sandboxed-audit-runner

仓库创建 2025年2月1日最近提交 7 天前SkillHot 收录 20 天前

▸ 精选理由

可降低代码中嵌入的提示注入和主机泄露风险，适合审计时使用。

▸ 风险提示

依赖 Anthropic srt 二进制与外部资源，安装或运行时可能下载代码。

这个 Skill 做什么

在 Anthropic Sandbox Runtime 中运行审计会话以隔离不信任代码。

在对不信任的代码做安全审计前，先用 Anthropic Sandbox Runtime（srt）把审计会话包起来，防止代码里藏的恶意注入命令影响主机或泄露密钥。适合在要跑智能合约审计、基础设施审计或任何可能含有恶意文件的代码库前启动。特点是隔离 agent 会话、阻断恶意注释/文件名诱导的外呼或数据外泄风险。

▸ 展开 SKILL.md 英文原文

Wrap the current audit agent session inside the Anthropic Sandbox Runtime (srt) before starting any security audit. Use this before invoking smart-contract-audit, infrastructure-audit, or any other audit skill on an untrusted codebase. Triggers include: start a sandboxed audit, run audit in sandbox, sandbox before auditing, protect my session during audit.

自动化集成沙箱化审计安全AnthropicClaude Code

119

Stars

Forks

仓库内 Skill

+10

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/forefy/.context/main/skills/sandboxed-audit-runner/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/forefy/.context/main/skills/sandboxed-audit-runner/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

# Sandboxed Audit Runner

Before running any audit on untrusted code, this skill configures and launches `srt` to wrap the entire agent session. The goal is to protect the host from prompt injection attacks embedded in the codebase under review - malicious comments, filenames, or configs designed to make the auditing agent exfiltrate SSH keys, tokens, or make unauthorized network calls.

**SKILL DIRECTORY DETECTION:**
```bash
SKILL_DIR=$([ -d "$HOME/.context/skills/sandboxed-audit-runner" ] && echo "$HOME/.context/skills/sandboxed-audit-runner" || echo ".context/skills/sandboxed-audit-runner")
```

## Prerequisites

```bash
npm install -g @anthropic-ai/sandbox-runtime
srt --version
```

On L

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有