Agent Sandbox is a Kubernetes extension for managing isolated, stateful workloads that run as single long-lived containers with stable identities and persistent storage. It is intended for AI agent runtimes, reinforcement-learning workloads, and other applications that do not fit ordinary stateless deployments. Its catalogue skills and instructions support operating these sandbox workloads.
Borrowing it
Nothing to install: this file belongs to kubernetes-sigs/agent-sandbox. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/.agents/skills/test-pyramid/SKILL.mdgit clone --depth 1 https://github.com/kubernetes-sigs/agent-sandboxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kubernetes-sigs/agent-sandbox/test-pyramid)<a href="https://agentmods.dev/skills/kubernetes-sigs/agent-sandbox/test-pyramid"><img src="https://agentmods.dev/badge/skills/kubernetes-sigs/agent-sandbox/test-pyramid/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kubernetes-sigs/agent-sandbox/test-pyramid"><img src="https://agentmods.dev/badge/skills/kubernetes-sigs/agent-sandbox/test-pyramid.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00104 | $0.01560 |
| Opus 5 | $0.00052 | $0.00780 |
| Sonnet 5 | $0.00021 | $0.00312 |
| Haiku 4.5 | $0.00010 | $0.00156 |
Grade A, and why
test-pyramid scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 53 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Test Pyramid Analysis
Goal: anything that can be tested as a unit test should be a unit test; only what genuinely needs a real cluster should be E2E. The end state is a pyramid — many fast unit tests, few E2E tests. This skill produces an evidence-backed rebalancing report; it does NOT move tests itself unless the user asks afterward.
Phase 1 — Inventory
Enumerate both layers and count actual test functions (not just files), so the report can show the pyramid shape numerically:
- Unit tests:
git ls-files '*_test.go' | grep -v '^test/e2e/'plusgit ls-files 'test/e2e/framework/*_test.go'and Python unit tests across all client packages (discover withgit ls-files 'clients/**' | grep '/test[s]*/unit/'— coversclients/python/,clients/integrations/deepagents/, andclients/integrations/mcp-server/). Countfunc Test...per package (grep -c '^func Test') anddef test_for Python. - E2E / system tests:
test/e2e/*_test.go(excludingtest/e2e/framework/), plustest/e2e/extensions/(density, python-runtime, rollout, and other cluster-physics E2E),test/e2e/clients/python/(SDK E2E),dev/tools/test-migration.py(upgrade/rollback), andtest/stress/(load). Countfunc Test...(anddef test_for Python / migration tests), and for table-driven E2E, the sub-scenarios. - Note per-layer runtime cost if discoverable (CI job durations from
dev/ci/, TestGrid tab names) — the payoff argument for each migration is time and flake surface removed from presubmit.
Phase 2 — Characterize every E2E test
Read each E2E test body (fan out parallel subagents over batches of 3-5 files for speed; each returns structured notes). For every test, record:
- What it arranges (objects applied, cluster preconditions).
- What it asserts — split assertions into:
- Cluster-physics assertions: pod actually scheduled/running, kubelet behavior, image pulls, real networking/routing (sandbox-router paths), LoadBalancer/Gateway, RBAC enforcement, webhook admission via real API server, CRD conversion via real storage, controller<->controller timing, upgrade/rollback state survival.
- Logic assertions: field values on objects after a reconcile, label/annotation stamping, status conditions, owner references, name hashing, defaulting, spec conversion, error classification, requeue decisions — anything a reconciler computes deterministically from inputs.
- The seam: which function/reconciler produces each logic assertion's value (e.g.
isAdoptable,computeAndSetStatus,merge_flaky_by_test). If you cannot name the seam, you cannot claim a unit test can cover it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 53 lines · 104 tokens per session scan A 4187604a0247
test-pyramid is a skill published in the GitHub repository kubernetes-sigs/agent-sandbox (3,776 stars, last pushed today), licensed Apache-2.0. It adds 104 tokens to every session and 1,560 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
06-test
Write and iterate tests until they pass, or validate a user journey end to end in the browser. Use when the user wants to add coverage, find what's untested, or walk a flow. Not for auditing test health or debugging a failure.
knowledge-engineering-quality-and-delivery-unit-integration-and-shared-test-harnesses
A testing guide for the CLI and web interfaces, covering unit, integration, end-to-end, and real-process test setup with shared fixtures and cleanup.
archestra-dev-testing
Use when deciding whether a change needs a test and at which level — unit, backend route-level integration, MSW-backed frontend integration, or e2e — or when reviewing tests for the "fluff test" anti-pattern. Start here before archestra-dev-backend-tests or archestra-dev-e2e.
vllm-test-generator
A test-writing guide for vLLM, an open-source system for running large language models. It helps create unit, integration, and end-to-end tests that match the project’s existing style.
test-writing
Write comprehensive tests for code including unit tests, integration tests, and end-to-end tests. Use this to ensure code quality, catch bugs, and validate functionality.
extension-test
Set up and run unit, integration, and E2E tests for Chrome extensions. Covers Jest mocks for chrome. APIs and Puppeteer E2E with real Chrome.