local-agent-process-isolation
Skill1 starsChanged 2 months agoMITView on GitHub
Use when changing shell or file tool execution, OS sandbox policies, Windows or POSIX isolation, MCP stdio process lifetime, or approval versus auto-allow. Use when the user mentions sandbox, 沙箱, Seatbelt, bubblewrap, Landlock, Job Object, write whitelist.
In this repository22 other files it gives its agents.
- AGENTS.mdAGENTS.md
- CLAUDE.mdCLAUDE.md
- agent-core-boundariesSkill
- agent-qualitySkill
- agent-runtimeSkill
- agent-surfaceSkill
- local-agent-process-isolationSkill
- spec-authorSkill
- using-agent-crewSkill
- agent-core-boundariesSkill
- agent-qualitySkill
- agent-runtimeSkill
- agent-surfaceSkill
- spec-authorSkill
- using-agent-crewSkill
- agent-core-boundariesSkill
- agent-qualitySkill
- agent-runtimeSkill
- agent-surfaceSkill
- local-agent-process-isolationSkill
- spec-authorSkill
- using-agent-crewSkill
The file
Files
Local Agent Process Isolation
You are the isolation engineer. You change OS/MCP enforcement. You run deny and kill-tree tests. You do not recommend a sandbox for the team to build later.
Stack (read, do not rewrite)
| When | Read |
| MCP / A2A / stdio child lifetime | agent-interop (pin the spec date; fetch before wire changes) |
| Secrets, injection, untrusted LLM output | security-and-hardening — not as OS-sandbox doctrine |
| You are writing an MCP server | mcp-builder (names, pagination, actionable errors) then agent-interop |
Cite, don’t vendor: Anthropic sandbox-runtime, Codex sandbox docs, Trail of Bits coop (CC-BY-SA).
Pairing (absorbed)
- Threat-model the trust boundary first (injection, exfil, escape, MCP-as-host), then patch. LLM output is untrusted input.
- Constraints inherit down the process tree. Docker/seccomp-alone are not the boundary.
- Missing Landlock/WSL1 → fail closed or explicit downgrade in code, never silent unsandbox.
- Windows ≠ Linux. Do not port Seatbelt/bwrap onto Windows; Job Object ≠ ACL/WFP.
- stdio MCP often sits outside bash Seatbelt — sandbox it or treat as unsandboxed in the implementation.
- MCP children die with the session. A protocol claim without a pinned spec date is a guess — fetch before changing wire code.
security-and-hardeningcovers secrets, injection, allowlists. It does not decide Seatbelt vs Job Object.- Unconstrained filesystem MCP is a reject. Inspector is a CLI while building a server, not a resident host.
Do
- Threat-model in the change (injection, exfil, escape, MCP-as-host) — then patch the primitive.
- Constraints inherit down the process tree. Docker/seccomp-alone are not the boundary.
- Missing Landlock/WSL1 → fail closed or explicit downgrade in code, never silent unsandbox.
- Windows ≠ Linux. Do not port Seatbelt/bwrap onto Windows; implement the Windows path (Job Object ≠ ACL/WFP).
- stdio MCP often sits outside bash Seatbelt — sandbox it or treat as unsandboxed in the implementation.
- Run tests that denies are observable and MCP children die with the session.
Required reads
.agents/skills/agent-interop/, .agents/skills/security-and-hardening/ (secrets/injection only). Paths: this-repo.md.
Done when
Deny/kill-tree tests exist. Sign-off: become agent-quality and re-run modular isolation tests plus overall suite.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.