[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M79FH11H59CWEZZZK7SWJMJS":3,"skill-same:01M79FH11H59CWEZZZK7SWJMJS":76},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":24,"commitSha":25,"skillDirectory":26,"forksCount":14,"repositoryHtmlUrl":27,"repositoryHomepageUrl":6,"ownerHtmlUrl":28,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":29,"install":30,"resources":43},"01M79FH11H59CWEZZZK7SWJMJS","nemoclaw-user-manage-policy",null,"Adds, removes, or modifies allowed endpoints in the sandbox policy. Use when customizing network policy, changing egress rules, or configuring sandbox endpoint access. Trigger keywords - customize nemoclaw network policy, sandbox egress policy configuration, nemoclaw integration policy examples, post-install policy setup, openshell approval workflow, policy preset, nemoclaw approve network requests, sandbox egress approval tui.","Elogic360\u002Fsoftware-factory","Elogic360","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F156535519?v=4","01M74NH3F0RB13PWB7JZDE2V80","elogic360","01M74NH3FPC65082MDZVMFHDM3",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FElogic360\u002Fsoftware-factory\u002Fblob\u002Fmain\u002Fskills\u002Fnvidia\u002Fnemoclaw-user-manage-policy\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: \"nemoclaw-user-manage-policy\"\ndescription: \"Adds, removes, or modifies allowed endpoints in the sandbox policy. Use when customizing network policy, changing egress rules, or configuring sandbox endpoint access. Trigger keywords - customize nemoclaw network policy, sandbox egress policy configuration, nemoclaw integration policy examples, post-install policy setup, openshell approval workflow, policy preset, nemoclaw approve network requests, sandbox egress approval tui.\"\nlicense: \"Apache-2.0\"\n---\n\n\u003C!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -->\n\u003C!-- SPDX-License-Identifier: Apache-2.0 -->\n\n# Customize the Sandbox Network Policy\n\n## Gotchas\n\n- Custom preset hosts bypass NemoClaw's review process and can widen sandbox egress to arbitrary destinations.\n\n## Prerequisites\n\n- A running NemoClaw sandbox for dynamic changes, or the NemoClaw source repository for static changes.\n- The OpenShell CLI on your `PATH`.\n\nAdd, remove, or modify the endpoints that the sandbox is allowed to reach.\n\nThe sandbox policy is defined in a declarative YAML file in the NemoClaw repository and enforced at runtime by [NVIDIA OpenShell](https:\u002F\u002Fgithub.com\u002FNVIDIA\u002FOpenShell).\nNemoClaw supports both static policy changes that persist across restarts and dynamic updates applied to a running sandbox through the OpenShell CLI.\n\n**Note:**\n\nIf the sandbox needs to reach an HTTP service running on the host, expose the service on a host IP that the OpenShell gateway can reach.\nApply a custom NemoClaw preset with `nemoclaw \u003Csandbox> policy-add --from-file`.\nDo not rely on `host.docker.internal` as a general host-service path because it bypasses the OpenShell policy path and may not be reachable in every sandbox runtime.\nSee Agent cannot reach a host-side HTTP service (use the `nemoclaw-user-reference` skill).\n\n## Static Changes\n\nStatic changes modify the baseline policy file and take effect after the next sandbox creation.\n\n### Edit the Policy File\n\nOpen `nemoclaw-blueprint\u002Fpolicies\u002Fopenclaw-sandbox.yaml` and add or modify endpoint entries.\n\nIf you want a built-in preset to be part of the baseline policy, merge its `network_policies` entries into this file and re-run `nemoclaw onboard`.\n\nIf you only need to apply a preset to a running sandbox, use `nemoclaw \u003Cname> policy-add` under [Dynamic Changes](#dynamic-changes).\nThat updates the live policy and does not edit `openclaw-sandbox.yaml`.\n\nUse a manual YAML edit when you need to allow custom hosts that are not covered by a preset, such as an internal API or a weather service.\n\nEach entry in the `network` section defines an endpoint group with the following fields:\n\n`endpoints`\n: Host and port pairs that the sandbox can reach.\n\n`binaries`\n: Executables allowed to use this endpoint.\n\n`rules`\n: HTTP methods and paths that are permitted.