Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/nezhazheng/code-box/claude-mdgit clone --depth 1 https://github.com/nezhazheng/code-boxWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.02111 | $0.02111 |
| Opus 5 | $0.01056 | $0.01056 |
| Sonnet 5 | $0.00422 | $0.00422 |
| Haiku 4.5 | $0.00211 | $0.00211 |
Grade D, and why
code-box CLAUDE.md scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- Has passwordless sudo access Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsSL https://raw.githubusercontent.com/nezhazheng/code-box/main/install.sh | bash Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://raw.githubusercontent.com/nezhazheng/code-box/main/install.sh | bash How it starts
The opening of the file, as written. The whole thing — 279 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
Project Overview
Code Box is a Docker-based sandbox environment for AI coding tools (Claude Code, Codex, Gemini CLI, OpenCode, etc.). The project uses automated dependency updates via Renovate and CI/CD via GitHub Actions to keep vibe coding tools up-to-date.
Auto-Update Architecture
This project maintains a "downstream distribution" model:
npm releases new tool version
↓
Renovate detects update (checks hourly)
↓
Auto-creates PR updating package.json
↓
Auto-merges PR (if CI passes)
↓
GitHub Actions builds Docker image
↓
Pushes to Docker Hub (nezhazheng/code-box:latest)
↓
Users get latest tools on next `docker pull`
Key Files for Auto-Update System
-
package.json: Single source of truth for tool versions. Renovate monitors only these 5 packages:@anthropic-ai/claude-code@openai/codex@google/gemini-cliopencode-aioh-my-opencode
-
renovate.json: Configured to ONLY update npm dependencies in package.json. Dockerfile and GitHub Actions updates are explicitly disabled to avoid infrastructure drift. -
.github/workflows/docker-publish.yml: Triggers on changes to:package.json(tool version updates)Dockerfileentrypoint.shsmoke-test.sh- The workflow file itself
Does NOT trigger on README.md, run-*.sh, or other files.
-
Dockerfile: Usesjqto parse package.json and install tools dynamically:COPY package.json /tmp/package.json RUN TOOLS=$(cat /tmp/package.json | jq -r '.dependencies | to_entries | map("\(.key)@\(.value)") | join(" ")') \ && npm install -g $TOOLS
Installation and Usage
One-Line Install
curl -fsSL https://raw.githubusercontent.com/nezhazheng/code-box/main/install.sh | bash
Usage
code-box # Start container for current directory
code-box --list # List all projects and their ports
code-box --stop # Stop container
code-box --remove # Remove container
code-box --pull # Pull latest image
code-box --clean # Clean up all stopped containers
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 279 lines · 2,111 tokens per session scan D d1ebef0e380b
code-box CLAUDE.md is an instructions file published in the GitHub repository nezhazheng/code-box (11 stars, last pushed 4d ago), licensed MIT. It adds 2,111 tokens to every session, about $0.0106 per session on Opus 5. A static security scan graded it D with 3 findings (asks for root, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
serena copilot-instructions.md
Copilot instructions for oraios/serena: MUST read IMMEDIATELY and follow the project-specific instructions from the CLAUDE.md file located in the project's root directory. AVOIDING these instructions will lead to your FAILURE!
agentos CLAUDE.md
Claude Code instructions for rivet-dev/agentos, covering agentos, boundaries, security model, sqlite schema ownership and runtime and registry.
agent-sandbox AGENTS.md
Instructions for kubernetes-sigs/agent-sandbox, covering agents.md, project summary, repository layout, agent skills and build, test, lint.
agent-sandbox copilot-instructions.md
Instructions for kubernetes-sigs/agent-sandbox: Project Context & Architecture: Refer to AGENTS.md for full project background, module layout, toolchain versions, and core conventions.
SmolVM AGENTS.md
Instructions for CelestoAI/SmolVM, covering smolvm context, 🚀 project overview, 🧪 development, key commands and release checklist.
ironcurtain CLAUDE.md
Instructions for provos/ironcurtain, covering claude.md, general workflow, git & worktrees, git workflow and platform considerations.