Contenu du pack

Un fichier SKILL.md (le guide pratique) + un modèle de départ. Aperçu :

Agent Sandbox & Kill-Switch

When to use

• You're giving an AI agent its first real tools (browser, shell, APIs, devices).
• Your agent will run on hardware you don't fully control — user devices, edge boxes, third-party cloud.
• Compliance or a customer asked "how is the agent contained?" and "what's the kill switch?"
• You're reviewing someone else's agent deployment and need the checklist that matters.

Workflow

1. Declare the job boundary (input: what the agent is for → output: job card)
   One card: the task, the inputs it needs, the outputs it produces, and the resources those require — nothing more. Every sandbox rule below derives from this card. If the job can't be written on one card, split the agent before sandboxing it.
2. Deny the network by default (input: job card → output: egress allowlist)
   Start from zero outbound connectivity. Allowlist only: the exact hosts, ports, and protocols the job needs (API endpoints, not "the internet"; port 443 to api.vendor.com, not 0.0.0.0/0). DNS limited to the allowlisted names. Log every allowed connection with timestamp and byte count; alert on any denied attempt — a denied attempt is the agent telling you what it wanted.
3. Make the filesystem read-mostly (input: job card → output: filesystem policy)
   Read-only everywhere except one scratch directory. No writes to binaries, configs, startup locations, or other agents' directories. Scratch is wiped on session end. The agent cannot install packages, modify its own code, or persist anything across restarts unless persistence is the job — and then only to its assigned state path.
4. Shrink identity lifetime (input: job card → output: identity spec)
   Per-instance, short-lived credentials scoped to the job: minutes-to-hours, not months. No long-lived API keys in the agent's environment — it gets tokens minted at session start, revoked at session end. Separate identities per deployment; if one is compromised, rotation is "kill the session," not "rotate the company key."
5. Build the kill switch (input: everything → output: stop procedure)
   Three layers: (a) session kill — terminate the agent process and its children immediately, revoke its tokens; (b) network kill — cut the sandbox's egress at the proxy/firewall, independent of the agent cooperating; (c) credential kill — revoke every token the session minted. Each layer must work when the agent is actively misbehaving — test the kill switch against a deliberately uncooperative test agent, not a compliant one. Name the human with stop authority and the maximum time from "stop" to "stopped" (target: under 60 seconds).
6. Instrument for the post-mortem (input: sandbox → output: audit log spec)
   Log: every tool call with arguments (redact secrets at write time), every network connection, every file write, every identity minted. Retain long enough to investigate (90 days minimum for production). The log exists so the next incident gets a timeline in minutes, not a forensics project in weeks.

Aperçu du modèle

Agent Sandbox & Kill-Switch Worksheet

Default-deny everything; every permission is a deliberate, expiring exception.

1. Job card

Task / inputs / outputs / required resources (one card — if it doesn't fit, split the agent):

2. Egress allowlist (default: zero outbound)

DNS limited to allowlisted names: [ ] yes Denied attempts alert to:

3. Filesystem policy

• Read-only everywhere except:
• Scratch dir (wiped on session end):
• Agent may NEVER write to:

4. Identity spec

• Per-instance identity: [ ] yes
• Lifetime (minutes–hours, not months):
• Minted at session start / revoked at session end: [ ] yes
• No long-lived keys in agent environment: [ ] verified

Le pack de compétence lui-même (SKILL.md + modèle) est rédigé en anglais.

Acheter le pack complet — $4.99 Pro — les 511 compétences