sealed-hands

Local hands for Sealed Connected skills.

npx -y sealed-hands run <skillId> --task "..." --read <path> --write <path>

What this is

Sealed sells agent skills that run without ever handing you their source. Most skills are Hosted: you send inputs, the skill runs on Sealed's servers, you get the output back, and nothing on your machine is involved.

Connected skills work on files in your own project. The skill's reasoning still runs entirely in the cloud — this package is the other half: a brainless executor that carries out one typed instruction at a time inside a scope you grant, and reports the result back.

The skill body never reaches this process. There is nothing here to read.

What it can do

Four verbs, and no others. There are no free-text fields anywhere in the wire protocol:

| | | |---|---| | read_file | read one file inside your --read scope | | write_file | write one file inside your --write scope | | list_dir | list a directory inside your scope | | run_command | run one command you allow-listed with --cmd |

The consent model

1. Nothing runs until you say yes. The scope you granted is printed in full, along with the skill's declared permission manifest, and it waits for y. Without a TTY it refuses outright rather than assuming consent — pass --yes to consent explicitly in a script.
2. Sensitive commands ask again, individually, every time.
3. Scope is enforced here, on your machine. The server can never widen it; it can only experience its effects. Paths resolve locally, and the grant expires (--ttl, default 15 minutes).
4. Every action prints as it happens, so you watch the whole session live.

Disclosure

File contents read under your scope are sent to the skill's cloud brain, and therefore to the model API behind it. That is the point of the grant, and it is stated again in the terminal before you approve. Grant the narrowest scope that lets the skill do its job.

Options

--task "..."        what you want done
--read <path>       readable path (repeatable)
--write <path>      writable path (repeatable)
--cmd a,b,c         allow-listed commands; must be declared by the skill
--ttl 15m           scope lifetime (default 15m)
--allow-sensitive   permit sensitive commands, still confirmed one by one
--api <baseUrl>     override the API base (default https://sealed.run)
--yes               consent to the scope non-interactively

SEALED_API_KEY must be set in your environment. Mint one at https://sealed.run/marketplace#/account. You are charged the session price only on clean completion — an aborted or failed session costs nothing.

Requirements

Node 18+. Zero runtime dependencies — Node built-ins only.

License

MIT