菜单
Defines tool permission profiles for programmatic agent execution. Controls which tools an agent can use based on execution mode and project type.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | sandbox-profiles |
| description | Defines tool permission profiles for programmatic agent execution. Controls which tools an agent can use based on execution mode and project type. |
| version | 1 |
| metadata | {"category":"security","author":"auto-workflow","evolution-stats":{"total-experiments":870}} |
| level | molecule |
| atoms | ["tool-prompts","agent-prompts"] |
Different execution contexts require different tool permissions:
{
"allowed": ["Read", "Grep", "Glob", "Edit", "ApplyPatch", "Code_Map", "Code_Inspect", "Code_Replace", "Code_Usages", "Diagnostics", "describe_symbol", "get_symbol_source", "find_buffers_and_recent"],
"readonly": ["Read", "Grep", "Glob", "Code_Map", "Code_Inspect", "Code_Usages", "Diagnostics", "describe_symbol", "get_symbol_source", "find_buffers_and_recent"],
"confirming": ["Edit", "ApplyPatch", "Code_Replace"],
"timeout": 15,
"max_calls": 25,
"result_limit": 4000
}
{
"allowed": ["Read", "Grep", "Glob", "Edit", "ApplyPatch", "Code_Map", "WebFetch", "WebSearch", "Bash", "Diagnostics"],
"readonly": ["Read", "Grep", "Glob", "Code_Map", "WebFetch", "WebSearch", "Diagnostics"],
"confirming": ["Edit", "ApplyPatch", "Bash"],
"timeout": 30,
"max_calls": 50,
"result_limit": 8000
}
{
"allowed": ["Read", "Grep", "Glob", "Edit", "Bash", "Diagnostics", "Programmatic"],
"readonly": ["Read", "Grep", "Glob", "Diagnostics"],
"confirming": ["Edit", "Bash", "Programmatic"],
"timeout": 60,
"max_calls": 100,
"result_limit": 16000
}
{
"allowed": ["Read", "Grep", "Glob", "Code_Map", "Code_Inspect", "Code_Usages", "Diagnostics", "describe_symbol", "get_symbol_source"],
"readonly": ["Read", "Grep", "Glob", "Code_Map", "Code_Inspect", "Code_Usages", "Diagnostics", "describe_symbol", "get_symbol_source"],
"confirming": [],
"timeout": 15,
"max_calls": 25,
"result_limit": 4000
}
Load profile in Emacs Lisp:
(let ((skill (gptel-auto-workflow--load-skill "sandbox-profiles")))
(plist-get skill :profiles))
scripts/validate_profile.py - Validate profile JSON against schemascripts/generate_profile.py - Generate profile from project analysisBased on analysis of 0 experiments.
| Tool | Level | Success Rate | Experiments |
|---|
Transforms research paper analysis from extraction to narrative storytelling. Uses 7-beat narrative spine (protagonist/dilemma/old-path/turning-point/solution/ending/core) to make papers understandable to non-experts. Includes speed-read card, PhD advisor review, and real-world testing. Use when researcher encounters a research paper and needs to extract deep understanding, not just surface facts. Triggers on "paper", "research paper", "analyze paper", "tell me about this paper", "讲论文", "读论文".
Workflow chain: researcher → paper-storytelling. When researcher encounters a research paper, automatically invoke paper-storytelling to transform extraction into narrative understanding. Use when user says "research paper", "analyze this paper", "tell me about this paper", or when researcher detects arxiv/PDF links.
Prompt template for external research specialist subagent. Auto-evolves based on experiment outcomes.
Inspect and operate OV5 (Ouroboros V5) through the live Emacs daemon. Use when checking auto-workflow status, starting guarded runs, reviewing experiment results, or querying researcher and evolution state.
Clojure REPL client (nREPL-based, Babashka). Use for evaluating Clojure code, loading Clojure files, fixing unbalanced brackets, and interactive nREPL work. Not the Elisp daemon-repl.
Daemon REPL for Elisp — evaluate Elisp code in a running Emacs daemon via emacsclient, validate brackets before save, auto-evaluate .el files on change. Use when you need to run Elisp from outside Emacs, check daemon status, or validate Elisp syntax.