Menú
Generate a Sigil sandbox policy YAML from scan results for secure agent execution
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Basado en la clasificación ocupacional SOC
Automated security auditing for AI agent code. Scans repos, packages, MCP servers, and installed skills for malicious patterns using eight-phase analysis: install hooks, dangerous code patterns, network exfiltration, credential access, obfuscation, provenance, prompt injection, and skill security. Use when: cloning repos, installing packages, reviewing MCP servers, auditing skills, scanning code before execution, or when asked to check if something is safe, audit code, scan for malware, review dependencies.
Act as a brutally honest McKinsey-level strategy consultant to diagnose the real underlying problems hurting a business's growth, profitability, or traction. Use this skill whenever someone asks to diagnose their business, wants honest feedback on why their business isn't growing, says things like 'what's wrong with my business', 'why isn't this working', 'roast my startup', 'tear apart my business', 'honest assessment', 'brutal feedback', 'diagnose my company', or asks for a strategy consultant perspective. Also trigger when users share a business description and ask what's holding them back.
Identify a founder's biggest blind spots — flawed assumptions, strategic misjudgments, and decisions that feel right but are damaging the business long-term. Use this skill whenever someone asks about their blind spots, wants to know what they're missing, says things like 'what am I not seeing', 'where am I wrong', 'challenge my assumptions', 'play devil's advocate on my business', 'what would I regret in 2 years', 'poke holes in my strategy', or asks for a fresh perspective from someone who's seen startups fail. Also trigger when a founder seems very confident and asks for feedback — confidence is often where blind spots hide.
Identify the single biggest bottleneck preventing faster business growth by examining the offer, audience targeting, distribution channels, messaging, pricing, and funnel structure. Use this skill whenever someone asks why they aren't growing faster, wants to find their growth bottleneck, says things like 'what's limiting our growth', 'why are we stuck', 'we've plateaued', 'growth has stalled', 'how do we grow faster', 'what's the constraint', 'find the bottleneck', 'why aren't we scaling', or describes a business that should be growing but isn't. Also trigger when a founder shares decent traction but frustration about pace.
Evaluate a business idea or offer through the lens of real market demand — is the problem truly painful, the solution compelling, and the positioning differentiated? Use this skill whenever someone asks for a market reality check, wants to validate a business idea, says things like 'is there a market for this', 'will people pay for this', 'is my idea viable', 'validate my concept', 'is this a real problem', 'market validation', 'demand check', 'would you buy this', or shares a new business concept and wants honest market feedback. Also trigger when someone is about to invest significant time or money into an unvalidated idea.
Analyze a product or service offer with ruthless objectivity to determine if the value proposition is strong enough to drive real demand. Use this skill whenever someone asks to evaluate their offer, test their value proposition, says things like 'is my offer good enough', 'rate my offer', 'test my pricing', 'is this compelling', 'would you buy this', 'critique my product', 'evaluate my service', 'offer teardown', 'value prop test', 'is my pricing right', or shares a product/service and wants to know if it will sell. Also trigger when someone is about to launch a new offer, restructuring their pricing, or struggling with low conversion rates that may be offer-related.
| name | generate-policy |
| description | Generate a Sigil sandbox policy YAML from scan results for secure agent execution |
| allowed-tools | Bash(./bin/sigil *), Read, Write, Glob |
Generate a Sigil security policy YAML file based on scan results. The policy controls filesystem, network, process, and credential access for sandboxed agent execution.
./bin/sigil scan <path> to get findingsversion: "1.0"
name: "<project-name>-policy"
description: "Auto-generated from Sigil scan on <date>"
filesystem:
read_only:
- /usr
- /lib
- /etc
read_write:
- /tmp
include_workdir: true
network:
default_action: deny
rules:
- name: "<endpoint-name>"
host: "<hostname>"
port: 443
access: read-only
enforcement: enforce
process:
run_as_user: sandbox
run_as_group: sandbox
deny_syscall_categories:
- privilege_escalation
credentials:
allowed_env:
- TERM
- PATH
- HOME
denied_env: []
providers: []
sigil-policy.yaml in the project root| Scan Verdict | Network Policy | Credential Policy | Process Policy |
|---|---|---|---|
| CLEAN | permissive | allow common | standard |
| LOW RISK | standard endpoints | allow declared | standard |
| MEDIUM RISK | strict allowlist | minimal | sandboxed user |
| HIGH RISK | deny all | deny all | full restrictions |
| CRITICAL | deny all + log | deny all | full restrictions |