[P2] Define script sandboxing and content security policy

[spazyCZ]

Objective

Define whether UAAPS should specify sandboxing or a content-security model for skill scripts.

Priority

P2 — Nice to Have

Details

Skills can include scripts, but beyond the platform permissions model there is no standard for script sandboxing, static analysis, interpreter constraints, or script integrity verification.

Acceptance Criteria

• Decide whether script-level security policy is in scope
• If yes, define baseline constraints or extension points
• Clarify relationship to the existing permissions model

Notes

Source: work/spec-gap-analysis.md