ariffazil/arifos-untrusted-sandbox
registries/antigravity/skills/arifos-untrusted-sandbox/SKILL.md
Mandatory bubblewrap (bwrap) supermax jail for executing any untrusted Python/JS synthesized by external AIs (Copilot, Mythos, third-party). Load when running, evaluating, or testing code from non-federation AI sources. Triggers on `exec(`, `eval(`, untrusted code review, jail requirement.
development
Updated Jun 15, 2026
$ install --global
skillsauthnpx skillsauth add ariffazil/openclaw-workspace arifos-untrusted-sandboxInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 15, 2026, 3:26 AM56.4s1 file scanned
SKILL.md
- name:
- arifos-untrusted-sandbox
- description:
- Mandatory bubblewrap (bwrap) supermax jail for executing any untrusted Python/JS synthesized by external AIs (Copilot, Mythos, third-party). Load when running, evaluating, or testing code from non-federation AI sources. Triggers on `exec(`, `eval(`, untrusted code review, jail requirement.
- version:
- 1.0.0
- author:
- arif
- tags:
- arifos, sandbox, security, bwrap, jail, untrusted
arifOS Untrusted Execution Sandbox
Authority
- Owner: Sovereign Architect 888 (Arif)
- Status: ACTIVE
- Deployed: 2026-06-03
Purpose
When an external AI (Copilot, Mythos, or any untrusted synthesizer) generates Python code for arifOS, that code MUST be executed inside a bwrap (Bubblewrap) Supermax jail before it touches any federation organ.
This skill defines both:
- The System Prompt fed to untrusted AI engines
- The Runtime Harness (
arifos-sandbox) that enforces the jail
When to Use
- Generating code from external LLMs (non-arifOS agents)
- Running user-submitted scripts
- Testing AI-generated automation
- Any scenario where code origin is not 100% trusted
When NOT to Use
- Federation agents (arifOS, WEALTH, WELL, GEOX) — these run under systemd hardening, not bwrap
- Internal tool execution — use
arifosmcp.runtime.dispatcher
The System Prompt
See /root/arifOS/prompts/untrusted_execution_synthesizer.txt
Core constraints communicated to the AI:
- UID 65534 (nobody), cap-drop ALL
- Network namespace: loopback exists, zero external routes
- Filesystem: read-only binds, writable only in
/tmp(64MB tmpfs) - Hard limits: 5 seconds, 128MB RAM
- Python stdlib only, zero third-party imports
- Banned modules: subprocess, os.system, ctypes, socket, urllib, eval, exec, compile, import
- I/O: stdin only in, stdout only out
The Runtime Harness
arifos-sandbox '<python_code>' [timeout] [memory_kb]
Implementation
timeout(1)enforces the seconds limit (SIGKILL)ulimit -venforces the memory limit (OOM)bwrapprovides namespace isolation, capability drop, and filesystem sandboxing- Script is written to ephemeral temp file, destroyed after execution
bwrap flags used
--ro-bind /usr /usr
--ro-bind /lib /lib
--ro-bind /lib64 /lib64
--proc /proc
--dev /dev
--size 67108864 --tmpfs /tmp
--unshare-all
--die-with-parent
--new-session
--cap-drop ALL
--setuid 65534
--setgid 65534
--dir /run/user
F1–F13 Alignment
| Floor | Compliance | |-------|------------| | F1 | Capability drop + namespace isolation = no privilege escalation | | F2 | Prompt accurately reflects runtime reality (loopback truth, timeout truth) | | F4 | Single-threaded, stdlib-only = consistent execution environment | | F7 | 5s/128MB bounds prevent resource exhaustion |
DITEMPA BUKAN DIBERI
Related Skills
ariffazil/openclaw
testing
VerifiedTrustedCommunity
OpenClaw edge agent bridge — operational triage, doctor, restart, and A2A bridge routing for the federation edge (Telegram surface). USE WHEN: "openclaw unhealthy", "gateway down", "edge bot not responding", "a2a bridge disconnected", "watchdog tripped", "openclaw doctor", "openclaw restart". NOT for token/security audit — use FORGE-telegram-audit.
2SKILL.mdUpdated Aug 8, 2026
ariffazil/MiniMax Image Generation
tools
VerifiedTrustedCommunity
Generate images, videos, TTS, voice clone, and music via MiniMax MCP server. Use when user asks to "draw", "generate image", "create picture", "make a photo", "text to image", "image generation".
2SKILL.mdUpdated Aug 8, 2026
ariffazil/arifos-constitutional-judge
testing
VerifiedTrustedCommunity
Single load-bearing constitutional-judgment skill. Routes all F1–F13, verdict, hold, seal, scope, authority and floor-check calls through the live arif_judge surface. Replaces 7 overlapping predecessors (arifos-constitutional-judge, arifos-constitutional-judge, arifos-constitutional-judge, arifos-constitutional-judge, arifos-constitutional-judge, arifos-constitutional-judge, arifos-constitutional-judge).
2SKILL.mdUpdated Aug 8, 2026
ariffazil/FORGE-lsp-pre-edit-gate
development
VerifiedTrustedCommunity
MANDATORY LSP grounding gate BEFORE any code mutation on .ts, .py, .js, .tsx, .jsx files. Forces the agent to read real-time compiler diagnostics and structural project context before editing — eliminating blind guesses and anchoring every mutation in F2 (TRUTH). Routes through arifOS kernel (:8088) for centralized gate logic.
2SKILL.mdUpdated Aug 8, 2026