Design a bounded audit task
Select one task that exercises the server capability without unrelated permissions. Record the invoking agent and inspect the resulting child processes, path access, and remote destinations.
Interpret effects in context
A connection or file write may be required for the task. Flag effects that exceed the manifest, requested operation, or expected runtime path, then reproduce them before drawing a security conclusion.
Terminal
$ sudo agentsight record -- <agent-command>
$ agentsight report audit --json