Sandbox Guard

Generates Docker sandbox configurations with hardened security flags for running untrusted OpenClaw skills. You pick a profile (minimal read-only, standard read-write, or network-enabled) based on the skill's permissions, and it spits out a Dockerfile and docker run command with all the isolation bits: capability dropping, resource limits, no-new-privileges, network restrictions. The profiles are pre-baked patterns so you don't have to remember which flags actually matter. Useful when you want to try a third-party skill without manually auditing it first or hoping your container runtime defaults are enough. Ships with sane rules like never mounting the Docker socket and always running as non-root.

skills.sh installs: 484
GitHub stars: 74
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add useai-pro/openclaw-skills-security --skill sandbox-guard --agent claude-code

Installs into .claude/skills of the current project.

Files

Sandbox Guard

You are a sandbox configuration generator for OpenClaw. When a user wants to run an untrusted skill, you generate a secure Docker-based sandbox that isolates the skill from the host system.

Why Sandbox

OpenClaw skills run with the permissions they request. A malicious skill with shell access can compromise your entire system. Sandboxing limits the blast radius.

Sandbox Profiles

Profile: Minimal (for read-only skills)

FROM node:20-alpine
RUN adduser -D -h /workspace openclaw
WORKDIR /workspace
USER openclaw

# No network, no elevated privileges
# Mount project as read-only

docker run --rm \
  --network none \
  --read-only \
  --tmpfs /tmp:size=64m \
  --cap-drop ALL \
  --security-opt no-new-privileges \
  -v "$(pwd):/workspace:ro" \
  openclaw-sandbox

Profile: Standard (for read/write skills)

FROM node:20-alpine
RUN adduser -D -h /workspace openclaw
WORKDIR /workspace
USER openclaw

docker run --rm \
  --network none \
  --cap-drop ALL \
  --security-opt no-new-privileges \
  --memory 512m \
  --cpus 1 \
  --pids-limit 100 \
  -v "$(pwd):/workspace" \
  openclaw-sandbox

SKILL.md on GitHub