Coming Soon

Skills aren't just Markdown instruction files anymore — they can bundle dependencies like scripts and MCP servers. Today, Sandboxing already confines a skill's shell commands and file access to a kernel sandbox. The next step is extending that same protection to everything a skill bundles.

The gap today

The sandbox covers the Bash and file tools, but a skill's bundled MCP servers still run as normal processes — they aren't sandboxed yet. That's the last unguarded path a bundled dependency could take.

Sandboxed MCP servers & scripts

Pound will launch a skill's MCP servers inside the same nono kernel sandbox at startup — zero configuration, no Docker, no setup. Just #<skill-name> and go, with the skill's servers confined the same way its shell commands already are.

What sandboxing will still not do

Even then, the sandbox is a blast-radius control, not a guarantee. It limits what a skill can reach; it can't stop a skill from writing malicious code into the project it's allowed to edit, and it isn't a defense against prompt injection. Always review what a skill produces — see Sandboxing.