\n\n### Re-Run Onboard\n\nApply the updated policy by re-running the onboard wizard:\n\n```console\n$ nemoclaw onboard\n```\n\nThe wizard picks up the modified policy file and applies it to the sandbox.\n\n### Verify the Policy\n\nCheck that the sandbox is running with the updated policy:\n\n```console\n$ nemoclaw \u003Cname> status\n```\n\n### Add Blueprint Policy Additions\n\nIf you maintain a custom blueprint, you can add extra policy entries under `components.policy.additions` in `nemoclaw-blueprint\u002Fblueprint.yaml`.\nNemoClaw validates those entries with the same policy schema used by preset files, fetches the live policy during sandbox creation, merges the additions into `network_policies`, and applies the merged policy through OpenShell.\nThe applied additions are recorded in the run metadata so you can audit which blueprint-level policy entries were active for that sandbox run.\n\n## Dynamic Changes\n\nDynamic changes apply a policy update to a running sandbox without restarting it.\n\n> [!WARNING]\n> `openshell policy set` **replaces** the sandbox's live policy with the contents of the file you provide; it does not merge.\n> A running sandbox's live policy is the baseline from `openclaw-sandbox.yaml` plus every preset that was layered on during onboarding.\n> Applying a file that contains only the baseline (or only a single preset) silently drops every other preset that was in effect.\n\n### Option 1: Drop a Preset File and Use `policy-add` (Recommended)\n\nThis is the non-destructive path and the only flow NemoClaw supports out of the box for merging new entries into a running policy.\n\n1. Create a preset-format YAML file under `nemoclaw-blueprint\u002Fpolicies\u002Fpresets\u002F`, for example `nemoclaw-blueprint\u002Fpolicies\u002Fpresets\u002Finfluxdb.yaml`:\n\n   ```yaml\n   preset:\n     name: influxdb\n     description: \"InfluxDB time-series database\"\n   network_policies:\n     influxdb:\n       name: influxdb\n       endpoints:\n         - host: influxdb.internal.example.com\n           port: 8086\n           protocol: rest\n           enforcement: enforce\n           rules:\n             - allow: { method: GET, path: \"\u002F**\" }\n             - allow: { method: POST, path: \"\u002Fapi\u002Fv2\u002Fwrite\" }\n       binaries:\n         - { path: \u002Fusr\u002Fbin\u002Fcurl }\n   ```\n\n2. Apply it to the running sandbox:\n\n   ```console\n   $ nemoclaw my-assistant policy-add\n   ```\n\n   NemoClaw reads the live policy via `openshell policy get --full`, structurally merges your preset's `network_policies` into it, and writes the merged result back.\n   Existing presets and the baseline remain in place.\n   The preset file under `presets\u002F` also persists across sandbox recreations.\n\n### Option 2: Snapshot, Edit, and Set via OpenShell\n\nUse this path only when you cannot add a file under the NemoClaw source tree.\nYou must start from the **live** policy, not from `openclaw-sandbox.yaml`, so the presets layered on at onboarding are preserved in the file you apply.\n\n```console\n$ openshell policy get --full my-assistant > live-policy.yaml\n```\n\nEdit `live-policy.yaml` to add your entries under `network_policies:`, keeping the existing `version` field intact, then apply:\n\n```console\n$ openshell policy set --policy live-policy.yaml my-assistant\n```\n\n### Scope of Dynamic Changes\n\nDynamic changes apply only to the current session.\nWhen the sandbox stops, the running policy resets to the baseline composed from `openclaw-sandbox.yaml` plus the presets recorded for the sandbox.\nTo make a custom policy survive a sandbox recreation, ship the preset file in the repository (Option 1 above — the file under `presets\u002F` persists) or edit `openclaw-sandbox.yaml` and re-run `nemoclaw onboard`.\n\n### Approve Requests Interactively\n\nFor one-off access, you can approve blocked requests in the OpenShell TUI instead of editing the baseline policy:\n\n```console\n$ openshell term\n```\n\nThis is useful when you want to test a destination before deciding whether it belongs in a permanent preset or custom policy file.\n\n## Policy Presets\n\nNemoClaw ships preset policy files for common integrations in `nemoclaw-blueprint\u002Fpolicies\u002Fpresets\u002F`.