unsafe-sandbox

Rules for unsafe Rust and the L3 behavioral process harness.

IndexedApache-2.0★ 13

Install

Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install skill/kalarislabs-unsafe-sandbox

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

Rules for unsafe Rust and the L3 behavioral process harness. Use when adding unsafe blocks, FFI, sandbox features, differential replay, or canary credentials.

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.

Tools: No tools found
Secrets: None asked for
Install scripts: None found

Network hosts it talks to 1

codeload.github.com · found in install command

Files it touches

~/.claude/skills/unsafe-sandbox

What's inside

Skill name: unsafe-sandbox
Description: Rules for unsafe Rust and the L3 behavioral process harness. Use when adding unsafe blocks, FFI, sandbox features, differential replay, or canary credentials.
License: Apache-2.0
Instructions: 11 lines in SKILL.md · view on GitHub

Files (1)

SKILL.md

SKILL.md (first lines)

# Unsafe and sandbox

- `unsafe` only in `skill-doctor-sandbox`.
- Every block has `// SAFETY:` naming the invariant.
- Default binary does not enable `sandbox`. Missing L3 → coverage reduction, not a crash.
- Canaries are fake host-injected values, never production secrets.
- Differential replay: vary clock / hostname / CI env; divergence is a finding.
- No Firecracker daemon on the default path.
- Sandbox tests: `#[cfg(feature = "sandbox")]`. Do not fail Windows required CI because L3 is absent.

From KalarisLabs/Skill-Doctor, Apache-2.0.

Signals

Stars: 13
Forks: 1
Open issues: 30
Last commit (this folder): Sep 10, 2026 (1 month ago)
Last release: Sep 12, 2026 (1 month ago)

From GitHub (fetched Oct 24, 2026).

Details

License: Apache-2.0
Repository: github.com/KalarisLabs/Skill-Doctor
Website: github.com/KalarisLabs/Skill-Doctor
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: GitHub github-graphql

More from KalarisLabs

Cite this page

unsafe-sandbox skill. Agent Mart. https://agentmart.dev/skills/kalarislabs-unsafe-sandbox (last updated 2026-10-24)