AST06: Weak Isolation
Risk Level: High
Skills execute in the same security context as the host agent, with its filesystem, shell, and network access, because sandboxing is either unavailable or off by default. Every other control on this list assumes some containment boundary. This is the risk that removes it.
Real-world evidence
OpenClaw runs tools on the host for the main session. SecurityScorecard found more than 135,000 publicly exposed OpenClaw instances, and Microsoft Defender guidance advised treating OpenClaw as untrusted code execution with persistent credentials attached.
Mitigations
- Run skills in container isolation by default, not as an opt-in for careful users
- Bind agent control interfaces to localhost and require authentication on them
- Apply seccomp or AppArmor profiles to constrain the syscall surface available to a skill
- Isolate each skill in its own process and namespace
- Restrict skill hot-reload and workspace precedence rules that let a repo override trusted config
- Authenticate and rate-limit WebSocket connections into the agent