XPR Code Sandbox

Execute JavaScript code in a secure sandbox for data processing, computation, and quick expression evaluation without network or filesystem access.

This skill appears internally consistent for running JavaScript computations in a sandbox and does not ask for credentials or installs. Before installing, consider: (1) provenance — the source/homepage is unknown; prefer skills from known authors. (2) Treat it as untrusted when executing third-party code: test with non-sensitive inputs and small timeouts. (3) Although the code explicitly blocks require/process/global and disables code-generation-from-strings, vm-based sandboxes have historically had escape techniques — avoid sending secrets or sensitive data into the sandbox. (4) If you need stronger guarantees, run similar workloads in a dedicated, isolated execution environment (separate process/container) or seek a sandbox with formal audits.

Type: OpenClaw Skill Name: xpr-code-sandbox Version: 0.2.11 The skill provides a sandboxed JavaScript execution environment using Node.js's `vm` module. The `SKILL.md` documentation clearly outlines the limitations, explicitly stating 'No network access, no filesystem, no imports'. The `src/index.ts` implementation reinforces these security measures by setting `codeGeneration: { strings: false, wasm: false }` and explicitly blocking access to `require`, `process`, `globalThis`, and `global` within the sandbox. Timeouts and output limits are also enforced. There is no evidence of malicious intent, data exfiltration, persistence, or prompt injection attempts against the agent. The implementation adheres to best practices for secure sandboxing with the `vm` module.