Any clues why "an OS-enforced sandbox" is in requirements?

Probably to save their skin if agent starts to do some unexpected things and bringing havoc. But I doubt that OpenAI models with normal subscription, for example, wont even work with this skill.