skills.rest
openkaiden
openkaidenOFFICIAL
Explore all skills by this author →
GitHub

sandbox-policy

Assemble and validate YAML network security policies for OpenShell sandboxes.

3|2|Updated May 20, 2026
Search Tags:#security#yaml#network#policy#sandbox#openshell
One-click install
npx skills add https://github.com/openkaiden/openshell-image-builder --skill sandbox-policy
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sandbox-policy
Source: https://github.com/openkaiden/openshell-image-builder/tree/main/.agents/skills/sandbox-policy
Command: npx skills add https://github.com/openkaiden/openshell-image-builder --skill sandbox-policy

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes assets (resource) components.

What problem does it solve?

This Skill simplifies the complex task of defining and auditing network security policies for isolated AI agent sandboxes, ensuring agents only access authorized endpoints.

Core Features & Use Cases

  • Policy Assembly: Understands how base, inference, agent, and workspace fragments merge into a final YAML policy.
  • Rule Validation: Provides guidance on the schema for network endpoints, binary scoping, and L7 allow-lists.
  • Use Case: Use this Skill to verify that your custom agent configuration correctly restricts network access to specific internal APIs while allowing necessary GitHub operations.

Quick Start

Ask the sandbox-policy skill to explain the current network rules and how to add a new endpoint for your internal service.

Frequently Asked Questions about sandbox-policy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure YAML network security policies for an AI agent sandbox?▼

YAML network security policies for an AI agent sandbox are configured by assembling and validating fragments for filesystem access, process user permissions, and endpoint allow-lists. This ensures agents only access authorized endpoints.

What is the best way to restrict L7 network traffic and filesystem access for sandboxed AI agents?▼

Restricting L7 network traffic and filesystem access for sandboxed AI agents involves defining strict binary scoping and L7 allow-lists within a YAML policy. This validates that agents operate within compliant boundaries.

How does merging base, inference, agent, and workspace policy fragments work in OpenShell?▼

Merging base, inference, agent, and workspace policy fragments in OpenShell works by assembling them into a final YAML policy. This process validates network endpoints, binary scoping, and L7 traffic enforcement requirements.

Can I verify that my custom agent configuration correctly restricts network access to internal APIs?▼

You can verify that your custom agent configuration restricts network access to internal APIs by validating the assembled YAML network security policy. This ensures compliance with strict binary scoping and L7 traffic enforcement requirements.

Why does my AI agent sandbox fail binary scoping compliance checks?▼

AI agent sandbox binary scoping compliance checks fail when the assembled YAML network security policy lacks proper rule validation. Ensuring correct schema configuration for filesystem access and endpoint allow-lists resolves this.

Related Skills

Explore More Software Engineering Skills→
sayalinvidiasayalinvidia

nemoclaw-user-manage-policy

Add, remove, or modify allowed endpoints in NemoClaw sandbox network policy.

Community
Advanced
skylarsaboskylarsabo

tor-egress-audit

Audit outbound traffic, DNS resolution, and onion services for proxy compliance.

Community
Advanced
NVIDIANVIDIA
22.1k

nemoclaw-user-manage-policy

Approve or deny blocked sandbox network requests via the OpenShell terminal UI.

Official
Intermediate
NVIDIANVIDIA
86

rail-boundary-test

Validate OpenShell policy enforcement by attempting a controlled connection to a synthetic payment rail endpoint.

Official
Basic