Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Plugin Sandbox Setup · a5c-ai | DecimalAI

a5c-ai/plugin-sandbox-setup

SkillScore13Maintained

Configure plugin sandboxing with vm2 or isolated-vm for secure plugin execution.

Securityby a5c-ai

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/a5c-ai-plugin-sandbox-setup/SKILL.md

decimalai skills pull a5c-ai-plugin-sandbox-setup --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/a5c-ai-plugin-sandbox-setup/SKILL.md https://app.decimal.ai/s/a5c-ai-plugin-sandbox-setup/SKILL.md

Raw file: /s/a5c-ai-plugin-sandbox-setup/SKILL.md ↗ · machine-readable summary at /s/a5c-ai-plugin-sandbox-setup.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

Yes — +13% lift-19% tokens0% turns13% of whole cases pass with skill (3/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-02	✗→✓	▲ Improved	-50%	0%
case-03	✗→✓	▲ Improved	-52%	0%
case-15	✗→✓	▲ Improved	-69%	0%
case-01	✗→✗	＝ Same ✗	5%	0%
case-04	✗→✗	＝ Same ✗	-13%	0%

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/31/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

a5c-ai / babysitter

library/specializations/cli-mcp-development/skills/plugin-sandbox-setup/SKILL.md

View on GitHub ↗

License MITImported 7/31/2026Version v1

Skill contents

SKILL.md

Plugin Sandbox Setup

Configure plugin sandboxing for security.

Generated Patterns

typescript
import ivm from 'isolated-vm';

export async function runInSandbox(code: string, context: Record<string, unknown>) {
  const isolate = new ivm.Isolate({ memoryLimit: 128 });
  const vmContext = isolate.createContextSync();
  const jail = vmContext.global;

  for (const [key, value] of Object.entries(context)) {
    jail.setSync(key, new ivm.ExternalCopy(value).copyInto());
  }

  const script = isolate.compileScriptSync(code);
  const result = await script.run(vmContext, { timeout: 5000 });
  isolate.dispose();
  return result;
}

Target Processes

plugin-architecture-implementation
mcp-server-security-hardening

Illustrative Want to see what a5c-ai/plugin-sandbox-setup would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/1/2026, 01:19 UTC · 23 cases