\nApply a preset as-is or use it as a starting template for a custom policy.\nFor guided post-install examples, see [Common Integration Policy Examples](references\u002Fintegration-policy-examples.md).\n\nDuring onboarding, the policy tier (use the `nemoclaw-user-reference` skill) you select determines which presets are enabled by default.\nYou can add or remove individual presets in the interactive preset screen that follows tier selection.\n\nAvailable presets:\n\n| Preset | Endpoints |\n|--------|-----------|\n| `brave` | Brave Search API |\n| `brew` | Homebrew (Linuxbrew) package manager |\n| `discord` | Discord API, gateway, and CDN access |\n| `github` | GitHub and GitHub REST API |\n| `huggingface` | Hugging Face Hub (download-only) and inference router |\n| `jira` | Atlassian Jira API |\n| `local-inference` | Local Ollama and vLLM through the host gateway |\n| `npm` | npm and Yarn registries |\n| `openclaw-pricing` | OpenClaw model-pricing reference fetch (LiteLLM and OpenRouter) |\n| `outlook` | Microsoft 365 and Outlook |\n| `pypi` | Python Package Index |\n| `slack` | Slack API and webhooks |\n| `telegram` | Telegram Bot API |\n| `wechat` | WeChat (personal) iLink Bot API (experimental) |\n| `whatsapp` | WhatsApp Web messaging (experimental) |\n\nTo apply a preset to a running sandbox:\n\n```console\n$ nemoclaw \u003Cname> policy-add\n```\n\n**Note:**\n\nPreset selection is interactive when you omit a preset name.\nPass a preset name with `--yes` for scripted workflows.\n\nFor example, to interactively add PyPI access to a running sandbox:\n\n```console\n$ nemoclaw my-assistant policy-add\n```\n\nTo list which presets are applied to a sandbox:\n\n```console\n$ nemoclaw \u003Cname> policy-list\n```\n\nTo include a preset in the baseline, merge its entries into `openclaw-sandbox.yaml` and re-run `nemoclaw onboard`.\n\n**Note:**\n\nThe `openshell policy set --policy \u003Cfile> \u003Csandbox-name>` command operates on raw policy files and does not\naccept the `preset:` metadata block used in preset YAML files. Use `nemoclaw \u003Cname> policy-add` for\npresets.\n\nFor scripted workflows, `policy-add` and `policy-remove` accept the preset name as a positional argument:\n\n```console\n$ nemoclaw my-assistant policy-add pypi --yes\n$ nemoclaw my-assistant policy-remove pypi --yes\n```\n\nSet `NEMOCLAW_NON_INTERACTIVE=1` instead of `--yes` to drive the same flow from an environment variable.\nSee Commands (use the `nemoclaw-user-reference` skill) for the full flag reference.\n\n`nemoclaw \u003Cname> rebuild` reapplies every policy preset to the recreated sandbox, so presets survive an agent-version upgrade without manual reapplication.\n\n## Custom Preset Files\n\nApply a user-authored preset YAML to a running sandbox without editing the baseline or dropping to `openshell policy set`.\n\n### Authoring\n\nA custom preset follows the same shape as the built-in ones under `nemoclaw-blueprint\u002Fpolicies\u002Fpresets\u002F`:\n\n```yaml\npreset:\n  name: my-internal-api\n  description: \"Internal service\"\nnetwork_policies:\n  my-internal-api:\n    name: my-internal-api\n    endpoints:\n      - host: api.example.internal\n        port: 443\n        protocol: rest\n        enforcement: enforce\n        rules:\n          - allow: { method: GET, path: \"\u002F**\" }\n    binaries:\n      - { path: \u002Fusr\u002Flocal\u002Fbin\u002Fnode }\n```\n\nThe top-level `preset.name` must be a lowercase RFC 1123 label (letters, digits, hyphens) and must not collide with a built-in preset name such as `slack` or `pypi`.\nRename `preset.name` if NemoClaw refuses to apply the file because of a collision.\n\n### Apply a Single File\n\n```console\n$ nemoclaw my-assistant policy-add --from-file .\u002Fpresets\u002Fmy-internal-api.yaml\n```\n\nPreview the endpoints without applying with `--dry-run`, and skip the confirmation prompt with `--yes` or by exporting `NEMOCLAW_NON_INTERACTIVE=1`.\n\n### Apply Every File in a Directory\n\n```console\n$ nemoclaw my-assistant policy-add --from-dir .\u002Fpresets\u002F --yes\n```\n\nFiles are processed in lexicographic order.\nProcessing stops at the first failure; presets already applied are not rolled back.