What problem does it solve? Sandboxed agent runners rely on a default-deny tinyproxy filter, and editing that hostname allowlist incorrectly (wildcards, IP literals, metadata hosts) silently breaks the security boundary. This Skill enforces disciplined add, remove, and audit operations on the filter file so every change stays safe and verifiable. ## Core Features & Use Cases - Guarded Add/Remove Operations: Validates POSIX-anchored regex patterns, refuses wildcards, IP literals, metadata-service hosts, and internal domains before touching docker/sandbox-proxy/filter. - Allowlist Auditing: Classifies existing entries as active, stale, or suspect using proxy logs and produces a markdown audit table without editing the file. - Verification Discipline: Surfaces the exact proxy rebuild and just doctor --full egress-test commands after every change, plus a PR description template. - Use Case: A sandboxed implement run fails because tinyproxy denied api.partner-example.com. Use this Skill to validate the hostname, add an anchored pattern to the correct filter section, and get the rebuild and egress-test commands to confirm enforcement. ## Quick Start Add api.example.com to the sandbox allowlist and show me the rebuild and verification commands.
