Install software from an unverified source
Yes, the tool can access your files after you install and run it.

It is correct that sandboxing is a technique to limit an application's access to files and other resources in order to contain the effects of virusses, etc. However, only App Store apps are sandboxes by default. Apps downloaded from thirdparties are normally not sandboxed.

You can however create your own sandbox for a thirdparty application using the exact same sandbox, called SeatBelt, that is used for App Store apps. It is however not that easy to define a "good" sandbox profile that allows only what you want the app to access, and disallows the rest.

In general you can run your application sandboxed like this from Terminal.app:

sandbox-exec -f definition.sb /Applications/MyApp.app/Contents/MacOS/MyApp


here definition.sb should be replaced with the name of a sandbox definition file, you have created for the app. Obviously MyApp.app should be replaced with the name of the app you're trying to sandbox.

You can inspect the system default sandbox definitions at /usr/share/sandbox to get inspiration. You can also find community-made definitions for popular apps such as Skype and Firefox, for example download from here:

https://github.com/pansen/macos-sandbox-profiles
https://github.com/s7ephen/OSX-Sandbox--Seatbelt--Profiles

You can also take a look at the developer oriented documentation that Apple provides for their SeatBelt sandbox:

https://developer.apple.com/library/content/documentation/Security/Conceptual/AppSandboxDesignGuide/AboutAppSandbox/AboutAppSandbox.html

Also here's a link to a blog post / tutorial on how to create simple, but powerful definitions:

https://paolozaino.wordpress.com/2015/08/04/how-to-run-your-applications-in-a-mac-os-x-sandbox-to-enhance-security/

Their example shows how to allow the reading or certain folders, but not other - and similar denying an application the right to write to specific files and folders.

A simple sandbox definition file could look like this:

(version 1)
(allow default)
(deny network*)


When you run your app with sandbox-exec using that .sb file, your app will run without access to the network.