What problem does it solve? AI agents execute model-generated code and tool calls against real systems, and a single prompt injection can turn private data access plus network egress into data exfiltration. This Skill provides the decision procedures to sandbox agents correctly, classify every tool call as read-only, reversible-write, or irreversible-destructive, and enforce those tiers at a blocking interception point. ## Core Features & Use Cases - Lethal trifecta audit: Checks every agent configuration for the simultaneous presence of private data, untrusted content, and an egress path, and refuses assembly or cuts a leg when all three coincide. - Sandbox tier selection: Compares hardened containers, gVisor, Firecracker/Kata microVMs, and WebAssembly, and specifies network egress controls in five terms (host and port, pinned addresses, DNS denial, loopback/RFC 1918 denial, mandatory egress proxy). - Effect-tier classification and interception: Resolves HTTP verbs, SQL verbs, and shell commands into read-only, reversible-write, or destructive tiers on the fully-substituted call, binds each tier to an allow/deny disposition, and orders guard hooks, deny rules, allow rules, classifiers, and human gates. - Use Case: When wiring a PreToolUse hook for an agent that has a shell and a general HTTP client, use this Skill to classify each call, default-deny unresolved operations, and place the egress allowlist at a mandatory proxy the agent cannot bypass. ## Quick Start Audit my agent configuration for exfiltration risk and tell me which sandbox tier and egress controls to apply before shipping it.
