does not\naccept the `preset:` metadata block used in preset YAML files. Use `nemoclaw \u003Cname> policy-add` for\npresets.\n\nFor scripted workflows, `policy-add` and `policy-remove` accept the preset name as a positional argument:\n\n```console\n$ nemoclaw my-assistant policy-add pypi --yes\n$ nemoclaw my-assistant policy-remove pypi --yes\n```\n\nSet `NEMOCLAW_NON_INTERACTIVE=1` instead of `--yes` to drive the same flow from an environment variable.\nSee Commands (use the `nemoclaw-user-reference` skill) for the full flag reference.\n\n`nemoclaw \u003Cname> rebuild` reapplies every policy preset to the recreated sandbox, so presets survive an agent-version upgrade without manual reapplication.\n\n## Custom Preset Files\n\nApply a user-authored preset YAML to a running sandbox without editing the baseline or dropping to `openshell policy set`.\n\n### Authoring\n\nA custom preset follows the same shape as the built-in ones under `nemoclaw-blueprint\u002Fpolicies\u002Fpresets\u002F`:\n\n```yaml\npreset:\n  name: my-internal-api\n  description: \"Internal service\"\nnetwork_policies:\n  my-internal-api:\n    name: my-internal-api\n    endpoints:\n      - host: api.example.internal\n        port: 443\n        protocol: rest\n        enforcement: enforce\n        rules:\n          - allow: { method: GET, path: \"\u002F**\" }\n    binaries:\n      - { path: \u002Fusr\u002Flocal\u002Fbin\u002Fnode }\n```\n\nThe top-level `preset.name` must be a lowercase RFC 1123 label (letters, digits, hyphens) and must not collide with a built-in preset name such as `slack` or `pypi`.\nRename `preset.name` if NemoClaw refuses to apply the file because of a collision.\n\n### Apply a Single File\n\n```console\n$ nemoclaw my-assistant policy-add --from-file .\u002Fpresets\u002Fmy-internal-api.yaml\n```\n\nPreview the endpoints without applying with `--dry-run`, and skip the confirmation prompt with `--yes` or by exporting `NEMOCLAW_NON_INTERACTIVE=1`.\n\n### Apply Every File in a Directory\n\n```console\n$ nemoclaw my-assistant policy-add --from-dir .\u002Fpresets\u002F --yes\n```\n\nFiles are processed in lexicographic order.\nProcessing stops at the first failure; presets already applied are not rolled back.\nFix the failing file and re-run the command to continue.\n\n**Warning:**\n\nCustom preset hosts bypass NemoClaw's review process and can widen sandbox egress to arbitrary destinations.\nReview every host in a custom preset before applying it, especially when the file originates outside your team.\n\nLoad [references\u002Fcustomize-network-policy-details.md](references\u002Fcustomize-network-policy-details.md) for detailed steps on Remove a Custom Preset.\n\n## References\n\n- **[references\u002Fintegration-policy-examples.md](references\u002Fintegration-policy-examples.md)** — Guides users through common post-install integration policy setup for maintained NemoClaw policy presets, including Outlook, messaging channels, GitHub, Jira, Brave Search, package managers, Hugging Face, local inference, and OpenShell approval workflows.\n- **Load [references\u002Fapprove-network-requests.md](references\u002Fapprove-network-requests.md)** when approving or denying sandbox egress requests, managing blocked network calls, or using the approval TUI. Reviews and approves blocked agent network requests in the TUI.\n- **Load [references\u002Fcustomize-network-policy-details.md](references\u002Fcustomize-network-policy-details.md)** when you need detailed steps for Remove a Custom Preset.\n\n## Related Skills\n\n- [Approve or Deny Agent Network Requests](references\u002Fapprove-network-requests.md) for real-time operator approval.\n- [Common Integration Policy Examples](references\u002Fintegration-policy-examples.md) for maintained preset examples such as Outlook, messaging, GitHub, Jira, Brave Search, package managers, Hugging Face, and local inference.\n- `nemoclaw-user-reference` — Network Policies (use the `nemoclaw-user-reference` skill) for the full baseline policy reference\n- OpenShell [Policy Schema](https:\u002F\u002Fdocs.nvidia.com\u002Fopenshell\u002Flatest\u002Freference\u002Fpolicy-schema.html) for the full YAML policy schema reference.\n- OpenShell [Sandbox Policies](https:\u002F\u002Fdocs.nvidia.com\u002Fopenshell\u002Flatest\u002Fsandboxes\u002Fpolicies.html) for applying, iterating, and debugging policies at the OpenShell layer.