A mandatory sandbox with explicit resource ACLs and cryptographic signing for all third-party ClawdHub skills, enforcing runtime isolation and audit trails before execution.