Built this after finding a credential stealer on an AI skills marketplace. The malicious skill looked like a normal weather lookup but was exfiltrating ~/.ssh, AWS creds, and browser cookies. My agent ran it without hesitation.

SkillSandbox is the fix: skills declare permissions in YAML (network egress, filesystem paths, env vars), the runtime enforces via iptables default-deny, seccomp-bpf, and mount isolation. MCP server integration for Claude Code.

Also built a companion project, AgentTrace (https://github.com/theMachineClay/agenttrace), for the other failure mode: when an agent has the right permissions but does the wrong thing repeatedly. Session-aware policy engine with cumulative cost tracking, violation counting, and kill-switch.

Together: SkillSandbox constrains what agents can reach. AgentTrace enforces what agents should do.

Happy to answer questions about the architecture or threat model.