A procedure for running a requested coding task inside an isolated K8E sandbox. The sandbox uses systems such as gVisor, Kata, or Firecracker to separate code execution from the main computer.

Running, executing, or testing code in the K8E sandbox, including tasks started with the k8e-sandbox command.

It provides a safer place to execute or test code when running it directly on the host could be risky. If no task is supplied, it asks for one instead of inventing work.

k8e-sandbox — Skill for Claude Code by xiaods

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add xiaods/k8e --skill k8e-sandbox

Clone the repo

git clone --depth 1 https://github.com/xiaods/k8e

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/xiaods/k8e/k8e-sandbox.svg)](https://agentmods.dev/skills/xiaods/k8e/k8e-sandbox)

Your own site

<a href="https://agentmods.dev/skills/xiaods/k8e/k8e-sandbox"><img src="https://agentmods.dev/badge/skills/xiaods/k8e/k8e-sandbox.svg" alt="Measured on agentmods" height="20"></a>

Per session 61 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 5,363 The whole file, excluding the scripts and references it only reads on demand.

Security scan B 2 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 3 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

medium Rogue Agent · line 115
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
medium Prompt Injection · line 130
Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Fix: Review content for implicit steering or bias. Ensure instructions are explicit and align with the skill's stated purpose.
medium Rogue Agent · line 201
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00061	$0.05363
Opus 5	$0.00030	$0.02681
Sonnet 5	$0.00012	$0.01073
Haiku 4.5	$0.00006	$0.00536

Measured 8d ago against content hash aa5d88b6934f, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade B, and why

k8e-sandbox scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Subtle steeringmediumPrompt injection

Instructions that bias recommendations or shape behaviour without the user noticing.

If you only see a platform-suffixed name in the user's environment (no symlink yet), use that file directly: `./k8e-sandbox-cli-linux-amd64 status` etc. All spellings are interchangeable; never tell the user they are mis

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -sLO https://github.com/xiaods/k8e/releases/latest/download/k8e-sandbox-cli-linux-amd64

pkg/sandboxcli/skills/k8e-sandbox/SKILL.md · 359 lines

How it starts

The opening of the file, as written. The whole thing — 359 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/k8e-sandbox

Treat this as the k8e-sandbox skill command.

Invocation (same skill, different harness prefixes):

Claude Code: /k8e-sandbox <goal>
Codex: $k8e-sandbox <goal> (or pick from /skills)
Pi: /skill:k8e-sandbox <goal> (or /k8e-sandbox when skill commands are enabled)
dsh (DeepSeek Harness): the model loads this skill via the skill tool (catalog name k8e-sandbox), or the user names it directly in chat — see dsh execution path below

Goal from invocation arguments:

$ARGUMENTS

If $ARGUMENTS is empty and no goal is otherwise provided, ask the user for a sandbox goal and stop (do not invent work).

dsh (DeepSeek Harness) execution path

In dsh, decide your execution mode by checking the current session's tool list first — everything else in this skill branches on it.

A. Plugin mounted — `k8e_sandbox_session_status` IS in your tool list

The dsh-k8e-sandbox plugin replaced the harness's execution seams:

bash (subprocess seam) → runs inside the sandbox pod
read / write / edit / dir listings (fs seam) → sandbox /workspace
k8e_sandbox_* tools → session lifecycle, expose, egress allowlist

Rules:

Do NOT run k8e-sandbox-cli here: it is not present inside the sandbox, and invoking it from the sandboxed bash would recursively dial the gateway from inside the pod. Use the tools + sandboxed seams instead.
Prefer plain bash for commands — it lands in the sandbox. Use k8e_sandbox_exec when you want structured stdout/stderr/exitCode, and k8e_sandbox_run_background + k8e_sandbox_poll for long/streaming tasks.
First action in a session: k8e_sandbox_session_status — it lazily creates the session shared by fs/subprocess/exec, and reports available, sessionId, tenantId.

Tool reference (exact argument shapes — do not guess):

Tool	Arguments	Returns
`k8e_sandbox_session_status`	`{}`	`available`, `sessionId`, `tenantId`, `error`
`k8e_sandbox_session_destroy`	`{}` — releases the pod (idempotent)	`destroyed`
`k8e_sandbox_exec`	`{code: string (required), lang?: "bash"\|"python"\|"node"\|"ts", timeout?: number}`	`stdout`, `stderr`, `exitCode`, `durationMs`, `truncated`
`k8e_sandbox_run_background`	`{code: string (required), lang?: …}`	`runId`, `sessionId`, `status`
`k8e_sandbox_poll`	`{runId: string (required)}`	`runId`, `status`, `stdout`, `stderr`, `exitCode`, `durationMs`
`k8e_sandbox_expose`	`{port: number (required), host?: string}`	`url`, `port`
`k8e_sandbox_unexpose`	`{port: number (required)}`	`ok`, `port`
`k8e_sandbox_allow_hosts`	`{hosts: string[] (required)}` — full replacement list; `[]` clears (falls back to cluster defaults)	`hosts[]`

Read the full file on GitHub · 359 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

8d ago First seen · 359 lines · 61 tokens per session scan B aa5d88b6934f

Subscribe to this mod's changes

k8e-sandbox is a skill published in the GitHub repository xiaods/k8e (481 stars, last pushed 13d ago), licensed Apache-2.0. It adds 61 tokens to every session and 5,363 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 2 findings (subtle steering, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Containers DevOps and cloud Security agentic-ai dsh-plugin k8s kubernetes sandbox-playground

container-manager-kubernetes-operations

Full operational Kubernetes surface via the container-manager-mcp MCP server — workloads (pods/rollouts/StatefulSets/DaemonSets/ReplicaSets/Jobs/CronJobs), config (ConfigMaps/Secrets/Namespaces/CRDs/patch), networking (Ingress/native Services/NetworkPolicy/DNS), storage (PV/PVC/StorageClass/snapshots/CSI), RBAC…

Knuckles-Team/container-manager-mcp · 189 tokens

hunt-k8s

Hunt Kubernetes & Docker — API anonymous access, kubelet 10250 exec (SPDY/WebSocket, NOT plain POST) and the simpler /run primitive, etcd 2379 unauth, dashboard skip-login, RBAC misconfig, secret/SA-token abuse, docker.sock host escape, runc/container-escape (Leaky Vessels CVE-2024-21626), API-server-mediated…

uphiago/recon-skills · 159 tokens

kelos

Install and configure Kelos; author, document, inspect, troubleshoot, and operate its Kubernetes custom resources and CRD schemas in the kelos.dev API group using manifests, kubectl, or the kelos CLI. Use when a request names Kelos or a distinctive Kelos kind such as AgentConfig or TaskSpawner and concerns an…

kelos-dev/kelos · 128 tokens

kubernetes-expert

Expert-level Kubernetes cluster management, deployment strategies, networking, and production operations. Use when the user mentions containers, orchestration, devops, or cloud native, or when the task involves Kubernetes Architecture, Pods, Deployments, or Services.

personamanagmentlayer/pcl · 53 tokens

kubernetes

Kubernetes operations playbook for deploying services: core objects, probes, resource sizing, safe rollouts, and fast kubectl debugging.

bobmatnyc/claude-mpm-skills · 29 tokens

container-manager-multi-context

Operate several container backends and contexts at once — Kubernetes, Docker, Podman, and Swarm — via the container-manager-mcp MCP server's cmmulticontext tool, with per-call backend/context selection and parallel fan-out across a configured pool of contexts. Use when the agent must compare, migrate between, or…

Knuckles-Team/container-manager-mcp · 118 tokens

k8e-sandbox