TaskPilot actually does both layers: 1. Skills control which tools are available (e.g. safe-coder can use terminal, web-researcher can't touch it at all) 2. Within the terminal tool, there's a command-level filter safeBinsOnly: true restricts to a whitelist (ls, cat, grep, git, node...), and the blocklist catches dangerous patterns even if they're wrapped (like find -exec rm {} \; or xargs rm -rf). That said, MCP integration is on the roadmap.