# Sandboxing Agentic Systems

> >-

- **Type:** Skill
- **Install:** `agentstack add skill-pebeto-agent-stdlib-sandboxing-agentic-systems`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [pebeto](https://agentstack.voostack.com/s/pebeto)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [pebeto](https://github.com/pebeto)
- **Source:** https://github.com/pebeto/agent-stdlib/tree/main/skills/sandboxing-agentic-systems

## Install

```sh
agentstack add skill-pebeto-agent-stdlib-sandboxing-agentic-systems
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Sandboxing agentic systems

Source: [How we contain Claude](https://www.anthropic.com/engineering/how-we-contain-claude) and [Beyond permission prompts](https://www.anthropic.com/engineering/claude-code-sandboxing). Single-layer skills exist (a Seatbelt-profile generator, Docker configs). None package the end-to-end, threat-model-driven layering, which is where containment actually comes from.

Contain at the environment layer first, steer at the model layer second. A prompt or a classifier is probabilistic and will miss an edge case eventually. A filesystem mount and a firewall rule are deterministic: they hold on the case you did not think of. Build the deterministic boundary first and treat model-layer guidance as a second line, never the only one.

## Isolate the filesystem

Scope reads and writes to the working directories the task needs. Block parent and system paths. Two details decide whether it holds:

- **Use an OS primitive that also covers spawned subprocesses.** Linux bubblewrap and macOS Seatbelt confine the process tree, so a shell command the agent runs is confined too. An application-level path check does not survive the agent shelling out.
- **Validate paths before symlink resolution.** A symlink inside an allowed directory can point at `/etc`. Resolve and check the real target, not the link.

Offer mount modes that match the task: read-only, read-write, and read-write-without-delete for work that should add but never remove.

## Isolate the network

Route every outbound connection through an egress proxy with allow and deny lists, and prompt on a new destination. The non-obvious part:

**Check provenance, not just the destination domain.** Allowlisting a domain opens every endpoint reachable through it, including ones that exfiltrate. Validate where the request came from and what it carries, not only where it is going.

## Treat incoming content as hostile

Anything a network-enabled tool returns is a possible prompt-injection payload, including a fetched web page, an API response, or a file from a shared drive. Run tool results through a lightweight classifier before they enter the model's context. Defer parsing or executing project-local config, localhost listeners, and similar local-but-untrusted inputs until the user has explicitly consented.

## Keep credentials outside the sandbox

The sandbox runs model-directed code, so a long-lived secret inside it is one injection away from leaving. Put credentials behind a transparent intermediary, such as a git proxy, that authenticates and validates the request's parameters before it injects the token. The agent uses the capability; it never holds the secret.

## Log every boundary attempt

Record and surface each escape or boundary-violation attempt immediately. The logs tell you whether your layers are holding and give you the signal to tighten them.

## Match the isolation to the blast radius

Prefer battle-tested primitives (gVisor, seccomp, hypervisors) over custom isolation you have to get right yourself. Size the isolation to what the agent could damage and to the expertise of whoever operates it. Anthropic's reference implementation is `anthropic-experimental/sandbox-runtime`.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [pebeto](https://github.com/pebeto)
- **Source:** [pebeto/agent-stdlib](https://github.com/pebeto/agent-stdlib)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-pebeto-agent-stdlib-sandboxing-agentic-systems
- Seller: https://agentstack.voostack.com/s/pebeto
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.