\n",{"name":5,"license":15,"description":7},"main","7a940b8e5af16c95e5c190a524421d32fc7445a9",".claude\u002Fskills\u002Fnemoclaw-user-manage-policy","https:\u002F\u002Fgithub.com\u002Fheadmktlucca-ui\u002Fneuroads-lp","https:\u002F\u002Fgithub.com\u002Fheadmktlucca-ui","https:\u002F\u002Fneuroads.com.br","2026-08-12 00:42:44",{"source":8,"skillName":5,"commands":52,"prompt":62,"zipAvailable":63},[53,56,59],{"tool":54,"command":55},"npx","npx skills add headmktlucca-ui\u002Fneuroads-lp --skill nemoclaw-user-manage-policy",{"tool":57,"command":58},"bunx","bunx skills add headmktlucca-ui\u002Fneuroads-lp --skill nemoclaw-user-manage-policy",{"tool":60,"command":61},"pnpm","pnpm dlx skills add headmktlucca-ui\u002Fneuroads-lp --skill nemoclaw-user-manage-policy","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fheadmktlucca-ui\u002Fneuroads-lp\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fnemoclaw-user-manage-policy\u002FSKILL.md",true,[65,71,75,79,83,87,91],{"path":66,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":69,"sourceHtmlUrl":70},"BENCHMARK.md","REFERENCE","参考文档",3189,"https:\u002F\u002Fgithub.com\u002Fheadmktlucca-ui\u002Fneuroads-lp\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fnemoclaw-user-manage-policy\u002FBENCHMARK.md",{"path":72,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":73,"sourceHtmlUrl":74},"evals\u002Fevals.json",5098,"https:\u002F\u002Fgithub.com\u002Fheadmktlucca-ui\u002Fneuroads-lp\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fnemoclaw-user-manage-policy\u002Fevals\u002Fevals.json",{"path":76,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":77,"sourceHtmlUrl":78},"references\u002Fapprove-network-requests.md",2414,"https:\u002F\u002Fgithub.com\u002Fheadmktlucca-ui\u002Fneuroads-lp\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fnemoclaw-user-manage-policy\u002Freferences\u002Fapprove-network-requests.md",{"path":80,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":81,"sourceHtmlUrl":82},"references\u002Fcustomize-network-policy-details.md",681,"https:\u002F\u002Fgithub.com\u002Fheadmktlucca-ui\u002Fneuroads-lp\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fnemoclaw-user-manage-policy\u002Freferences\u002Fcustomize-network-policy-details.md",{"path":84,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":85,"sourceHtmlUrl":86},"references\u002Fintegration-policy-examples.md",12424,"https:\u002F\u002Fgithub.com\u002Fheadmktlucca-ui\u002Fneuroads-lp\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fnemoclaw-user-manage-policy\u002Freferences\u002Fintegration-policy-examples.md",{"path":88,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":89,"sourceHtmlUrl":90},"skill-card.md",2961,"https:\u002F\u002Fgithub.com\u002Fheadmktlucca-ui\u002Fneuroads-lp\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fnemoclaw-user-manage-policy\u002Fskill-card.md",{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"skill.oms.sig","OTHER","其他",5377,"https:\u002F\u002Fgithub.com\u002Fheadmktlucca-ui\u002Fneuroads-lp\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fnemoclaw-user-manage-policy\u002Fskill.oms.sig",[98,123,148,173,191,226],{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":102,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":113,"publishedAt":39},"01M6PTDCZTXTGSTX4RFK901YSZ","xunit-skill","Generates xUnit.net tests in C#. Covers Fact\u002FTheory, constructor injection, IClassFixture, and FluentAssertions. Use when user mentions \"xUnit\", \"[Fact]\", \"[Theory]\", \"Assert.Equal\", \"C# xUnit\". Triggers on: \"xUnit\", \"[Fact]\", \"[Theory]\", \"Assert.Equal C#\", \"xUnit.net\".","MIT","https:\u002F\u002Fgithub.com\u002Fheadmktlucca-ui\u002Fneuroads-lp\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fxunit-skill\u002FSKILL.md",[105,110],{"categoryNo":106,"categoryName":107,"taxonomyType":108,"taxonomyTypeDesc":109},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":111,"categoryName":112,"taxonomyType":108,"taxonomyTypeDesc":109},"01JBSEEDCAT000000000000023","Skill与智能体开发",[114,115,116,117,19,32,118,119,120,121,122],"xunit","xunit skill","testing","injection","tests","triggers","unit","unit-testing","C#",{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":102,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":131,"publishedAt":39},"01M6PTCB59ZTG5FTMWGPYEMMBP","xcuitest-skill","Generates XCUITest UI tests for iOS\u002FiPadOS apps in Swift. Apple's native testing framework for reliable, fast UI automation. Supports local simulators and TestMu AI cloud real devices. Use when user mentions \"XCUITest\", \"XCTest\", \"iOS UI test\", \"Swift test\", \"XCUIApplication\". Triggers on: \"XCUITest\", \"XCTest UI\", \"iOS UI test\", \"Swift UI