Borrowing it
Nothing to install: this file belongs to dslsdzc/rev-skills. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/dslsdzc/rev-skills/main/.claude/skills/re-sandbox/SKILL.mdgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-sandbox)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-sandbox"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-sandbox/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-sandbox"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-sandbox.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 34 Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.Fix: Pin the image: image:tag or image@sha256:abc123
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00039 | $0.03398 |
| Opus 5 | $0.00019 | $0.01699 |
| Sonnet 5 | $0.00008 | $0.00680 |
| Haiku 4.5 | $0.00004 | $0.00340 |
Grade A, and why
re-sandbox scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- 验证: 沙箱内 `ping 8.8.8.8` 不通；`curl http://example.com` 命中 INetSim 模拟响应 How it starts
The opening of the file, as written. The whole thing — 134 lines — stays where its author put it; the contents beside it link to each section on GitHub.
沙箱环境搭建
何时使用 / 何时不用
- 用：任何涉及运行样本的动态分析（行为分析、回连观察、脱壳验证、动态 API 监控）——动态分析强制前置，默认沙箱为最高原则（见 [[re-analyze/platform-tips]]）
- 用：需要干净、可回滚的隔离环境执行不可信程序
- 不用：纯静态分析（[[re-triage]] / [[re-format-pe]] / [[re-ghidra]] 等）可免沙箱
- 不用：样本已有可信运行环境且用户明确要求本机运行（仍应先说明风险）
工具准备
所有工具先验证再使用。本技能是 [[re-analyze/platform-tips]] 最高原则（默认沙箱，动态执行强制前置）的执行者——所有工具只为让"运行样本"更安全可控。
firejail —— 轻量应用沙箱（最低隔离级别，仅 Linux）
- Linux:
apt install firejail/dnf install firejail/pacman -S firejail - macOS/Windows: 不支持（用 Docker 或 VM 替代）
- WSL: Linux 包直接可用
- 验证:
firejail --version；firejail --list能看到活动沙箱 - 注意: firejail 是用户态隔离（namespace/seccomp 组合），不是安全边界——不防内核漏洞利用与提权，高威胁样本仍用 VM（见坑 3）；常用参数
--private（临时 home，退出即弃）、--net=none（断网）、--dns=<ip>（DNS 指向）
docker —— 容器隔离（中级）
- Linux:
apt install docker.io/dnf install docker/pacman -S docker（或 Docker 官方脚本） - macOS:
brew install --cask docker（Docker Desktop，需手动启动）或brew install docker+brew install colima+colima start - Windows:
choco install docker-desktop（Docker Desktop）；WSL2 内用 Linux 版 - 验证:
docker --version；docker run --rm hello-world能跑通 - 注意：容器共享内核，不是完全隔离（见坑 3）
VirtualBox / VMware —— 虚拟机 + 快照（最高隔离级别）
- VirtualBox:
- Linux:
apt install virtualbox/dnf install VirtualBox（RPMFusion 源）/pacman -S virtualbox - macOS:
brew install --cask virtualbox - Windows:
choco install virtualbox - 验证:
VBoxManage --version
- Linux:
- VMware Workstation/Fusion: 商业授权；Windows
choco install vmware-workstation；验证:vmrun list或vmware --version - 快照命令（VBoxManage 示例）:
VBoxManage snapshot <vm> take clean # 建立快照 VBoxManage snapshot <vm> restore clean # 恢复快照
INetSim —— 模拟网络服务（网络隔离主力）
- Linux: Debian/Ubuntu
apt install inetsim（或官方 .deb；其他发行版用源码构建，Perl 依赖较多，推荐专用 Debian VM） - macOS/Windows: 不建议本机装——在 Linux VM 内运行
- 验证:
inetsim --version；启动后inetsim日志显示 HTTP/SMTP/DNS/FTP 等服务监听
Cuckoo / CAPE —— 自动化恶意样本分析沙箱
- Cuckoo（旧，仍可用）:
pip install cuckoo；验证:cuckoo --version - CAPE（活跃继任）:
验证:git clone https://github.com/kevoreilly/CAPEv2 cd CAPEv2 && pip install -r requirements.txtpython cuckoo.py --help或cape子命令能列出 - 依赖虚拟机与网络隔离配置，首次搭建成本高——单次人工分析优先用 VM 快照方案
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +1 lines d0b909a65baf
- 9d ago First seen · 133 lines · 39 tokens per session scan A 644d73a7dc3b
re-sandbox is a skill published in the GitHub repository dslsdzc/rev-skills (54 stars, last pushed today), licensed Apache-2.0. It adds 39 tokens to every session and 3,398 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
reverse-engineering-arm-binaries
Reverse engineers ARM/AArch64 malware by identifying the architecture and instruction set state (ARM/Thumb), parsing ELF/Mach-O ARM headers, and orienting analysis around the ARM calling convention. Activates for requests to reverse ARM binaries, analyze AArch64 malware, or handle ARM/Thumb instruction-set decoding.
reverse-engineering-binaries-with-ghidra
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.