Owner-script sandbox hardening

Parent: structure

Owner-authored skill scripts (skill_run_script, see skills-progressive-disclosure) are untrusted, so they run hard-sandboxed: --network=none (can't exfiltrate), --read-only root (can't persist), --tmpfs /tmp bounded scratch (64 MB), --memory=256m --cpus=0.5 (runaway loops capped), --rm (auto-cleaned). The interpreter is a 3-language whitelist (python3 -c / node -e / bash -c) — no arbitrary binaries, so the shell-injection surface outside the boundary is zero. These are docker run flags assembled by DockerRunner in internal/capabilities/sandbox/sandbox.go (the package moved under capabilities/ with the domain-module split; the bwrap workspaces of the MCP capability sandboxes are a different package, capabilities/sandboxws).

Same instinct as the network-isolated MCP capability sandboxes (mcp-capability-plugins): untrusted code runs caged, reaching the host only through narrow, declared channels.

Ask this entry a question.

The AI answers in the owner’s voice, grounded in this corpus. Bring your own key and start — it never leaves your browser.

no code?·BYOAI

Bring your own AI.

Use your own key against the owner’s public corpus. Pick any OpenAI-compatible provider, or point at your own self-hosted endpoint. Private topics return “need a code”.

· your key never touches our server — stored encrypted in your browser only
· owner pays for retrieval, you pay for inference
· private topics return “ask for a code”