# sandboxed-audit-runner

Wrap the session in the Anthropic Sandbox Runtime before touching untrusted code. Use before running any audit skill on a codebase you do not trust.

- **Kind:** skill
- **Source:** https://github.com/forefy/.context
- **Page:** https://forefy.com/skills/9fb0e5c9-e2f4-45ab-a892-4ce2e4f62b40
- **API (JSON + files):** https://forefy.com/api/asr/9fb0e5c9-e2f4-45ab-a892-4ce2e4f62b40

---

## SKILL.md

---
name: sandboxed-audit-runner
description: Wrap the session in the Anthropic Sandbox Runtime before touching untrusted code. Use before running any audit skill on a codebase you do not trust.
---

# Sandboxed Audit Runner

Before running any audit on untrusted code, this skill configures and launches `srt` to wrap the entire agent session. The goal is to protect the host from prompt injection attacks embedded in the codebase under review - malicious comments, filenames, or configs designed to make the auditing agent exfiltrate SSH keys, tokens, or make unauthorized network calls.

**SKILL DIRECTORY DETECTION:**
```bash
SKILL_DIR=$([ -d "$HOME/.context/skills/sandboxed-audit-runner" ] && echo "$HOME/.context/skills/sandboxed-audit-runner" || echo ".context/skills/sandboxed-audit-runner")
```

## Prerequisites

```bash
npm install -g @anthropic-ai/sandbox-runtime
srt --version
```

On Linux, also install bubblewrap: `apt install bubblewrap`.

## Setup

### 1. Create the audit session config

Read `$SKILL_DIR/references/smart-contract.srt.md`, extract the JSON block, and write it to `.srt-audit.json` in the project root. Remove any `allowedDomains` entries the audit does not need.

### 2. Start the sandboxed session

```bash
srt --settings .srt-audit.json bash
```

All commands run inside that shell - including any invoked audit skill - are now sandboxed at the OS level. On macOS this uses `sandbox-exec`; on Linux it uses `bubblewrap`.

### 3. Invoke the audit skill normally

With the sandbox active, invoke the audit skill as usual:

```
run smart-contract-audit
```

The entire agent conversation and all tool calls it makes will execute under the srt restrictions for the duration of the session.

### 4. Verify the sandbox is active (optional)

```bash
cat ~/.ssh/id_rsa      # should be blocked
curl https://example.com  # should be blocked if not in allowedDomains
```

### 5. Clean up

```bash
exit
rm .srt-audit.json
```

## Why this matters

Audited code can contain:
- Comments or string literals with prompt injection payloads targeting the AI
- `package.json` postinstall scripts that probe `~/.aws` or `~/.ssh`
- Test fixtures or build scripts with embedded exfiltration logic
- Configs that instruct tooling to phone home

Wrapping the session in `srt` means these attempts are blocked at the OS level before any tool executes them, regardless of whether the AI detected the injection.

## references

```

```

## references/smart-contract.srt.md

Sandbox profile for EVM smart contract audits. Allows GitHub dependency fetches, block explorer APIs, free public RPCs for fork testing, and package registries. All sensitive host credential paths are denied.

Copy the JSON block below to `.srt-audit.json` in the project root before starting the sandboxed session.

```json
{
  "network": {
    "allowedDomains": [
      "github.com",
      "raw.githubusercontent.com",
      "api.github.com",
      "registry.npmjs.org",
      "pypi.org",
      "files.pythonhosted.org",
      "crates.io",
      "static.crates.io",
      "api.etherscan.io",
      "api-goerli.etherscan.io",
      "api-sepolia.etherscan.io",
      "api.basescan.org",
      "api-optimistic.etherscan.io",
      "api.arbiscan.io",
      "mainnet.infura.io",
      "rpc.ankr.com",
      "cloudflare-eth.com",
      "eth.llamarpc.com",
      "base.llamarpc.com",
      "arb1.arbitrum.io"
    ],
    "deniedDomains": []
  },
  "filesystem": {
    "denyRead": [
      "~/.ssh",
      "~/.gnupg",
      "~/.aws",
      "~/.config/gcloud",
      "~/.npmrc",
      "~/.pypirc",
      "~/.netrc"
    ],
    "allowRead": [
      ".",
      "~/.foundry",
      "~/.cargo"
    ],
    "allowWrite": [
      ".",
      "/tmp",
      "~/.foundry/cache"
    ],
    "denyWrite": [
      ".env",
      ".env.*",
      "*.pem",
      "*.key"
    ]
  }
}
```