OpenShell is a runtime for autonomous AI agents that executes them in sandboxed environments governed by declarative policies. It is used to restrict agents' access to files, credentials, data, and network resources, and the catalogue includes skills and workflows for operating and contributing to it.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add NVIDIA/OpenShell --skill generate-sandbox-policygit clone --depth 1 https://github.com/NVIDIA/OpenShellWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nvidia/openshell/generate-sandbox-policy)<a href="https://agentmods.dev/skills/nvidia/openshell/generate-sandbox-policy"><img src="https://agentmods.dev/badge/skills/nvidia/openshell/generate-sandbox-policy/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nvidia/openshell/generate-sandbox-policy"><img src="https://agentmods.dev/badge/skills/nvidia/openshell/generate-sandbox-policy.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Snyk warn
- NVIDIA SkillSpector pass
- Socket pass
SkillSpector: 1 finding, up to low
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- low Privilege Escalation · line 310 Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.Fix: Request only the minimum permissions required. Document why each permission is needed. Remove broad permissions like '*' or 'all'.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00098 | $0.08580 |
| Opus 5.5 | $0.00039 | $0.03432 |
| Sonnet 5.5 | $0.00020 | $0.01716 |
| Haiku 4.5 | $0.00010 | $0.00858 |
Grade A, and why
generate-sandbox-policy scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- "Allow curl to hit api.github.com, read-only" How it starts
The opening of the file, as written. The whole thing — 668 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Generate Sandbox Policy
Generate YAML sandbox network policies and network middleware configuration from API documentation and natural-language user requirements.
Overview
This skill translates a user's plain-language policy intent into a valid sandbox policy. The amount of detail the user provides determines the granularity of the generated policy — from broad L4 or preset-based policies (just a host:port) up to fine-grained per-endpoint L7 rules (full API docs).
The output is a network_policies YAML block, an optional network_middlewares block, and optionally a full policy file that conforms to the sandbox policy schema.
Step 1: Gather Inputs
Determine the Detail Tier
The user's input falls into one of three tiers. Work with whatever the user provides — do not require a higher tier than needed.
| Tier | User provides | What you can generate |
|---|---|---|
| Minimal | Host(s) and plain-language intent | L4-only policies, or L7 with access presets (read-only, read-write, full) |
| Moderate | Host(s) + some known URL paths or resources | L7 with targeted glob rules for known paths, presets for the rest |
| Full | Complete API docs (OpenAPI, Swagger, markdown, URL) | Fine-grained per-endpoint L7 rules with specific method+path combinations |
Minimal Tier (host + intent only)
The user provides API endpoints and a broad intent. No API docs needed.
Examples:
- "Allow curl to hit api.github.com, read-only"
- "Give claude full access to api.anthropic.com"
- "Let /usr/bin/myapp talk to internal-svc:8080 but only for reading"
This is sufficient for:
- L4-only policies (host:port + binary checks, no method or path rules)
- Preset-based L7 policies (
read-only,read-write,fullon all paths)
For this tier, default to:
access: read-onlywhen the user says "read", "browse", "view", "query", "fetch"access: read-writewhen the user says "read-write", "create", "update" (but not "delete")access: fullwhen the user says "full access", "everything", "unrestricted"- L4-only when the user says "just allow it", "pass through", or "no
inspection". Omit
protocolfor explicit-proxy clients. Useprotocol: tcponly when the workload must use native DNS and direct socket calls, the endpoint has a valid DNS hostname, and the selected runtime support (currently Docker and Podman).
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago Changed · +1 lines 2a692a47770d
- 22d ago Changed · +2 lines 737036a0c7ef
- 29d ago Changed · +16 lines 6502915b05f4
- 1mo ago Changed · +2 lines da009fdc44eb
- 1mo ago Changed · +2 lines cc3290776d78
- 1mo ago Changed · +5 lines 6764108a156e
- 1mo ago Changed · -7 lines 639dbb1664bc
- 1mo ago Changed · +6 lines 5b70515b1fb4
- 1mo ago Changed c5885208e40a
- 2mo ago First seen · 641 lines · 98 tokens per session scan A 452141ee7fd7
generate-sandbox-policy is a skill published in the GitHub repository NVIDIA/OpenShell (21,172 stars, last pushed yesterday), licensed Apache-2.0. It adds 98 tokens to every session and 8,580 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
generate-sandbox-policy compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| generate-sandbox-policyNVIDIA/OpenShell | Skill | 21k | yesterday | Apache-2.0 | A | 98 | Claude Code, Codex |
| imagegenopenai/codex | Skill | 133k | today | Apache-2.0 | A | 113 | Codex |
| playwright-climicrosoft/playwright | Skill | 99k | yesterday | Apache-2.0 | A | 19 | Claude Code |
| local-ai-agentsmicrosoft/ai-agents-for-beginners | Skill | 79k | 4d ago | MIT | A | 200 | Claude Code, Codex |
| systematic-debuggingobra/superpowers | Skill | 313k | 3d ago | MIT | A | 21 | Claude Code |
| next-cache-components-adoptionvercel/next.js | Skill | 143k | today | MIT | A | 95 | Claude Code |
| chat-pet-sprite-creationmicrosoft/vscode | Skill | 195k | today | MIT | A | 53 | Claude Code, Codex |