What is pound?
Pound is a skill registry for Claude Code with two promises: every skill runs inside a sandbox, and every skill is always up to date.
Skills you didn't write run on your machine
A skill is an instruction file — often bundled with scripts and tools — that Claude follows and executes. The moment you run one you didn't write yourself, it has the same access you do: it can read ~/.ssh, your .env, your cloud credentials, and reach out to the network. A single bad skill can quietly exfiltrate secrets or trash your machine. That's the thing standing between skill registries and actually being usable.
Pound sandboxes every skill
While a Pound skill is active, Pound confines what it can touch:
- Shell commands run in a kernel sandbox (Landlock on Linux, Seatbelt on macOS, via
nono) with network access blocked and the filesystem narrowed to the skill's own workspace,/tmp, and read-only access to your current project. - File reads and writes are filtered — your project is fair game, but credential stores like
~/.ssh,~/.aws,~/.config/gcloud,~/.gnupg, and~/.netrc, and the rest of your home directory, are blocked.
So the common attacks — "read your secrets and POST them to a server", "wipe your home directory", "phone home" — are cut off at the kernel. The sandbox is off when no skill is active and turns on automatically the moment you run one.
👉 Full details, requirements, and limits: Sandboxing.
What it does not protect against
Be clear-eyed about this: the sandbox limits what a skill can reach, not what it can write. Because a skill's whole job is to edit code in your project, Pound cannot stop a skill from writing malicious or buggy code into your repo (a backdoor, a weakened check, a poisoned package.json). Treat skill output like a pull request from a stranger — review it before you ship it. Pound is a blast-radius control, not a guarantee against prompt injection or supply-chain attacks.
Always up to date
Skills are fetched live, only when you call them, only for that session — nothing is permanently installed. Because every run pulls the current version, you are always on the latest. The moment an author ships a fix, you get it automatically, with nothing to update on your end and no stale local copies drifting out of sync.