Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/katosh/agent_sandbox/sandbox-helpgit clone --depth 1 https://github.com/katosh/agent_sandboxWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.02249 |
| Opus 5 | $0.00000 | $0.01125 |
| Sonnet 5 | $0.00000 | $0.00450 |
| Haiku 4.5 | $0.00000 | $0.00225 |
Grade B, and why
sandbox-help scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
| `not-installed` | (binary missing) | `BWRAP=…` points at a non-existent file, or no `bwrap` on `PATH` and no `~/.linuxbrew/bin/bwrap`. | `sudo apt install bubblewrap`, `brew install bubblewrap`, or set `BWRAP=/path/to/ How it starts
The opening of the file, as written. The whole thing — 136 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Sandbox Configuration Guide
The user's config file is ~/.config/agent-sandbox/sandbox.conf, edited outside the sandbox. Changes take effect on next sandbox start. Below are common adjustments.
Grant read access to a path
Add the path to READONLY_MOUNTS in sandbox.conf:
READONLY_MOUNTS=(
# ... existing entries ...
"/fh/fast/mylab/shared_data"
)
Grant read+write access to an extra directory
Add the path to EXTRA_WRITABLE_PATHS:
EXTRA_WRITABLE_PATHS=(
"/fh/scratch/delete30/mylab/agent-output"
)
Expose credentials (SSH, AWS, etc.)
Add the dotfile or directory to HOME_READONLY (read-only) or HOME_WRITABLE (read+write):
HOME_READONLY=(
# ... existing entries ...
".ssh" # SSH keys — needed for git push, remote access
".aws" # AWS credentials
)
Home directory access modes (HOME_ACCESS)
The sandbox startup banner shows the home directory mode. Here's what each means:
| Mode | What you see in ~ |
Writes to ~ |
Details |
|---|---|---|---|
restricted |
Only dotfiles/dirs listed in HOME_READONLY and HOME_WRITABLE |
Blocked (tmpfs is remounted read-only) | Default. Minimal surface area. |
tmpwrite |
All listed dotfiles/dirs (typically most of ~) via read-only bind mounts |
Allowed but ephemeral — writes go to a tmpfs overlay and vanish on exit | Good for tools that need to write to ~/.cache, ~/.config, etc. without persisting changes. Existing files like ~/.linuxbrew, ~/.local are visible read-only. |
read |
Full real home directory | Blocked (read-only bind) | Credential dirs are hidden. HOME_WRITABLE paths are still writable. |
write |
Full real home directory | Allowed (real writes persist) | Credential dirs are hidden. Least restrictive — use with caution. |
Key point for tmpwrite: Your home directory is NOT empty. Tools installed at ~/.linuxbrew, ~/.local/bin, etc. are all visible. You just can't permanently modify them — writes land on a tmpfs overlay that disappears when the sandbox exits.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 136 lines · 0 tokens per session scan B 806da6ceebbe
sandbox-help is an agent published in the GitHub repository katosh/agent_sandbox (11 stars, last pushed 1mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,249 tokens. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
clean-implementer
Use this agent when you need to implement a design, feature, or refactor code with an emphasis on clean architecture, testability, and maintainability. This includes writing new modules, refactoring existing code to reduce duplication or complexity, breaking up large files or functions, and organizing code into…
cube-project-reviewer
Use this agent to review a pull request against CubeSandbox project-specific conventions and release gates that generic reviewers miss — OCI image multi-arch support, bilingual README coverage, feature-change test coverage, unit-test gate, orphaned project wiring, upgradability, terraform/k8s deployment design, Fix…
documentation-accuracy-reviewer
Use this agent when you need to verify that code documentation is accurate, complete, and up-to-date. Specifically use this agent after: implementing new features that require documentation updates, modifying existing APIs or functions, completing a logical chunk of code that needs documentation review, or when…
security-code-reviewer
name: security-code-reviewer description: Use this agent when you need to review code for security vulnerabilities, input validation issues, or authentication/authorization flaws. Examples: After implementing authentication logic, when adding user input handling, after writing API endpoints that process external data…
test-coverage-reviewer
name: test-coverage-reviewer description: Use this agent when you need to review testing implementation and coverage. Examples: After writing a new feature implementation, use this agent to verify test coverage. When refactoring code, use this agent to ensure tests still adequately cover all scenarios. After…
agent-network-restricted-dependency-install
When dependency installation fails with DNS, registry, index, host resolution, TLS, or network timeout errors inside an agent session, check whether network access is restricted before changing package files.