test\", \"XCUIApplication\", \"TestMu\".","https:\u002F\u002Fgithub.com\u002Fheadmktlucca-ui\u002Fneuroads-lp\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fxcuitest-skill\u002FSKILL.md",[129,130],{"categoryNo":106,"categoryName":107,"taxonomyType":108,"taxonomyTypeDesc":109},{"categoryNo":111,"categoryName":112,"taxonomyType":108,"taxonomyTypeDesc":109},[132,133,116,134,135,136,137,138,32,139,140,141,142,143,118,119,144,145,146,147],"xcuitest","xcuitest skill","automation","test","testing framework","ios","devices","mobile","mobile-testing","ui test","local","apple","apps","native","for","objective",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":102,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":158,"publishedAt":39},"01M6PTATMNTY9NF4J7KSR76YK6","world-builder","Create and manage generative game zones for Dorothy's Pokemon-style world. Use this skill when creating, updating, or designing game worlds via MCP tools.","https:\u002F\u002Fgithub.com\u002Fheadmktlucca-ui\u002Fneuroads-lp\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fworld-builder\u002FSKILL.md",[154,157],{"categoryNo":155,"categoryName":156,"taxonomyType":108,"taxonomyTypeDesc":109},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":111,"categoryName":112,"taxonomyType":108,"taxonomyTypeDesc":109},[159,160,161,162,163,164,165,166,32,167,22,168,169,170,171,146,172],"builder","world","world builder","MCP","create","mcp tools","Tools","game","pokemon","style","via","theme","zone","generative",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":102,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":181,"publishedAt":39},"01M6PT9Z92JTSQEHE1QR0NNW5F","webdriverio-skill","Generates WebdriverIO (WDIO) automation tests in JavaScript or TypeScript. Supports local and TestMu AI cloud. Use when user mentions \"WebdriverIO\", \"WDIO\", \"wdio.conf\", \"browser.url\", \"$\", \"$$\". Triggers on: \"WebdriverIO\", \"WDIO\", \"wdio\", \"browser.$\".","https:\u002F\u002Fgithub.com\u002Fheadmktlucca-ui\u002Fneuroads-lp\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fwebdriverio-skill\u002FSKILL.md",[179,180],{"categoryNo":106,"categoryName":107,"taxonomyType":108,"taxonomyTypeDesc":109},{"categoryNo":111,"categoryName":112,"taxonomyType":108,"taxonomyTypeDesc":109},[182,116,183,134,184,185,186,187,19,32,188,142,118,119,189,190],"webdriverio skill","typescript","javascript","browser","cloud","e2e","e2e-testing","URL","conf",{"skillNo":192,"name":193,"nameZh":6,"description":194,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":102,"licenseFileUrl":6,"sourceHtmlUrl":195,"categories":196,"keywords":206,"publishedAt":39},"01M6PT9NVK36ZWCQ69YXK3FR4K","web-design-guidelines","Web platform design and accessibility guidelines. Use when building web interfaces, auditing accessibility, implementing responsive layouts, or reviewing web UI code. Triggers on tasks involving HTML, CSS, web components, WCAG compliance, responsive design, or web performance.","https:\u002F\u002Fgithub.com\u002Fheadmktlucca-ui\u002Fneuroads-lp\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fweb\u002FSKILL.md",[197,200,201],{"categoryNo":198,"categoryName":199,"taxonomyType":108,"taxonomyTypeDesc":109},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":155,"categoryName":156,"taxonomyType":108,"taxonomyTypeDesc":109},{"categoryNo":202,"categoryName":203,"taxonomyType":204,"taxonomyTypeDesc":205},"01JBSEEDCAT000000000000032","设计师","PROFESSION","适用职业",[207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,119,225],"design","web","guidelines","web design guidelines","web design","css","performance","components","web components","tasks","code","web performance","ui","platform design","html","responsive design","responsive","platform","implementing",{"skillNo":227,"name":228,"nameZh":6,"description":229,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":102,"licenseFileUrl":6,"sourceHtmlUrl":230,"categories":231,"keywords":234,"publishedAt":39},"01M6PT9A3JKRE3X34276F2FW5R","watchos-design-guidelines","Apple Human Interface Guidelines for Apple Watch. Use when building watchOS apps, complications, or workout features. Triggers on tasks involving Watch UI, Digital Crown, glanceable interfaces, or wrist-based interactions.","https:\u002F\u002Fgithub.com\u002Fheadmktlucca-ui\u002Fneuroads-lp\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fwatchos\u002FSKILL.md",[232,233],{"categoryNo":155,"categoryName":156,"taxonomyType":108,"taxonomyTypeDesc":109},{"categoryNo":202,"categoryName":203,"taxonomyType":204,"taxonomyTypeDesc":205},[207,209,235,216,219,32,236,237,143,224,238,119,144,239,146,240,241],"watchos design guidelines","workout","human","watch","interface","platform-design","features"]