Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add catpilotai/catpilot-ai-guardrails --skill tool-sandboxinggit clone --depth 1 https://github.com/catpilotai/catpilot-ai-guardrailsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/catpilotai/catpilot-ai-guardrails/tool-sandboxing)<a href="https://agentmods.dev/skills/catpilotai/catpilot-ai-guardrails/tool-sandboxing"><img src="https://agentmods.dev/badge/skills/catpilotai/catpilot-ai-guardrails/tool-sandboxing/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/catpilotai/catpilot-ai-guardrails/tool-sandboxing"><img src="https://agentmods.dev/badge/skills/catpilotai/catpilot-ai-guardrails/tool-sandboxing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00050 | $0.01571 |
| Opus 5.5 | $0.00020 | $0.00628 |
| Sonnet 5.5 | $0.00010 | $0.00314 |
| Haiku 4.5 | $0.00005 | $0.00157 |
Grade E, and why
tool-sandboxing scanned grade E with 4 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
- Block access to credential and system paths (`~/.ssh`, `~/.aws`, `~/.gnupg`, `~/.kube`, `~/.config/gcloud`, `/etc/passwd`, `/etc/shadow`) even when a parent directory is allowed. Cloud metadata endpointhighServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
- Resolve outbound HTTP hostnames via `socket.getaddrinfo` before connecting, reject private, loopback, link-local, reserved, and cloud metadata IPs (`169.254.169.254`, `metadata.google.internal`), and disable redirects Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
An agent harness that hands the model raw `subprocess.run(..., shell=True)`, `open(path)`, or `requests.get(url)` gives any prompt injection or reasoning mistake the full privileges of the host process. String-prefix che Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
- Expose `subprocess.run(cmd, shell=True)` or unrestricted `open(path)` directly as an agent tool. How it starts
The opening of the file, as written. The whole thing — 138 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Baseline
Applies when: Defining, wrapping, or invoking agent tools for shell execution, filesystem reads/writes/deletes, outbound HTTP fetches, or external state changes (deployments, outbound messages, database writes).
Always:
- Restrict shell tools to an explicit command allowlist with
shell=Falseand an argv list; exclude commands with exec/eval flags (find -exec,awk,python -c). - Resolve every file path and non-flag shell argument with
Path.resolve()and verify it lies inside an explicit workspaceALLOWED_DIRSset before reading or writing. - Block access to credential and system paths (
~/.ssh,~/.aws,~/.gnupg,~/.kube,~/.config/gcloud,/etc/passwd,/etc/shadow) even when a parent directory is allowed. - Resolve outbound HTTP hostnames via
socket.getaddrinfobefore connecting, reject private, loopback, link-local, reserved, and cloud metadata IPs (169.254.169.254,metadata.google.internal), and disable redirects (allow_redirects=False). - Require explicit human approval (
"yes") showing the exact action and parameters before any destructive, external-communication, or deployment tool call. - Wire deterministic runtime gates (
hooks/harness/secret_gate.py,destructive_gate.py,network_gate.py,path_gate.py) at the tool boundary of Python harnesses.
Never:
- Expose
subprocess.run(cmd, shell=True)or unrestrictedopen(path)directly as an agent tool. - Rely on hostname prefix strings alone to block SSRF (
127.0.0.1,::1,0.0.0.0, and DNS rebinding bypass string checks), or follow HTTP redirects on agent URL fetches. - Allow an agent tool to delete files, deploy services, or send external emails/messages without an explicit human confirmation gate.
Open the full component before acting: it has the examples, the remediation steps, and the detection patterns.
Why
An agent harness that hands the model raw subprocess.run(..., shell=True), open(path), or requests.get(url) gives any prompt injection or reasoning mistake the full privileges of the host process. String-prefix checks on paths or URLs routinely fail: symlinks and .. escape the working directory, DNS names resolve to internal RFC 1918 or link-local metadata addresses (169.254.169.254), and HTTP 302 redirects pivot a public URL into an internal service after the initial check.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 138 lines · 50 tokens per session scan E ae423b432a1d
tool-sandboxing is a skill published in the GitHub repository catpilotai/catpilot-ai-guardrails (2 stars, last pushed 8d ago), licensed MIT. It adds 50 tokens to every session and 1,571 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it E with 4 findings (reaches for credential files, cloud metadata endpoint, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-29.
tool-sandboxing compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| tool-sandboxingcatpilotai/catpilot-ai-guardrails | Skill | 2 | 8d ago | MIT | E | 50 | Claude Code |
| dcf-modelNousResearch/hermes-agent | Skill | 262k | today | MIT | A | 14 | Claude Code, Codex |
| baoyu-article-illustratorNousResearch/hermes-agent | Skill | 262k | today | MIT | A | 18 | Claude Code, Codex |
| flash-attentionNousResearch/hermes-agent | Skill | 262k | today | MIT | A | 14 | Claude Code, Codex |
| subagent-driven-developmentNousResearch/hermes-agent | Skill | 262k | today | MIT | A | 17 | Claude Code, Codex |
| mcporterNousResearch/hermes-agent | Skill | 262k | today | MIT | A | 16 | Claude Code, Codex |
| mem0-vercel-ai-sdkmem0ai/mem0 | Skill | 69k | yesterday | Apache-2.0 | A | 146 | Claude Code, Codex |