I let my local model read whatever it wants and use a bunch of "non destructive" bash commands, but I review everything else it tries to do. So far so good. Maybe my closet box is too dumb to bother doing fancy sandbox escapes.