Claude Skill

unsafe-sandbox

Rules for unsafe Rust and the L3 microVM sandbox. Use when adding unsafe blocks, FFI, sandbox features, differential replay, or canary credentials.

LLM Mart · 0 points · 10 0 0

Virus-scanned Reviewed automatically before listing.

Full trust report

Download KalarisLabs-Skill-Doctor-skills_unsafe-sandbox-9413620.zip · 0 KB

kalarislabs/skill-doctor 13 1 forks Apache-2.0 Updated 9d ago

Part of kalarislabs/skill-doctor — 15 skills

Install

skills CLI npx skills add https://github.com/KalarisLabs/Skill-Doctor/tree/main/skills/unsafe-sandbox

Claude Code

claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install kalarislabs-skill-doctor@llmmart

Git git clone https://github.com/KalarisLabs/Skill-Doctor.git

The skills CLI installs just this skill, for any of its supported agents. Claude Code installs the whole kalarislabs/skill-doctor collection as a plugin from our marketplace. Git is the plain clone.

Skill manifest

Unsafe and sandbox

unsafe only in skill-doctor-sandbox.
Every block has // SAFETY: naming the invariant.
Default binary does not enable sandbox. Missing L3 → coverage reduction, not a crash.
Canaries are fake host-injected values, never production secrets.
Differential replay: vary clock / hostname / CI env; divergence is a finding.
No Firecracker daemon on the default path.
Sandbox tests: #[cfg(feature = "sandbox")]. Do not fail Windows required CI because L3 is absent.

Files (skill-doctor)

SKILL.md 707 B

---
name: unsafe-sandbox
description: Rules for unsafe Rust and the L3 behavioral process harness. Use when adding unsafe blocks, FFI, sandbox features, differential replay, or canary credentials.
---

# Unsafe and sandbox

- `unsafe` only in `skill-doctor-sandbox`.
- Every block has `// SAFETY:` naming the invariant.
- Default binary does not enable `sandbox`. Missing L3 → coverage reduction, not a crash.
- Canaries are fake host-injected values, never production secrets.
- Differential replay: vary clock / hostname / CI env; divergence is a finding.
- No Firecracker daemon on the default path.
- Sandbox tests: `#[cfg(feature = "sandbox")]`. Do not fail Windows required CI because L3 is absent.