The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses asyncio.create_subprocess_exec to run npx sandcastle run. This is the core functionality of the bridge, used to initiate sandboxed jobs. The environment provided to the subprocess is explicitly restricted to a minimal set (PATH, HOME, NODE_NO_WARNINGS) to prevent environment variable leakage.
[EXTERNAL_DOWNLOADS]: The use of npx facilitates the execution of the sandcastle package, which may involve downloading it from the npm registry if not locally available. The documentation references a specific version (0.5.7) from a known GitHub repository.
[SAFE_PRACTICE]: Secrets are managed by writing them to memory-backed storage (/dev/shm) with highly restrictive permissions (0600) and ensuring they are unlinked immediately after the process finishes. This minimizes the risk of secret persistence on physical disk.
[SAFE_PRACTICE]: The skill implements a 'kill-switch' mechanism that checks for an abort signal both before launch and during execution, allowing for immediate termination of subprocesses.
[SAFE_PRACTICE]: All subprocess output is processed through a regex-based stripper designed to redact sensitive information (keys, tokens, passwords) before the logs are committed to the session history.

sandcastle-runner