sandbox-help

A guide to configuring an agent sandbox, which is a restricted environment controlling which files and credentials an agent can read or change.

In plain words
What is it for?
Use it to configure read-only mounts, writable directories, SSH or AWS credentials, and different levels of home-directory access.
Why use it?
It explains how to grant access safely without exposing the entire computer or home directory.

Agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/katosh/agent_sandbox/sandbox-help
Clone the repo
git clone --depth 1 https://github.com/katosh/agent_sandbox
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,249 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.02249
Opus 5 $0.00000 $0.01125
Sonnet 5 $0.00000 $0.00450
Haiku 4.5 $0.00000 $0.00225

Measured 2d ago against content hash 806da6ceebbe, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

sandbox-help scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

| `not-installed` | (binary missing) | `BWRAP=…` points at a non-existent file, or no `bwrap` on `PATH` and no `~/.linuxbrew/bin/bwrap`. | `sudo apt install bubblewrap`, `brew install bubblewrap`, or set `BWRAP=/path/to/
agents/sandbox-help.md · 136 lines

How it starts

The opening of the file, as written. The whole thing — 136 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Sandbox Configuration Guide

The user's config file is ~/.config/agent-sandbox/sandbox.conf, edited outside the sandbox. Changes take effect on next sandbox start. Below are common adjustments.

Grant read access to a path

Add the path to READONLY_MOUNTS in sandbox.conf:

READONLY_MOUNTS=(
    # ... existing entries ...
    "/fh/fast/mylab/shared_data"
)

Grant read+write access to an extra directory

Add the path to EXTRA_WRITABLE_PATHS:

EXTRA_WRITABLE_PATHS=(
    "/fh/scratch/delete30/mylab/agent-output"
)

Expose credentials (SSH, AWS, etc.)

Add the dotfile or directory to HOME_READONLY (read-only) or HOME_WRITABLE (read+write):

HOME_READONLY=(
    # ... existing entries ...
    ".ssh"          # SSH keys — needed for git push, remote access
    ".aws"          # AWS credentials
)

Home directory access modes (HOME_ACCESS)

The sandbox startup banner shows the home directory mode. Here's what each means:

Mode What you see in ~ Writes to ~ Details
restricted Only dotfiles/dirs listed in HOME_READONLY and HOME_WRITABLE Blocked (tmpfs is remounted read-only) Default. Minimal surface area.
tmpwrite All listed dotfiles/dirs (typically most of ~) via read-only bind mounts Allowed but ephemeral — writes go to a tmpfs overlay and vanish on exit Good for tools that need to write to ~/.cache, ~/.config, etc. without persisting changes. Existing files like ~/.linuxbrew, ~/.local are visible read-only.
read Full real home directory Blocked (read-only bind) Credential dirs are hidden. HOME_WRITABLE paths are still writable.
write Full real home directory Allowed (real writes persist) Credential dirs are hidden. Least restrictive — use with caution.

Key point for tmpwrite: Your home directory is NOT empty. Tools installed at ~/.linuxbrew, ~/.local/bin, etc. are all visible. You just can't permanently modify them — writes land on a tmpfs overlay that disappears when the sandbox exits.

Read the full file on GitHub · 136 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 136 lines · 0 tokens per session scan B 806da6ceebbe

Subscribe to this mod's changes

sandbox-help is an agent published in the GitHub repository katosh/agent_sandbox (11 stars, last pushed 1mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,249 tokens. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other agents, from other repositories

clean-implementer

Use this agent when you need to implement a design, feature, or refactor code with an emphasis on clean architecture, testability, and maintainability. This includes writing new modules, refactoring existing code to reduce duplication or complexity, breaking up large files or functions, and organizing code into…

provos/ironcurtain · 550 tokens

cube-project-reviewer

Use this agent to review a pull request against CubeSandbox project-specific conventions and release gates that generic reviewers miss — OCI image multi-arch support, bilingual README coverage, feature-change test coverage, unit-test gate, orphaned project wiring, upgradability, terraform/k8s deployment design, Fix…

TencentCloud/CubeSandbox · 88 tokens

documentation-accuracy-reviewer

Use this agent when you need to verify that code documentation is accurate, complete, and up-to-date. Specifically use this agent after: implementing new features that require documentation updates, modifying existing APIs or functions, completing a logical chunk of code that needs documentation review, or when…

TencentCloud/CubeSandbox · 0 tokens

security-code-reviewer

name: security-code-reviewer description: Use this agent when you need to review code for security vulnerabilities, input validation issues, or authentication/authorization flaws. Examples: After implementing authentication logic, when adding user input handling, after writing API endpoints that process external data…

TencentCloud/CubeSandbox · 0 tokens

test-coverage-reviewer

name: test-coverage-reviewer description: Use this agent when you need to review testing implementation and coverage. Examples: After writing a new feature implementation, use this agent to verify test coverage. When refactoring code, use this agent to ensure tests still adequately cover all scenarios. After…

TencentCloud/CubeSandbox · 0 tokens

agent-network-restricted-dependency-install

When dependency installation fails with DNS, registry, index, host resolution, TLS, or network timeout errors inside an agent session, check whether network access is restricted before changing package files.

laozhangzzz/agent-pitbook · 0 tokens