Sandwrap

Run untrusted skills safely with soft-sandbox protection. Wraps skills in multi-layer prompt-based defense (~85% attack prevention). Use when: (1) Running third-party skills from unknown sources, (2) Processing untrusted content that might contain prompt injection, (3) Analyzing suspicious files or URLs safely, (4) Testing new skills before trusting them. Supports manual mode ('run X in sandwrap') and auto-wrap for risky skills.

This skill is an instruction-only 'soft' sandbox: it provides detailed policies and code examples but ships no code to actually enforce them. That means the protection it offers depends entirely on the agent/platform following its prompts and on any platform-level interception you may already have. Before using it on sensitive data: (1) confirm your platform can intercept and enforce tool calls and path restrictions (the skill assumes this capability); (2) do not rely on Sandwrap for high-value secrets — use a VM/container or a vetted isolation mechanism instead; (3) examine where sandbox-config.json and sandwrap-output/ would live and who can read/write them; (4) test the skill with benign but adversarial-looking inputs to validate that the platform enforces the rules the skill describes; and (5) if you need stronger guarantees, request an implementation (code that runs on the platform and performs tool interception) or prefer a real OS-level sandbox.

Type: OpenClaw Skill Name: sandwrap Version: 1.0.0 The OpenClaw skill 'sandwrap' is designed as a security defense mechanism to protect against prompt injection and malicious skill execution. Its primary purpose, as detailed across SKILL.md, CLAWHUB-README.md, and references/architecture.md, is to wrap untrusted skills in a multi-layered, prompt-based 'soft sandbox'. The architecture document explicitly outlines defensive measures such as dynamic delimiters, instruction hierarchy, tool allowlists, human-in-the-loop approvals, and output verification. Crucially, it includes pseudo-code and rules to prevent data exfiltration (e.g., detecting secrets, large base64 blobs, blocking internal/private IPs), block malicious execution (e.g., path traversal, executable file writes), and counter various prompt injection techniques (e.g., meta-instructions, roleplay, encoded payloads). All content consistently describes a security-focused tool with no evidence of malicious intent or risky capabilities beyond its stated defensive purpose.