Agent Sandbox Leak Auditor

The source default has four authored trace steps, of which two are flagged outbound. With the initial guard checkboxes enabled both are intercepted by the local rules and risk reads secured. At seventy pixels per step or attempt the bars span two hundred eighty and one hundred forty. The media-count field fifty three is a preset number, not a count of actual images inspected. Its incident titles and severity strings are unverified fixture text. This auditor processes local JSON and renders labels; it does not intercept network calls, scrub real files, or establish that any described public leak occurred. Unchecking all four guard boxes leaves the same two outbound fixture steps unblocked. The intercepted count changes from two to zero and risk becomes critical. At one hundred pixels per blocked attempt the bars shrink from two hundred to zero. The rule chain first checks whether the outbound payload string contains tainted, then domain pinning, human-gate tool substrings, and finally OCR text. A tainted source step does not automatically propagate taint to every later payload. The JSON report records local reasons and flags, not execution-level enforcement or a proven production guardrail policy. A custom synthetic outbound step can declare domain approved dot internal dot net dot example, tool web fetch, and ordinary payload text. The pinning rule accepts any domain string containing approved dot internal dot net. With no tainted, OCR, or human-gate tool substring, this one attempt is labeled leaked even with all guards on. At one hundred pixels per leaked or blocked attempt the bars span one hundred and zero. This reveals a source string-match limitation; it does not contact that address. Guard labels and downloaded JSON must be interpreted with their implemented conditions, rather than as a functioning firewall or validated defense against real agent egress.