SkillOS enforces three layers of execution security:

Every file-IO tool call (read_file, write_file, Read, Write, Glob, Grep, etc.) is validated before the permission mode check. Even tools in ALLOW mode cannot escape the workspace root.

from permission_policy import PathPolicy

p = PathPolicy()                                          # defaults to cwd
p.validate_path("read_file", {"path": "/etc/passwd"})     # (False, "path traversal blocked: ...")
p.validate_path("read_file", {"path": "projects/foo.md"}) # (True, "")

• Resolves symlinks via Path.resolve() before checking
• Relative paths are resolved against the workspace root
• Non-file-IO tools (e.g. Bash, call_llm) are not checked

Shell commands run through a pluggable SandboxExecutor instead of raw subprocess.run().

# Default — runs on host (same as before)
python agent_runtime.py "Your goal"

# E2B cloud sandbox — requires pip install e2b-code-interpreter + E2B_API_KEY
python agent_runtime.py --sandbox e2b "Your goal"

If --sandbox e2b is requested but the package or API key is missing, the runtime falls back to local with a warning.

Additionally, the QWEN manifest exec() namespace is restricted — exec, eval, and compile are removed from builtins so manifest-defined tools cannot execute arbitrary code generation.

SkillOS includes an antivirus-style security gate that scans every skill file before installation. No external skill reaches disk without passing through skill-security-scan-agent.

The security scan runs between download and disk write during skill install and skill update:

skill install my-skill
      ↓
1. Download to temp path
      ↓
2. → skill-security-scan-agent (8 checks)
      ↓
BLOCKED  →  abort, display reason, keep report, delete temp file
WARNING  →  display findings, prompt "Install anyway? [y/N]"
SAFE     →  proceed with install, log scan_id in packages.lock

Skills are markdown documents interpreted by an LLM at runtime. The attack surface is the LLM's interpretation of the skill's instructions — not executable code.

Scans body and frontmatter for patterns that attempt to hijack the LLM:

• "ignore all previous instructions"
• "disregard your system prompt"
• "you are now [X]" (jailbreak pattern)
• "DAN mode", "sudo mode", "bypass restrictions"
• "override safety", "pretend there are no restrictions"

Any match → BLOCK

Compares the incoming skill's name field against all known system skill names (loaded from system/skills/**/*.manifest.md and system/agents/*.md). If a third-party skill claims a system skill's name:

→ BLOCK: "Name conflict with system skill {name} — possible trust hijacking"

Trusted sources (e.g., github:EvolvingAgentsLabs/*, local:) are exempt.

Compares declared tools against the skill's stated purpose. A skill claiming Bash with a description like "summarizes text" is suspicious:

Any tool not in the SkillOS allowed set (Read, Write, Edit, Glob, Grep, Bash, WebFetch, Task, Agent) → BLOCK

Overclaiming without unknown tools → WARN

Scans for hardcoded URLs in WebFetch, curl, or wget contexts pointing to non-whitelisted domains. Legitimate skills rarely hardcode specific URLs in their spec — they receive URLs as parameters.

• Unknown domain in fetch context → WARN
• Domain on the blocklist (system/security/blocklist.md) → BLOCK

Scans for techniques used to hide malicious content:

• Long base64 blobs (60+ chars) outside code examples
• Zero-width characters (\u200B, \u200C, \uFEFF)
• Unicode homoglyphs in critical keywords (Cyrillic chars substituting Latin)
• Excessive hidden HTML comments
• Null bytes or control characters

Single technique → WARN Multiple techniques together → BLOCK

Scans for patterns indicating unbounded agent spawning:

• More than 3 Agent/Task calls without a convergence condition
• Self-referential delegation (agent instructed to spawn itself)
• Loops without termination criteria

→ WARN (may be a legitimate orchestrator — human review required)

• Missing required keys (name, type, description) → WARN
• Unknown YAML keys with executable-looking values → WARN
• extends pointing outside system/skills/ → WARN

Compares against system/packages.lock:

• Same skill name, different source → WARN: "already installed from {source}"
• Incoming skill would overwrite a system skill from an external source → BLOCK

Every scan writes a report to system/security/scan_reports/{skill_name}_{timestamp}.md:

---
scan_id: a1b2c3d4-...
skill_name: my-agent
source: github:someorg/skills
scanned_at: 2026-04-01T14:30:00Z
verdict: WARNING
scanner_version: 1.0.0
---

# Security Scan Report: my-agent

**Verdict**: WARNING
**Source**: github:someorg/skills
**Scanned**: 2026-04-01T14:30:00Z

## Check Results

| Check | ID | Status | Detail |
|-------|----|--------|--------|
| Prompt Injection      | CHECK-01 | PASS | No patterns found |
| Name Spoofing         | CHECK-02 | PASS | No conflict |
| Tool Overclaiming     | CHECK-03 | WARN | Bash declared; description suggests read-only |
| Exfiltration Vectors  | CHECK-04 | PASS | No hardcoded URLs |
| Obfuscation           | CHECK-05 | PASS | No patterns found |
| Delegation Chains     | CHECK-06 | PASS | No unbounded loops |
| Frontmatter Integrity | CHECK-07 | PASS | All required keys present |
| Supply Chain          | CHECK-08 | PASS | No conflict |

## Findings Detail

**CHECK-03**: Skill declares `tools: [Read, Bash, Write]` but description reads
"Searches and summarizes text files." Bash is not needed for read/summarize tasks.
Recommend verifying the tool list with the source maintainer.

## Recommended Action
Review findings before installing.
Use `skill install my-agent --force` to override after manual review.

All reports are indexed in system/security/scan_index.md for audit history.

Every installed skill records its scan result in system/packages.lock:

- name: my-agent
  version: v1.0
  source: github:someorg/skills
  installed_to: system/agents/my-agent.md
  hash: md5:abc123
  installed_at: 2026-04-01T14:30:00Z
  security_scan:
    verdict: SAFE
    scan_id: a1b2c3d4-...
    report_path: system/security/scan_reports/my-agent_20260401.md
    scanned_at: 2026-04-01T14:30:00Z

Re-scan already-installed skills at any time:

# Scan all installed skills
skillos execute: "security scan all installed skills"

# Scan a specific skill
skillos execute: "security scan skill research-assistant-agent"

# Full system security audit
skillos execute: "security audit system"

This is useful after updating scanner rules or discovering a new threat pattern.

Known malicious domains can be added to system/security/blocklist.md. Any skill with a hardcoded fetch to a blocklisted domain gets an automatic BLOCK regardless of other checks.

# Security Blocklist

## Malicious Domains
- evil.example.com   # exfiltration endpoint seen in wild (2026-03-15)
- data-harvest.io    # credential harvesting service