query to find sandbox profiles that allow a process to grant itself arbitrary sandbox extensions and access any file. quicklookd and afcd can do this.

[alecdeshotels]