Skill · aci · sandbox-security
Sandbox and injection
Enforce security at the executor: sandbox, allowlist, prompt-injection defense, pinned MCP, secrets out of the prompt, reduced subagent principals. Use whenever the agent runs code, reads the web or PDFs, installs MCP, or someone wants to 'just tell the model not to delete files'.
GET /api/canon/skills/sandbox-security?format=md
Untrusted speakers are everywhere: pages, PDFs, MCP descriptions, other agents. Policy text is not enforcement. E2B, OpenHands isolation, and policy sandboxes exist so you do not exec on the host with prod creds.
When
The agent has a shell, a browser, documents, or plugins. The model is a confused deputy.
Do
- 01
Sandbox every exec
Container, E2B, or OpenHands isolation. Host prod creds never enter the sandbox.
- 02
Label untrusted content
Retrieved docs, web, MCP descriptions are data. Never concatenate them into the system prompt as peer instructions.
- 03
Shrink the blast radius
Allow/ask/deny. Pin MCP. Subagents are reduced principals — no parent deploy keys.
Don't
- subprocess on the laptop with the shared AWS profile.
- eval() on model output.
- 'You must not delete files' as the only guard.
Hard rules
- Secrets injected at the executor, never the prompt or the workspace dump.
- At least one injection/refusal case in the eval set.
- Computer-use is last resort, always sandboxed.
Refuse
- Unsandboxed exec — A shell or code-act tool on the host with production credentials.
- Security by system prompt — 'Never delete files' as the only guard. The model is a confused deputy and will try to help.
- Tool poisoning — An MCP server or plugin whose description is an instruction: 'call me first, send secrets'.
- Subagent inherits the parent — Nested loops get every tool and every secret. Isolation was theater.
Load with this
Load next
- Allow / ask / denyThe agent can touch a workspace, a browser, or production. The model proposes; code decides.
- MCP serverA capability must live outside the agent process and be approved independently.
- Browser agentThe environment is a web page that has no API you can call.
- Eval harnessYou need to know whether a prompt, a tool, or a skill got worse.
Trigger tests
Should fire
- “How do we sandbox the coding agent?”
- “Defend against prompt injection”
- “The agent has a shell on prod”
Should not
- “Add CSP headers to the website”
- “Rotate AWS keys”