\nFix the failing file and re-run the command to continue.\n\n**Warning:**\n\nCustom preset hosts bypass NemoClaw's review process and can widen sandbox egress to arbitrary destinations.\nReview every host in a custom preset before applying it, especially when the file originates outside your team.\n\nLoad [references\u002Fcustomize-network-policy-details.md](references\u002Fcustomize-network-policy-details.md) for detailed steps on Remove a Custom Preset.\n\n## References\n\n- **[references\u002Fintegration-policy-examples.md](references\u002Fintegration-policy-examples.md)** — Guides users through common post-install integration policy setup for maintained NemoClaw policy presets, including Outlook, messaging channels, GitHub, Jira, Brave Search, package managers, Hugging Face, local inference, and OpenShell approval workflows.\n- **Load [references\u002Fapprove-network-requests.md](references\u002Fapprove-network-requests.md)** when approving or denying sandbox egress requests, managing blocked network calls, or using the approval TUI. Reviews and approves blocked agent network requests in the TUI.\n- **Load [references\u002Fcustomize-network-policy-details.md](references\u002Fcustomize-network-policy-details.md)** when you need detailed steps for Remove a Custom Preset.\n\n## Related Skills\n\n- [Approve or Deny Agent Network Requests](references\u002Fapprove-network-requests.md) for real-time operator approval.\n- [Common Integration Policy Examples](references\u002Fintegration-policy-examples.md) for maintained preset examples such as Outlook, messaging, GitHub, Jira, Brave Search, package managers, Hugging Face, and local inference.\n- `nemoclaw-user-reference` — Network Policies (use the `nemoclaw-user-reference` skill) for the full baseline policy reference\n- OpenShell [Policy Schema](https:\u002F\u002Fdocs.nvidia.com\u002Fopenshell\u002Flatest\u002Freference\u002Fpolicy-schema.html) for the full YAML policy schema reference.\n- OpenShell [Sandbox Policies](https:\u002F\u002Fdocs.nvidia.com\u002Fopenshell\u002Flatest\u002Fsandboxes\u002Fpolicies.html) for applying, iterating, and debugging policies at the OpenShell layer.\n","\u003C!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -->\n\u003C!-- SPDX-License-Identifier: Apache-2.0 -->\n\n# Customize the Sandbox Network Policy\n\n## Gotchas\n\n- Custom preset hosts bypass NemoClaw's review process and can widen sandbox egress to arbitrary destinations.\n\n## Prerequisites\n\n- A running NemoClaw sandbox for dynamic changes, or the NemoClaw source repository for static changes.\n- The OpenShell CLI on your `PATH`.\n\nAdd, remove, or modify the endpoints that the sandbox is allowed to reach.\n\nThe sandbox policy is defined in a declarative YAML file in the NemoClaw repository and enforced at runtime by [NVIDIA OpenShell](https:\u002F\u002Fgithub.com\u002FNVIDIA\u002FOpenShell).\nNemoClaw supports both static policy changes that persist across restarts and dynamic updates applied to a running sandbox through the OpenShell CLI.\n\n**Note:**\n\nIf the sandbox needs to reach an HTTP service running on the host, expose the service on a host IP that the OpenShell gateway can reach.\nApply a custom NemoClaw preset with `nemoclaw \u003Csandbox> policy-add --from-file`.\nDo not rely on `host.docker.internal` as a general host-service path because it bypasses the OpenShell policy path and may not be reachable in every sandbox runtime.\nSee Agent cannot reach a host-side HTTP service (use the `nemoclaw-user-reference` skill).\n\n## Static Changes\n\nStatic changes modify the baseline policy file and take effect after the next sandbox creation.\n\n### Edit the Policy File\n\nOpen `nemoclaw-blueprint\u002Fpolicies\u002Fopenclaw-sandbox.yaml` and add or modify endpoint entries.\n\nIf you want a built-in preset to be part of the baseline policy, merge its `network_policies` entries into this file and re-run `nemoclaw onboard`.\n\nIf you only need to apply a preset to a running sandbox, use `nemoclaw \u003Cname> policy-add` under [Dynamic Changes](#dynamic-changes).\nThat updates the live policy and does not edit `openclaw-sandbox.yaml`.\n\nUse a manual YAML edit when you need to allow custom hosts that are not covered by a preset, such as an internal API or a weather service.