Claims
- 1k installs
- 67k repo stars
- Updated August 4, 2026
- ruvnet/ruflo
claims is an agent skill that grants, revokes, and verifies fine-grained permissions for multi-agent operations for developers who need claims-based authorization across agent swarms.
About
claims is a ruvnet/ruflo security skill that implements claims-based authorization for agent operations and access control in multi-agent environments. The skill lets developers grant, revoke, and verify permissions before agents read files, write code, execute shell commands, spawn sub-agents, access memory, or use the network. Developers reach for claims when open-access agent swarms become risky and operations need explicit authorization checks tied to claim types. Documented claim types include read, write, execute, spawn, memory, and network, each gating a distinct capability boundary. Skip claims for single-agent local work with no security requirements.
- 7 claim types including read, write, execute, spawn, memory, network and admin
- Granular scope patterns such as /src/** and memory:patterns
- 4 security levels from minimal (read-only) to admin
- Commands for check, grant, revoke and list operations
- Hard-gate: skip when using open access or single-agent local workflows
Claims by the numbers
- 1,001 all-time installs (skills.sh)
- +3 installs in the week ending Aug 5, 2026 (Skillselion tracking)
- Ranked #395 of 2,203 Security skills by installs in the Skillselion catalog
- Security screen: MEDIUM risk (skills.sh audit)
- Data as of Aug 5, 2026 (Skillselion catalog sync)
npx skills add https://github.com/ruvnet/ruflo --skill claimsAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 1k |
|---|---|
| repo stars | ★ 67k |
| Security audit | 2 / 3 scanners passed |
| Last updated | August 4, 2026 |
| Repository | ruvnet/ruflo ↗ |
How do you authorize multi-agent operations securely?
Grant, revoke, and verify fine-grained permissions when coordinating multiple specialized agents.
Who is it for?
Developers building multi-agent systems who need explicit, revocable capability boundaries instead of unrestricted tool access.
Skip if: Single-agent local sessions with no security requirements or open-access prototyping where permission overhead is unnecessary.
When should I use this skill?
The user needs permission management, access control, authorization checks, or secure multi-agent coordination with scoped capabilities.
What you get
Granted or revoked claim tokens, verified authorization decisions, and auditable permission checks before agent actions execute.
- Granted claim records
- Authorization verification results
By the numbers
- Defines 6 claim types: read, write, execute, spawn, memory, network
Files
Claims Authorization Skill
Purpose
Claims-based authorization for secure agent operations and access control.
Claim Types
| Claim | Description |
|---|---|
read | Read file access |
write | Write file access |
execute | Command execution |
spawn | Agent spawning |
memory | Memory access |
network | Network access |
admin | Administrative operations |
Commands
Check Claim
npx claude-flow claims check --agent agent-123 --claim writeGrant Claim
npx claude-flow claims grant --agent agent-123 --claim write --scope "/src/**"Revoke Claim
npx claude-flow claims revoke --agent agent-123 --claim writeList Claims
npx claude-flow claims list --agent agent-123Scope Patterns
| Pattern | Description |
|---|---|
* | All resources |
/src/** | All files in src |
/config/*.toml | TOML files in config |
memory:patterns | Patterns namespace |
Security Levels
| Level | Claims |
|---|---|
minimal | read only |
standard | read, write, execute |
elevated | + spawn, memory |
admin | all claims |
Best Practices
1. Follow principle of least privilege 2. Scope claims to specific resources 3. Audit claim usage regularly 4. Revoke claims when no longer needed
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85How it compares
Use claims when agents need revocable capability tokens; rely on host tool policies alone only for trusted single-agent local sessions.
FAQ
Which claim types does the claims skill support?
The claims skill supports six claim types: read for file reads, write for file writes, execute for command execution, spawn for agent spawning, memory for memory access, and network for network access.
When should developers use the claims skill?
Developers use the claims skill for permission management, access control, and authorization checks in multi-agent setups. The skill should be skipped for open-access or single-agent local work without security requirements.
Is Claims safe to install?
skills.sh reports 2 of 3 security scanners passed. Review the Security Audits panel on this page before installing in production.