Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ariana-dot-dev/cloud-sandbox-vm-skills --skill ephemeral-ci-environmentgit clone --depth 1 https://github.com/ariana-dot-dev/cloud-sandbox-vm-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ariana-dot-dev/cloud-sandbox-vm-skills/ephemeral-ci-environment)<a href="https://agentmods.dev/skills/ariana-dot-dev/cloud-sandbox-vm-skills/ephemeral-ci-environment"><img src="https://agentmods.dev/badge/skills/ariana-dot-dev/cloud-sandbox-vm-skills/ephemeral-ci-environment/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ariana-dot-dev/cloud-sandbox-vm-skills/ephemeral-ci-environment"><img src="https://agentmods.dev/badge/skills/ariana-dot-dev/cloud-sandbox-vm-skills/ephemeral-ci-environment.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.00419 |
| Opus 5 | $0.00042 | $0.00210 |
| Sonnet 5 | $0.00017 | $0.00084 |
| Haiku 4.5 | $0.00008 | $0.00042 |
Grade C, and why
ephemeral-ci-environment scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
`curl -fsSL https://box.ascii.dev/install | sh`, then `box login "$BOX_API_KEY" --json`. (Select the repo to auto-clone in the dashboard, or clone it in setup.) Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
`curl -fsSL https://box.ascii.dev/install | sh`, then `box login "$BOX_API_KEY" --json`. (Select the repo to auto-clone in the dashboard, or clone it in setup.) What it actually says
Ephemeral CI / test environment (Box)
Use this when you need a clean, throwaway environment to test a repo, run a CI job, or reproduce a bug — identical every time, with nothing left behind. Every run starts from a fresh VM with all toolchains preinstalled, so there's no "works on my machine" drift.
Why Box
- Pristine + reproducible — fresh VM per run; no leftover state.
- Batteries included — Docker + Node/Python/Go/Rust/Java/etc. already there; repo auto-clones in.
- Cheap per run — per-second billing; a test run costs cents, and you
box deleteafter.
Prereqs
curl -fsSL https://box.ascii.dev/install | sh, then box login "$BOX_API_KEY" --json. (Select the repo to auto-clone in the dashboard, or clone it in setup.)
Recipe
box_id="$(box new --json | jq -r 'select(.event == "ready") | .id')"
trap 'box delete "$box_id" --json' EXIT
box ssh "$box_id" -- "cd /project && npm ci && npm test"
box ssh "$box_id" -- "cat /project/junit.xml" > junit.xml # pull results back
Limits
EU-only; 100 active VMs soft cap. For thousands of <500 ms parallel CI shards, dedicated CI runners scale further; Box is best for full-machine, Docker-capable, reproducible runs.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 32 lines · 83 tokens per session scan C 40287d565910
ephemeral-ci-environment is a skill published in the GitHub repository ariana-dot-dev/cloud-sandbox-vm-skills (2 stars, last pushed 3mo ago), licensed MIT. It adds 83 tokens to every session and 419 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
declaring-invariants
Find tests that enumerate a domain by copying it, and declare the invariants a codebase depends on. Reports where a parametrize list, for-loop, or it.each iterates a hand-written subset of a dict/set/tuple/Enum that exists in the source, and names the members nothing covers. Use when reviewing tests, when a module…
gating
Build and audit deterministic verification gates — a check that blocks a pipeline and can be shown to go red. Use when writing a calibration gate, CI check, validation script or pre-publication check for a numeric or empirical result; when a plausible-but-wrong value would survive review; when asking whether an…
ci-cd
Use when building or fixing a delivery pipeline. Covers pipeline structure, caching, test parallelization, deployment strategies, secrets, and making the pipeline fast enough that people do not route around it.
testing-automation-expert
Production-grade testing strategies for robust, maintainable systems. Covers unit/integration/E2E testing, contract testing, accessibility, mutation testing, and CI/CD patterns. Supports Python (pytest) and TypeScript (Jest/Vitest/Playwright).
environment-to-production-release-protocol
Use this skill when a Power Platform or Dynamics 365 solution must progress through a structured dev-to-test-to-production release pipeline using managed solutions and Power Platform pipelines, when rollback readiness must be verified before go-live, or when a deployment approval gate must be enforced. Defines the…
argo-rollouts-progressive-delivery-review
Use this skill when reviewing Argo Rollouts progressive delivery configuration. Trigger when the user asks about canary or blue-green Rollout strategy correctness, AnalysisTemplate success/failure conditions, traffic weighting provider alignment, canaryService isolation, PDB deadlock risk with Rollout maxSurge…