\n\nEach entry in the `network` section defines an endpoint group with the following fields:\n\n`endpoints`\n: Host and port pairs that the sandbox can reach.\n\n`binaries`\n: Executables allowed to use this endpoint.\n\n`rules`\n: HTTP methods and paths that are permitted.\n\n### Re-Run Onboard\n\nApply the updated policy by re-running the onboard wizard:\n\n```console\n$ nemoclaw onboard\n```\n\nThe wizard picks up the modified policy file and applies it to the sandbox.\n\n### Verify the Policy\n\nCheck that the sandbox is running with the updated policy:\n\n```console\n$ nemoclaw \u003Cname> status\n```\n\n### Add Blueprint Policy Additions\n\nIf you maintain a custom blueprint, you can add extra policy entries under `components.policy.additions` in `nemoclaw-blueprint\u002Fblueprint.yaml`.\nNemoClaw validates those entries with the same policy schema used by preset files, fetches the live policy during sandbox creation, merges the additions into `network_policies`, and applies the merged policy through OpenShell.\nThe applied additions are recorded in the run metadata so you can audit which blueprint-level policy entries were active for that sandbox run.\n\n## Dynamic Changes\n\nDynamic changes apply a policy update to a running sandbox without restarting it.\n\n> [!WARNING]\n> `openshell policy set` **replaces** the sandbox's live policy with the contents of the file you provide; it does not merge.\n> A running sandbox's live policy is the baseline from `openclaw-sandbox.yaml` plus every preset that was layered on during onboarding.\n> Applying a file that contains only the baseline (or only a single preset) silently drops every other preset that was in effect.\n\n### Option 1: Drop a Preset File and Use `policy-add` (Recommended)\n\nThis is the non-destructive path and the only flow NemoClaw supports out of the box for merging new entries into a running policy.\n\n1. Create a preset-format YAML file under `nemoclaw-blueprint\u002Fpolicies\u002Fpresets\u002F`, for example `nemoclaw-blueprint\u002Fpolicies\u002Fpresets\u002Finfluxdb.yaml`:\n\n   ```yaml\n   preset:\n     name: influxdb\n     description: \"InfluxDB time-series database\"\n   network_policies:\n     influxdb:\n       name: influxdb\n       endpoints:\n         - host: influxdb.internal.example.com\n           port: 8086\n           protocol: rest\n           enforcement: enforce\n           rules:\n             - allow: { method: GET, path: \"\u002F**\" }\n             - allow: { method: POST, path: \"\u002Fapi\u002Fv2\u002Fwrite\" }\n       binaries:\n         - { path: \u002Fusr\u002Fbin\u002Fcurl }\n   ```\n\n2. Apply it to the running sandbox:\n\n   ```console\n   $ nemoclaw my-assistant policy-add\n   ```\n\n   NemoClaw reads the live policy via `openshell policy get --full`, structurally merges your preset's `network_policies` into it, and writes the merged result back.\n   Existing presets and the baseline remain in place.\n   The preset file under `presets\u002F` also persists across sandbox recreations.\n\n### Option 2: Snapshot, Edit, and Set via OpenShell\n\nUse this path only when you cannot add a file under the NemoClaw source tree.\nYou must start from the **live** policy, not from `openclaw-sandbox.yaml`, so the presets layered on at onboarding are preserved in the file you apply.\n\n```console\n$ openshell policy get --full my-assistant > live-policy.yaml\n```\n\nEdit `live-policy.yaml` to add your entries under `network_policies:`, keeping the existing `version` field intact, then apply:\n\n```console\n$ openshell policy set --policy live-policy.yaml my-assistant\n```\n\n### Scope of Dynamic Changes\n\nDynamic changes apply only to the current session.\nWhen the sandbox stops, the running policy resets to the baseline composed from `openclaw-sandbox.yaml` plus the presets recorded for the sandbox.\nTo make a custom policy survive a sandbox recreation, ship the preset file in the repository (Option 1 above — the file under `presets\u002F` persists) or edit `openclaw-sandbox.yaml` and re-run `nemoclaw onboard`.