SkillSandbox – Capability-based sandbox for AI agent skills (Rust)

Name: SkillSandbox – Capability-based sandbox for AI agent skills (Rust)
Availability: InStock
Author: ClaytheMachine

by ClaytheMachine·Feb 15, 2026·1 point·0 comments

Visit Project View on HN

AI Analysis

●●●BangerSolve My ProblemDark HorseWizardry

Seccomp+iptables+mount isolation blocks the ClawdHub credential stealer in practice.

Strengths

•Threat model grounded in real incident (malicious weather skill harvesting AWS keys).
•iptables default-deny + seccomp-bpf enforcement is OS-native, not easily bypassed.
•Companion AgentTrace tool addresses second-order failure (right perms, wrong behavior).

Weaknesses

•Rust/Linux stack limits adoption; no MCP server integration actually shown working.
•Adoption depends on marketplace ecosystem standardizing YAML manifests — chicken-and-egg.

Post Description

Built this after finding a credential stealer on an AI skills marketplace. The malicious skill looked like a normal weather lookup but was exfiltrating ~/.ssh, AWS creds, and browser cookies. My agent ran it without hesitation.

SkillSandbox is the fix: skills declare permissions in YAML (network egress, filesystem paths, env vars), the runtime enforces via iptables default-deny, seccomp-bpf, and mount isolation. MCP server integration for Claude Code.

Also built a companion project, AgentTrace (https://github.com/theMachineClay/agenttrace), for the other failure mode: when an agent has the right permissions but does the wrong thing repeatedly. Session-aware policy engine with cumulative cost tracking, violation counting, and kill-switch.

Together: SkillSandbox constrains what agents can reach. AgentTrace enforces what agents should do.

Happy to answer questions about the architecture or threat model.