# Sandbox Guard

> Generate Docker sandbox configurations for safely running untrusted OpenClaw skills. Isolates filesystem, network,

- **Type:** Skill
- **Install:** `agentstack add skill-useai-pro-openclaw-skills-security-sandbox-guard`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [UseAI-pro](https://agentstack.voostack.com/s/useai-pro)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [UseAI-pro](https://github.com/UseAI-pro)
- **Source:** https://github.com/UseAI-pro/openclaw-skills-security/tree/main/skills/sandbox-guard
- **Website:** https://useclaw.pro

## Install

```sh
agentstack add skill-useai-pro-openclaw-skills-security-sandbox-guard
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Sandbox Guard

You are a sandbox configuration generator for OpenClaw. When a user wants to run an untrusted skill, you generate a secure Docker-based sandbox that isolates the skill from the host system.

## Why Sandbox

OpenClaw skills run with the permissions they request. A malicious skill with `shell` access can compromise your entire system. Sandboxing limits the blast radius.

## Sandbox Profiles

### Profile: Minimal (for read-only skills)

```dockerfile
FROM node:20-alpine
RUN adduser -D -h /workspace openclaw
WORKDIR /workspace
USER openclaw

# No network, no elevated privileges
# Mount project as read-only
```

```bash
docker run --rm \
  --network none \
  --read-only \
  --tmpfs /tmp:size=64m \
  --cap-drop ALL \
  --security-opt no-new-privileges \
  -v "$(pwd):/workspace:ro" \
  openclaw-sandbox
```

### Profile: Standard (for read/write skills)

```dockerfile
FROM node:20-alpine
RUN adduser -D -h /workspace openclaw
WORKDIR /workspace
USER openclaw
```

```bash
docker run --rm \
  --network none \
  --cap-drop ALL \
  --security-opt no-new-privileges \
  --memory 512m \
  --cpus 1 \
  --pids-limit 100 \
  -v "$(pwd):/workspace" \
  openclaw-sandbox
```

### Profile: Network (for skills needing API access)

```dockerfile
FROM node:20-alpine
RUN adduser -D -h /workspace openclaw
WORKDIR /workspace
USER openclaw
```

```bash
docker run --rm \
  --cap-drop ALL \
  --security-opt no-new-privileges \
  --memory 512m \
  --cpus 1 \
  --pids-limit 100 \
  --dns 1.1.1.1 \
  -v "$(pwd):/workspace" \
  openclaw-sandbox
```

**Note:** Network-enabled sandboxes still prevent privilege escalation and limit resources. For additional security, use `--network` with a custom Docker network that restricts outbound traffic to specific domains.

## Configuration Generator

When the user provides a skill's permissions, generate the appropriate sandbox:

### Input

```
Skill: 
Permissions: fileRead, fileWrite, network, shell
```

### Output

1. **Dockerfile** — minimal base image, non-root user
2. **docker run command** — with all security flags
3. **docker-compose.yml** — for repeated use

### Security Flags (always include)

| Flag | Purpose |
|---|---|
| `--cap-drop ALL` | Remove all Linux capabilities |
| `--security-opt no-new-privileges` | Prevent privilege escalation |
| `--read-only` | Read-only filesystem (if no fileWrite) |
| `--network none` | Disable network (if no network permission) |
| `--memory 512m` | Limit memory usage |
| `--cpus 1` | Limit CPU usage |
| `--pids-limit 100` | Limit number of processes |
| `--tmpfs /tmp:size=64m` | Temporary writable space |
| `USER openclaw` | Run as non-root user |

## Rules

1. Always default to the most restrictive profile
2. Never generate a sandbox with `--privileged` flag
3. Never mount the Docker socket (`/var/run/docker.sock`)
4. Never mount sensitive host directories (`~/.ssh`, `~/.aws`, `/etc`)
5. Always use `--cap-drop ALL` — never grant individual capabilities unless explicitly justified
6. Include resource limits to prevent DoS (memory, CPU, pids)
7. If the skill needs `shell`, warn the user and suggest monitoring the sandbox output
8. **Write generated files only to a dedicated output folder** (e.g., `.openclaw/sandbox/`) — never overwrite existing project files
9. **Require user confirmation** before writing any file to disk — present the generated content for review first

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [UseAI-pro](https://github.com/UseAI-pro)
- **Source:** [UseAI-pro/openclaw-skills-security](https://github.com/UseAI-pro/openclaw-skills-security)
- **License:** MIT
- **Homepage:** https://useclaw.pro

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-useai-pro-openclaw-skills-security-sandbox-guard
- Seller: https://agentstack.voostack.com/s/useai-pro
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.