Blast Radius Drill Skill

Before an agent runs unattended, one question decides whether that's brave or reckless: if this agent were fully hijacked right now — every permission turned against you — what is the total damage? Most people never ask it, and find the answer during the incident. The drill asks it on purpose: walk the worst case through every capability, then build the containment that bounds it — caps that halt runaway loops, a kill-switch that stops it fast, reversibility so a bad run is undoable, and isolation so the damage can't spread. The goal isn't zero risk; it's bounded, recoverable risk, known in advance.

What This Skill Produces

• The worst-case walk-through — per capability, the maximum damage a fully-hijacked agent could do, made concrete
• The containment controls — the caps, halts, and isolation that bound each worst case
• The reversibility audit — which actions are undoable (and how) vs. irreversible (and thus gated or denied)
• The recovery runbook — the kill-switch, the "what did it do" audit trail, and the restore steps — decided while calm

Required Inputs

Ask for these if not provided:

• The agent's capabilities and environment — from the tool-permission-review inventory; the drill runs the worst case through each grant
• The autonomy scope — how long it runs unattended, how many actions between human checks (longer + more = larger blast radius to contain)
• What's reachable — the accounts, systems, data, and money the agent's permissions can touch; the worst case is bounded by reach
• The reversibility landscape — what's backed up, version-controlled, or restorable vs. what's gone-once-done (sent email, spent money, deleted-without-backup, public posts)