Kilo Code is an open-source AI coding agent that works inside VS Code and JetBrains, from the command line, or through cloud services. Developers use it to build software with AI models, switch between providers, and run cloud agents or automated code reviews. The catalogue includes eleven skills, eight agents, and one instruction for Kilo Code.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Kilo-Org/kilocode --skill jetbrains-sandboxgit clone --depth 1 https://github.com/Kilo-Org/kilocodeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kilo-org/kilocode/jetbrains-sandbox)<a href="https://agentmods.dev/skills/kilo-org/kilocode/jetbrains-sandbox"><img src="https://agentmods.dev/badge/skills/kilo-org/kilocode/jetbrains-sandbox/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kilo-org/kilocode/jetbrains-sandbox"><img src="https://agentmods.dev/badge/skills/kilo-org/kilocode/jetbrains-sandbox.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.02138 |
| Opus 5.5 | $0.00023 | $0.00855 |
| Sonnet 5.5 | $0.00011 | $0.00428 |
| Haiku 4.5 | $0.00006 | $0.00214 |
Grade A, and why
jetbrains-sandbox scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 184 lines — stays where its author put it; the contents beside it link to each section on GitHub.
JetBrains Sandbox
Use this skill to give an agent a running IntelliJ instance and the means to control it. The setup provides IntelliJ IDEA, MCP Steroid, and a minimal browser desktop using TigerVNC, Openbox, and noVNC. It is not tied to testing a particular plugin or following a prescribed IDE workflow. The HTTP transport works through sandbox HTTPS proxies that break WebSocket upgrades.
Boundaries
- Tested on Debian 13, Linux x86-64, with Bun available. Allow roughly 8 GB RAM and 10 GB free disk for the IDE, archives, plugins, and caches.
- Installation needs root for apt and creating the IDE account. With dependencies
preinstalled, a non-root account can use
--skip-depsand run as itself. - No public tunnel or viewer password is created. The default bind is loopback.
Use
--host 0.0.0.0only behind the user's authenticated sandbox port forwarding. Binding only to127.0.0.1may make the platform report that nothing is listening. - Raw VNC and MCP remain bound to loopback even when the viewer is externally reachable.
- If a secure preview proxy rewrites
Host, pass its exact browser-facing origin with--origin https://your-preview-host. Arbitrary forwarded headers are not trusted. - Do not accept JetBrains agreements, start a trial, sign into services, copy the agent's credentials into the IDE, or dismiss unrelated dialogs automatically.
- All runtime state defaults to the current worktree's ignored
.kilo-dev/jetbrains-sandbox/. Never point--dirat the workspace itself. - Never overwrite plugin jars while that state directory's IDE is running. Stop first.
- Do not stop another session's IDE or alter the user's workspace ownership. A supplied
--projectmust already be accessible to the selected non-root--user.
Pinned Setup
| Component | Default |
|---|---|
| IntelliJ IDEA | 2026.1, including its bundled Java runtime |
| MCP Steroid | 0.102.0-r-c68d8f15d |
| Optional Kilo plugin | Signed 7.1.12 release, only with --with-kilo |
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 184 lines · 57 tokens per session scan A 065d6cc72c41
jetbrains-sandbox is a skill published in the GitHub repository Kilo-Org/kilocode (27,806 stars, last pushed today), licensed MIT. It adds 57 tokens to every session and 2,138 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-29.
Other skills, from other repositories
architect
Architectural decision advisor for cloud, data, and SaaS distributed systems. Use when the user asks "should we use X or Y", weighs a tradeoff, or needs a decision matrix, scaling analysis, cost-at-scale review, data-tier design, multi-tenancy model, or API/resilience guidance. For full technical blueprints, use…
cloud-security
Rigorous security and data privacy scan for cloud deployments. Covers GCP infrastructure hardening, data privacy (PII/GDPR/CCPA), API security, container security, and compliance. Audits deployed infrastructure and config — not a code-diff review.
azure-appconfiguration-java
Client library for Azure App Configuration, a managed service for centralizing application configurations.
azure-monitor-query-java
Client library for querying Azure Monitor Logs and Metrics.
azure-resource-manager-durabletask-dotnet
Management plane SDK for provisioning and managing Azure Durable Task Scheduler resources via Azure Resource Manager.
azure-resource-manager-mysql-dotnet
Azure Resource Manager SDK for managing MySQL Flexible Server deployments.