Gws Modelarmor Sanitize Prompt
Sanitize inbound user prompts through a Google Model Armor template before they reach your LLM or agent pipeline.
Overview
Gws-modelarmor-sanitize-prompt is an agent skill for the Ship phase that sanitizes user prompts via the gws CLI and a Model Armor template before model inference.
Install
npx skills add https://github.com/googleworkspace/cli --skill gws-modelarmor-sanitize-promptWhat is this skill?
- Runs gws modelarmor +sanitize-prompt against a full template resource name
- Accepts --text, JSON body, or stdin when no inline text is provided
- Pairs with gws-shared auth and global flags documented as a prerequisite
- Documents companion +sanitize-response for outbound content safety
- Documented gws skill metadata version 0.22.5
- Requires gws binary per openclaw requires.bins
Adoption & trust: 14.9k installs on skills.sh; 26.9k GitHub stars; 3/3 security scanners passed (skills.sh audits).
What problem does it solve?
Raw user prompts can carry injection, policy violations, or unsafe content before your agent sends them to a model.
Who is it for?
Teams on Google Cloud Model Armor with gws installed who need a repeatable CLI step in agent or API ingress pipelines.
Skip if: Projects without Model Armor templates or builders who only need post-hoc response moderation (use sanitize-response instead).
When should I use this skill?
Sanitizing inbound user prompts through a configured Model Armor template via gws.
What do I get? / Deliverables
Inbound text is evaluated through your Model Armor template so only sanitized prompt content proceeds to inference or logging.
- Sanitized prompt payload from Model Armor for downstream inference
- Documented CLI invocations for text, JSON, and stdin paths
Recommended Skills
Journey fit
How it compares
CLI integration to Google Model Armor—not a local static prompt blocklist skill.
Common Questions / FAQ
Who is gws-modelarmor-sanitize-prompt for?
Solo and small-team builders using the googleworkspace gws CLI with Model Armor templates to guard LLM and agent inputs on Google Cloud.
When should I use gws-modelarmor-sanitize-prompt?
During Ship/security when wiring pre-inference prompt checks in CI or runtime, before launch traffic, and whenever user prompts enter an automated agent workflow.
Is gws-modelarmor-sanitize-prompt safe to install?
Review the Security Audits panel on this page; the skill requires the gws binary, cloud auth, and sends prompt text to Google APIs—scope credentials and templates least-privilege.
Workflow Chain
Requires first: gws shared
Then invoke: gws modelarmor sanitize response
SKILL.md
READMESKILL.md - Gws Modelarmor Sanitize Prompt
# modelarmor +sanitize-prompt > **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it. Sanitize a user prompt through a Model Armor template ## Usage ```bash gws modelarmor +sanitize-prompt --template <NAME> ``` ## Flags | Flag | Required | Default | Description | |------|----------|---------|-------------| | `--template` | ✓ | — | Full template resource name (projects/PROJECT/locations/LOCATION/templates/TEMPLATE) | | `--text` | — | — | Text content to sanitize | | `--json` | — | — | Full JSON request body (overrides --text) | ## Examples ```bash gws modelarmor +sanitize-prompt --template projects/P/locations/L/templates/T --text 'user input' echo 'prompt' | gws modelarmor +sanitize-prompt --template ... ``` ## Tips - If neither --text nor --json is given, reads from stdin. - For outbound safety, use +sanitize-response instead. ## See Also - [gws-shared](../gws-shared/SKILL.md) — Global flags and auth - [gws-modelarmor](../gws-modelarmor/SKILL.md) — All filter user-generated content for safety commands