\n\n### Approve Requests Interactively\n\nFor one-off access, you can approve blocked requests in the OpenShell TUI instead of editing the baseline policy:\n\n```console\n$ openshell term\n```\n\nThis is useful when you want to test a destination before deciding whether it belongs in a permanent preset or custom policy file.\n\n## Policy Presets\n\nNemoClaw ships preset policy files for common integrations in `nemoclaw-blueprint\u002Fpolicies\u002Fpresets\u002F`.\nApply a preset as-is or use it as a starting template for a custom policy.\nFor guided post-install examples, see [Common Integration Policy Examples](references\u002Fintegration-policy-examples.md).\n\nDuring onboarding, the policy tier (use the `nemoclaw-user-reference` skill) you select determines which presets are enabled by default.\nYou can add or remove individual presets in the interactive preset screen that follows tier selection.\n\nAvailable presets:\n\n| Preset | Endpoints |\n|--------|-----------|\n| `brave` | Brave Search API |\n| `brew` | Homebrew (Linuxbrew) package manager |\n| `discord` | Discord API, gateway, and CDN access |\n| `github` | GitHub and GitHub REST API |\n| `huggingface` | Hugging Face Hub (download-only) and inference router |\n| `jira` | Atlassian Jira API |\n| `local-inference` | Local Ollama and vLLM through the host gateway |\n| `npm` | npm and Yarn registries |\n| `openclaw-pricing` | OpenClaw model-pricing reference fetch (LiteLLM and OpenRouter) |\n| `outlook` | Microsoft 365 and Outlook |\n| `pypi` | Python Package Index |\n| `slack` | Slack API and webhooks |\n| `telegram` | Telegram Bot API |\n| `wechat` | WeChat (personal) iLink Bot API (experimental) |\n| `whatsapp` | WhatsApp Web messaging (experimental) |\n\nTo apply a preset to a running sandbox:\n\n```console\n$ nemoclaw \u003Cname> policy-add\n```\n\n**Note:**\n\nPreset selection is interactive when you omit a preset name.\nPass a preset name with `--yes` for scripted workflows.\n\nFor example, to interactively add PyPI access to a running sandbox:\n\n```console\n$ nemoclaw my-assistant policy-add\n```\n\nTo list which presets are applied to a sandbox:\n\n```console\n$ nemoclaw \u003Cname> policy-list\n```\n\nTo include a preset in the baseline, merge its entries into `openclaw-sandbox.yaml` and re-run `nemoclaw onboard`.\n\n**Note:**\n\nThe `openshell policy set --policy \u003Cfile> \u003Csandbox-name>` command operates on raw policy files and does not\naccept the `preset:` metadata block used in preset YAML files. Use `nemoclaw \u003Cname> policy-add` for\npresets.\n\nFor scripted workflows, `policy-add` and `policy-remove` accept the preset name as a positional argument:\n\n```console\n$ nemoclaw my-assistant policy-add pypi --yes\n$ nemoclaw my-assistant policy-remove pypi --yes\n```\n\nSet `NEMOCLAW_NON_INTERACTIVE=1` instead of `--yes` to drive the same flow from an environment variable.\nSee Commands (use the `nemoclaw-user-reference` skill) for the full flag reference.\n\n`nemoclaw \u003Cname> rebuild` reapplies every policy preset to the recreated sandbox, so presets survive an agent-version upgrade without manual reapplication.\n\n## Custom Preset Files\n\nApply a user-authored preset YAML to a running sandbox without editing the baseline or dropping to `openshell policy set`.\n\n### Authoring\n\nA custom preset follows the same shape as the built-in ones under `nemoclaw-blueprint\u002Fpolicies\u002Fpresets\u002F`:\n\n```yaml\npreset:\n  name: my-internal-api\n  description: \"Internal service\"\nnetwork_policies:\n  my-internal-api:\n    name: my-internal-api\n    endpoints:\n      - host: api.example.internal\n        port: 443\n        protocol: rest\n        enforcement: enforce\n        rules:\n          - allow: { method: GET, path: \"\u002F**\" }\n    binaries:\n      - { path: \u002Fusr\u002Flocal\u002Fbin\u002Fnode }\n```\n\nThe top-level `preset.name` must be a lowercase RFC 1123 label (letters, digits, hyphens) and must not collide with a built-in preset name such as `slack` or `pypi`.\nRename `preset.name` if NemoClaw refuses to apply the file because of a collision.\n\n### Apply a Single File\n\n```console\n$ nemoclaw my-assistant policy-add --from-file .\u002Fpresets\u002Fmy-internal-api.yaml\n```\n\nPreview the endpoints without applying with `--dry-run`, and skip the confirmation prompt with `--yes` or by exporting `NEMOCLAW_NON_INTERACTIVE=1`.