Lift

+13%

13% vs 0%

Agent turns

0%

1.0 vs 1.0

Tokens

-19%

1,376.91 vs 1,699.04

fail → pass · 3fail → fail · 20

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 In a Node.js server application executing third-party plugin code, we need to enforce strict V8 heap isolation to prevent plugins from accessing host global objects or blocking the main thread. Standard Node.js `vm` context execution is insufficient because isolation can be bypassed via constructor prototypes. Write a TypeScript module that imports the recommended native V8 isolate library for secure code execution.	fail→fail	17,199	17,402	+1%	1	1	0%	3,514	3,675	+5%	0	0	—
case-02 When configuring a native V8 isolate runner in Node.js for untrusted third-party plugins, what memory limit in megabytes should be passed to the isolate constructor options to prevent plugin heap exhaustion attacks?	fail→pass	9,547	2,956	-69%	1	1	0%	1,360	679	-50%	0	0	—
case-03 In an isolated V8 script runner for Node.js plugins, we need to protect against CPU spinning infinite loops. What execution timeout option in milliseconds should be passed when invoking the compiled script?	fail→pass	8,199	3,710	-55%	1	1	0%	1,586	765	-52%	0	0	—
case-04 In a Node.js V8 isolate sandbox utility that executes guest scripts on demand, how should the isolate instance lifecycle be managed after script execution finishes to prevent process handle and memory leaks?	fail→fail	17,653	12,809	-27%	1	1	0%	2,911	2,526	-13%	0	0	—
case-05 When injecting host context parameters (such as configuration objects or variables) into an `isolated-vm` sandbox, direct reference assignment will fail across V8 memory boundaries. What mechanism provided by the V8 isolate library safely serializes host objects into context memory?	fail→fail	8,556	6,298	-26%	1	1	0%	1,571	1,324	-16%	0	0	—
case-06 After instantiating an external copy of host data with `isolated-vm` in Node.js, what method transfers that copied object into the target global context object?	fail→fail	8,936	2,895	-68%	1	1	0%	1,626	785	-52%	0	0	—
case-07 In `isolated-vm`, after initializing a new `ivm.Isolate`, what synchronous method on the isolate creates the V8 execution context for running scripts?	fail→fail	2,874	2,332	-19%	1	1	0%	541	606	+12%	0	0	—
case-08 In an `isolated-vm` sandboxing setup for Node.js, what synchronous isolate method should be called to compile raw TypeScript/JavaScript string code before executing it in a context?	fail→fail	3,749	2,720	-27%	1	1	0%	798	762	-5%	0	0	—
case-09 When setting up a V8 isolate context using `isolated-vm` in Node.js, which property on the context object grants access to the global object (jail) for injecting variables?	fail→fail	4,532	3,132	-31%	1	1	0%	845	706	-16%	0	0	—
case-10 In an `isolated-vm` sandbox environment, what synchronous method is called on the global jail object to register a context key with its transferred value?	fail→fail	8,377	2,649	-68%	1	1	0%	1,376	655	-52%	0	0	—
case-11 When running untrusted code in a Node.js native V8 isolate allocated per request, a developer proposes calling `isolate.dispose()` at the end of the `try` block right before returning the execution result. Why is calling `isolate.dispose()` only in the `try` block problematic when an untrusted script throws or times out, and where should `isolate.dispose()` be called instead?	fail→fail	9,496	8,372	-12%	1	1	0%	1,814	1,833	+1%	0	0	—
case-12 When executing a compiled script inside a context using `isolated-vm` in Node.js, how is the script execution called and passed the context and timeout parameters?	fail→fail	7,704	6,118	-21%	1	1	0%	1,640	1,416	-14%	0	0	—
case-13 We are hardening a Model Context Protocol (MCP) server that evaluates dynamic plugin tools written by external users. Instead of running untrusted code directly in the main Node.js process using `eval` or `vm.runInContext`, how should the plugin runner isolate execution at the V8 heap layer?	fail→fail	15,511	13,385	-14%	1	1	0%	2,912	3,124	+7%	0	0	—
case-14 In designing a secure plugin architecture for a Node.js application, what specific constructor option key and default numeric value in MB should be supplied to `ivm.Isolate` to prevent untrusted code from allocating excessive memory?	fail→fail	3,017	2,238	-26%	1	1	0%	526	591	+12%	0	0	—
case-15 To secure a plugin execution sandbox against CPU-bound Denial of Service, what option key and numeric millisecond value must be passed to `script.run` inside the V8 isolate execution function?	fail→pass	9,214	1,915	-79%	1	1	0%	1,728	544	-69%	0	0	—
case-16 In a TypeScript plugin runner using `isolated-vm`, where and how is `isolate.dispose()` invoked relative to returning the script execution result?	fail→fail	14,437	8,882	-38%	1	1	0%	2,433	1,867	-23%	0	0	—
case-17 When iterating over entries in a context dictionary `Record<string, unknown>` to expose them to an `isolated-vm` sandbox context, how is each value wrapped before calling `copyInto()`?	fail→fail	13,255	2,791	-79%	1	1	0%	2,537	783	-69%	0	0	—
case-18 When initializing an `isolated-vm` runner in TypeScript, what exact synchronous method name on the isolate instance creates the V8 context object?	fail→fail	3,320	2,440	-27%	1	1	0%	574	600	+5%	0	0	—
case-19 In `isolated-vm`, why must `script.run()` be awaited in `runInSandbox`, and what object is passed as its first argument?	fail→fail	10,486	6,329	-40%	1	1	0%	1,707	1,266	-26%	0	0	—
case-20 What top-level ESM import statement is used to import the V8 isolation module under the standard alias `ivm` in TypeScript?	fail→fail	3,860	1,231	-68%	1	1	0%	751	398	-47%	0	0	—
case-21 We need to containerize an entire backend Node.js microservice executing untrusted tasks using Docker. What container security flags should be passed to `docker run` to restrict root filesystem writes and limit container execution privileges?	fail→fail	10,921	9,240	-15%	1	1	0%	2,323	2,140	-8%	0	0	—
case-22 In a frontend web application, we need to embed third-party HTML/JS widgets using an `<iframe>` element while restricting their access to the parent window domain, localStorage, and top-level navigation. What standard HTML attribute and directives should be applied to the `<iframe>` tag?	fail→fail	6,247	6,698	+7%	1	1	0%	1,223	1,537	+26%	0	0	—
case-23 Before executing submitted user JavaScript code, we want to perform static code analysis to block code containing `process.exit`, `eval()`, or `require()` calls at compile time. What AST parsing library and static analysis approach should be used in Node.js to scan script code?	fail→fail	12,649	12,699	+0%	1	1	0%	2,782	3,087	+11%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +13 percentage points is the difference between those two pass rates over the 23 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 0%
Pass rate with the skill: 13%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/1/2026, 01:19 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-02

Prompt

When configuring a native V8 isolate runner in Node.js for untrusted third-party plugins, what memory limit in megabytes should be passed to the isolate constructor options to prevent plugin heap exhaustion attacks?

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run13

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 54 days ago

Other measured skills in the registry, with their headline benchmark lift.