Berry Wiki

Skynot

Properties2
tagsai, sandboxing
aliasesSkynot

6 min read

Skynot

Summary

Skynot installs the Pi coding agent under a dedicated local Unix user named aidev. It creates a shared work area and a launcher that switches from the developer’s account to the agent account. It explicitly does not use a sandbox, container, or virtual machine.

  • Repository: tarsgate/skynot
  • Package: skynot through npm/npx
  • Implementation: TypeScript
  • License: AGPL-3.0-or-later
  • Checked: 2026-07-14

Problem

Pi can run commands without built-in approval prompts. Some developers want to keep it away from their personal home directory without paying the resource and setup cost of a VM or container. Skynot automates the traditional Unix answer: run the process as another user.

How It Works

  • Creates an aidev user and aiteam group.
  • Adds the current developer and agent user to the shared group.
  • Gives the developer passwordless permission to run commands as aidev.
  • Uses group permissions, a 007 umask, and access-control lists so both accounts can edit agent work.
  • Installs Pi and selected extensions under the agent’s home directory.
  • Creates ~aidev/Work and a developer launcher named spi.
  • Before each launch, checks that the current directory is inside the agent work area.
  • Checks whether user home directories are readable or writable by aidev and offers to remove group/other permissions.
  • Runs Pi as aidev.

Security Boundary

The boundary is Unix discretionary access control: file owner, group, mode bits, and access-control lists. The agent process has the rights of aidev, not the developer’s normal account.

This can protect properly permissioned home files, but it is not containment:

  • The agent shares the host kernel, system services, network, process environment, and world-readable filesystem.
  • Files readable by all users remain readable to aidev.
  • Local privilege-escalation vulnerabilities can cross the user boundary.
  • The agent can freely change its own home and shared work area.
  • No command, syscall, process, or network policy is applied.
  • Optional copied credentials are fully available to the agent account.

The launcher checks permissions at startup, but this is a safety check around Unix permissions, not a kernel sandbox policy.

Platforms And Agents

  • Hosts: Linux and macOS.
  • Requirements: Node.js 22, npm/npx, Git 2.46 or newer, and setfacl on Linux.
  • Agent: Pi coding agent.
  • Other agents: Not documented or supported by the installer.
  • Windows: Not supported.

Setup

Run npx skynot and follow the interactive prompts. The setup asks for administrator permission as needed and explains each system change.

Optional flags configure Pi authentication, Git identity, npm installation, SSH keys, update behavior, verbose output, or destruction of the created user/group. The destructive removal option deletes the aidev user and its home data.

System changes include creating a user/group, writing a sudoers rule, changing group membership, adding shell configuration, creating shared directory permissions, and possibly tightening permissions on other users’ home directories. Review these changes before accepting them.

Network And Credentials

  • Network: Unrestricted host networking. No destination allow-list, proxy, logging, or approval layer is provided.
  • Provider key: The authentication option writes Pi authentication data with mode 0600 under the agent’s Pi directory, or configures a requested environment variable.
  • SSH option: Copies the developer’s ~/.ssh/id_rsa private and public keys into aidev’s home and adds GitHub to known hosts.
  • Credential effect: Pi and any process it starts can read and exfiltrate copied agent credentials.
  • Safer default: SSH copying is optional, but the project does not document SSH-agent forwarding as a key-file-free alternative.

Strengths

  • Low overhead: No image, VM, or background platform is required.
  • Familiar model: Uses standard Unix user separation that administrators can inspect directly.
  • Automated setup: Handles the error-prone user, group, permission, and launcher steps.
  • Shared editing: The developer and agent can work on the same files through a dedicated group.
  • Launch checks: Refuses work outside the intended agent directory and checks home-directory visibility.
  • Transparent scope: The README clearly says there is no sandbox.

Limits

  • Weak isolation: A separate user is much less protective than a process sandbox, container, or VM.
  • No egress protection: Source and credentials can be sent anywhere.
  • Private-key duplication: The SSH option places a reusable private key directly inside the agent’s readable home.
  • Broad system changes: Setup modifies users, groups, sudoers, shell startup, and permissions.
  • Home hardening side effects: Removing group/other access from every user home may disrupt backup, indexing, sharing, or administration tools.
  • Pi only: No general agent runner.
  • Host tool drift: The agent uses the host operating system and installed tools rather than a reproducible environment.
  • No audit: No independent security review or formal threat model was found.

Activity And Maturity

Checked 2026-07-14:

  • Created: 2026-04-10.
  • Latest release: v0.0.755, published 2026-05-27.
  • Latest checked commit: 236baf085cc7, dated 2026-05-27.
  • History: About 145 commits and 8 tags.
  • Interest: 14 stars and 1 fork.
  • Open work: 7 combined visible issues and pull requests at the API check.
  • Assessment: Small pre-1.0 installer with a narrow, understandable model; not a security sandbox.

Best Fit

Best for a single-user Linux or macOS workstation where the goal is reducing accidental access to personal home files while trying Pi, and where the user accepts unrestricted networking and shared-kernel risk.

It is not suitable for hostile repositories, strong prompt-injection defense, sensitive credentials, multi-tenant systems, or compliance requirements.

Comparison

  • Versus Clawk: Skynot has almost no runtime overhead but shares the host kernel and network. Clawk uses a disposable VM and restricted outbound access.
  • Versus Flar or Pi Landstrip: Those add kernel-enforced process restrictions. Skynot only changes the operating-system user.
  • Versus Docker: Skynot reuses the whole host environment. Docker adds namespaces and a filesystem boundary but costs more setup and resources.
  • Versus manual user creation: Skynot automates permissions, Pi installation, launch checks, and shared workspace setup.

HN Context

Skynot was offered in the Clawk discussion as the low-overhead alternative: give the agent a dedicated user and avoid spending CPU on a VM or container.

That description matches the project. The tradeoff is also direct: it saves resources by giving up the separate-machine and network boundaries that motivated Clawk.

Unknowns

  • Permission coverage: The launcher checks user home directories, but other sensitive world-readable paths and service sockets are not inventoried.
  • macOS future: Apple changes to Unix permissions or administrator tooling could affect behavior.
  • Uninstall recovery: The project removes its agent user/group, but full rollback of shell, home-permission, and sudoers changes was not established.
  • Package provenance: Release signing and npm package integrity beyond normal registry controls were not documented.
  • Threat model: The intended protection level is described informally rather than as tested attacker capabilities.

Sources

Graph View