\n\n### Apply Every File in a Directory\n\n```console\n$ nemoclaw my-assistant policy-add --from-dir .\u002Fpresets\u002F --yes\n```\n\nFiles are processed in lexicographic order.\nProcessing stops at the first failure; presets already applied are not rolled back.\nFix the failing file and re-run the command to continue.\n\n**Warning:**\n\nCustom preset hosts bypass NemoClaw's review process and can widen sandbox egress to arbitrary destinations.\nReview every host in a custom preset before applying it, especially when the file originates outside your team.\n\nLoad [references\u002Fcustomize-network-policy-details.md](references\u002Fcustomize-network-policy-details.md) for detailed steps on Remove a Custom Preset.\n\n## References\n\n- **[references\u002Fintegration-policy-examples.md](references\u002Fintegration-policy-examples.md)** — Guides users through common post-install integration policy setup for maintained NemoClaw policy presets, including Outlook, messaging channels, GitHub, Jira, Brave Search, package managers, Hugging Face, local inference, and OpenShell approval workflows.\n- **Load [references\u002Fapprove-network-requests.md](references\u002Fapprove-network-requests.md)** when approving or denying sandbox egress requests, managing blocked network calls, or using the approval TUI. Reviews and approves blocked agent network requests in the TUI.\n- **Load [references\u002Fcustomize-network-policy-details.md](references\u002Fcustomize-network-policy-details.md)** when you need detailed steps for Remove a Custom Preset.\n\n## Related Skills\n\n- [Approve or Deny Agent Network Requests](references\u002Fapprove-network-requests.md) for real-time operator approval.\n- [Common Integration Policy Examples](references\u002Fintegration-policy-examples.md) for maintained preset examples such as Outlook, messaging, GitHub, Jira, Brave Search, package managers, Hugging Face, and local inference.\n- `nemoclaw-user-reference` — Network Policies (use the `nemoclaw-user-reference` skill) for the full baseline policy reference\n- OpenShell [Policy Schema](https:\u002F\u002Fdocs.nvidia.com\u002Fopenshell\u002Flatest\u002Freference\u002Fpolicy-schema.html) for the full YAML policy schema reference.\n- OpenShell [Sandbox Policies](https:\u002F\u002Fdocs.nvidia.com\u002Fopenshell\u002Flatest\u002Fsandboxes\u002Fpolicies.html) for applying, iterating, and debugging policies at the OpenShell layer.\n",{"name":5,"license":15,"description":7},"main","c475fc64e94e803b50d14a791dfee8853fbb2c5c","skills\u002Fnvidia\u002Fnemoclaw-user-manage-policy","https:\u002F\u002Fgithub.com\u002FElogic360\u002Fsoftware-factory","https:\u002F\u002Fgithub.com\u002FElogic360","2026-11-08 22:21:22",{"source":8,"skillName":5,"commands":31,"prompt":41,"zipAvailable":42},[32,35,38],{"tool":33,"command":34},"npx","npx skills add Elogic360\u002Fsoftware-factory --skill nemoclaw-user-manage-policy",{"tool":36,"command":37},"bunx","bunx skills add Elogic360\u002Fsoftware-factory --skill nemoclaw-user-manage-policy",{"tool":39,"command":40},"pnpm","pnpm dlx skills add Elogic360\u002Fsoftware-factory --skill nemoclaw-user-manage-policy","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FElogic360\u002Fsoftware-factory\u002Fblob\u002Fmain\u002Fskills\u002Fnvidia\u002Fnemoclaw-user-manage-policy\u002FSKILL.md",true,[44,50,54,58,62,66,70],{"path":45,"resourceType":46,"resourceTypeDesc":47,"sizeBytes":48,"sourceHtmlUrl":49},"BENCHMARK.md","REFERENCE","参考文档",3189,"https:\u002F\u002Fgithub.com\u002FElogic360\u002Fsoftware-factory\u002Fblob\u002Fmain\u002Fskills\u002Fnvidia\u002Fnemoclaw-user-manage-policy\u002FBENCHMARK.md",{"path":51,"resourceType":46,"resourceTypeDesc":47,"sizeBytes":52,"sourceHtmlUrl":53},"evals\u002Fevals.json",5098,"https:\u002F\u002Fgithub.com\u002FElogic360\u002Fsoftware-factory\u002Fblob\u002Fmain\u002Fskills\u002Fnvidia\u002Fnemoclaw-user-manage-policy\u002Fevals\u002Fevals.json",{"path":55,"resourceType":46,"resourceTypeDesc":47,"sizeBytes":56,"sourceHtmlUrl":57},"references\u002Fapprove-network-requests.md",2414,"https:\u002F\u002Fgithub.com\u002FElogic360\u002Fsoftware-factory\u002Fblob\u002Fmain\u002Fskills\u002Fnvidia\u002Fnemoclaw-user-manage-policy\u002Freferences\u002Fapprove-network-requests.md",{"path":59,"resourceType":46,"resourceTypeDesc":47,"sizeBytes":60,"sourceHtmlUrl":61},"references\u002Fcustomize-network-policy-details.md",681,"https:\u002F\u002Fgithub.com\u002FElogic360\u002Fsoftware-factory\u002Fblob\u002Fmain\u002Fskills\u002Fnvidia\u002Fnemoclaw-user-manage-policy\u002Freferences\u002Fcustomize-network-policy-details.md",{"path":63,"resourceType":46,"resourceTypeDesc":47,"sizeBytes":64,"sourceHtmlUrl":65},"references\u002Fintegration-policy-examples.md",12424,"https:\u002F\u002Fgithub.com\u002FElogic360\u002Fsoftware-factory\u002Fblob\u002Fmain\u002Fskills\u002Fnvidia\u002Fnemoclaw-user-manage-policy\u002Freferences\u002Fintegration-policy-examples.md",{"path":67,"resourceType":46,"resourceTypeDesc":47,"sizeBytes":68,"sourceHtmlUrl":69},"skill-card.md",2961,"https:\u002F\u002Fgithub.com\u002FElogic360\u002Fsoftware-factory\u002Fblob\u002Fmain\u002Fskills\u002Fnvidia\u002Fnemoclaw-user-manage-policy\u002Fskill-card.md",{"path":71,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"skill.oms.sig","OTHER","其他",5377,"https:\u002F\u002Fgithub.com\u002FElogic360\u002Fsoftware-factory\u002Fblob\u002Fmain\u002Fskills\u002Fnvidia\u002Fnemoclaw-user-manage-policy\u002Fskill.oms.sig",[77,84,91,98,105,112],{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":83,"publishedAt":19},"01M79G206MT3J6S0GY3C45P2KV","vss-summarize-video","Use to summarize a recorded video via the LVS summarization microservice (HITL-gated) with a VLM fallback. Not for report generation or live RTSP captioning.","https:\u002F\u002Fgithub.com\u002FElogic360\u002Fsoftware-factory\u002Fblob\u002Fmain\u002Fskills\u002Fnvidia\u002Fvss-summarize-video\u002FSKILL.md",[],[],{"skillNo":85,"name":86,"nameZh":6,"description":87,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":90,"publishedAt":19},"01M79G1WN63PGRE8CKD47WEBQ5","vss-setup-video-analytics-api","Use to deploy the vss-video-analytics-api REST service standalone (config-source, data-log bind, Elasticsearch, optional Kafka). Not for full warehouse deploy.","https:\u002F\u002Fgithub.com\u002FElogic360\u002Fsoftware-factory\u002Fblob\u002Fmain\u002Fskills\u002Fnvidia\u002Fvss-setup-video-analytics-api\u002FSKILL.md",[],[],{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":97,"publishedAt":19},"01M79G1S9F7VY3EF6H53PRP5AN","vss-setup-behavior-analytics","Use to deploy the vss-behavior-analytics service standalone (entrypoint, config-source, optional calibration). Not for the full warehouse deploy.","https:\u002F\u002Fgithub.com\u002FElogic360\u002Fsoftware-factory\u002Fblob\u002Fmain\u002Fskills\u002Fnvidia\u002Fvss-setup-behavior-analytics\u002FSKILL.md",[],[],{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":19},"01M79G1N1S1Y27PFZPYMNK1MTQ","vss-search-archive","Use this skill to run top-level VSS fusion search on archived video, or to ingest video files \u002F RTSP streams for search. Do NOT use for ad-hoc visual Q&A (use vss-ask-video), live captioning (use vss-deploy-dense-captioning), or video summarization and reports (use vss-summarize-video).","https:\u002F\u002Fgithub.com\u002FElogic360\u002Fsoftware-factory\u002Fblob\u002Fmain\u002Fskills\u002Fnvidia\u002Fvss-search-archive\u002FSKILL.md",[],[],{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":19},"01M79G1H6WN0Q6C0VCAXCZX6B7","vss-query-analytics","Use this skill when reading video-analytics metrics, incidents, alerts, and sensor data via the VA-MCP server (port 9901). Not for live VLM or incident-range narrative reports.","https:\u002F\u002Fgithub.com\u002FElogic360\u002Fsoftware-factory\u002Fblob\u002Fmain\u002Fskills\u002Fnvidia\u002Fvss-query-analytics\u002FSKILL.md",[],[],{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":118,"publishedAt":19},"01M79G1DYPNXQS7QHZ0AAF5FX5","vss-manage-video-io-storage","Use to call the VIOS REST API (sensor list, timelines, clip extraction, snapshots, add\u002Fdelete sensors and streams). Not for VLM inference or search.","https:\u002F\u002Fgithub.com\u002FElogic360\u002Fsoftware-factory\u002Fblob\u002Fmain\u002Fskills\u002Fnvidia\u002Fvss-manage-video-io-storage\u002FSKILL.md",[],[]]