BulkheadScope — AI skill for Claude Code

BulkheadScope

**[English](#english) | [中文](#中文)**

---

English

**Is your agent sandbox holding water?**

A bulkhead is a watertight compartment on a ship: when one floods, the rest stay dry. An agent sandbox is the same idea. BulkheadScope does not build bulkheads — it inspects the ones you already declared, tells you whether they hold, and tells you which planks you never needed.

Why this exists

Sandboxing stopped being a niche concern and became default infrastructure. On a single day in October 2026, `anthropics/sandbox-runtime` gained 650 stars, `NVIDIA/OpenShell` gained 896, and `cloudflare/security-audit-skill` gained 2,264. Everyone is *installing* sandboxes.

Far fewer people can answer three questions:

1. What is the effective boundary? Permissions are not declared in one place. They accumulate across a harness default, a checked-in settings file, a per-developer override, a skill's allowed-tools frontmatter, an MCP manifest and a container descriptor. The real boundary is a union computed by precedence rules most people have never read.
2. Does anything enforce it? A settings file is a request. With no runtime, every boundary is enforced by nothing but the harness asking politely.
3. Could a complete route out be assembled from what I already granted? This is the one nobody asks. Exfiltration is not one permission — it is a composition: read a secret, stage it somewhere, send it. Each step is routinely granted alone for good reasons. The danger only exists when all three are granted at once.

BulkheadScope answers all three, deterministically, with no LLM in the loop.

What makes it different

	Enforcing runtimes	Policy linters	BulkheadScope
Prevents the action	✅	❌	❌
Reads one config file	sometimes	✅	❌ — reads all layers and merges them
Resolves symlinks against the real filesystem	✅	❌	✅
Reports composed exfiltration routes	❌	❌	✅
Computes a