The Agent Skills Directory

Host-Side Lifecycle Commands: The skill describes the use of lifecycle hooks (initialize, postCreate, preRemove) which execute shell commands on the host system rather than inside the sandbox. While these are intended for environment setup, they represent a potential area for command execution if a user applies an unvetted configuration. The skill provides prominent guidance on the tool's interactive approval plan to mitigate this risk.
MCP Server Command Registration: Environment files can register Model Context Protocol (MCP) servers using host-side commands. Similar to lifecycle hooks, these commands run with host privileges to provide the agent with tools. This capability requires users to review the commands being registered to prevent unintended host-side execution.
Sandbox Security Configuration: The documentation identifies potential security downgrades, such as writableEnvFiles, which allows an agent to modify its own environment configuration. It also explains a "rename gap" where files in subdirectories can sometimes be modified despite read-only protections. These details are presented to educate the user on the security boundaries of the sandbox.
Credential Handling Guidance: The skill includes support for provisioning secrets and registries. It explicitly warns against hardcoding plaintext secrets in environment files and recommends using references to external secret managers, which helps prevent accidental credential exposure in version-controlled files.

docker-sandboxes-env