I'm not sure how much sandboxing can help here. Presumably you're giving the tool access to a repo directory, and that's where a juicy .env file can live. It will also have access to your environment variables.
I suspect a lot of people permanently allow actions and classes of commands to be run by these tools rather than clicking "yes" a bunch of times during their workflows. Ride the vibes.
I've tried the shaders in the following repo with ghostty. They definitely work. I ended up keeping a cursor trail shader. https://github.com/0xhckr/ghostty-shaders