Skip to content
Get packs

Throwaway Machine Sandbox

Run untrusted code in a disposable VM with no network and a read-only repo, then verify isolation.

Source Download skill
Repository
smol-machines/smolvm
Stars
6,901
Licence
Apache-2.0
Files
10 files

What it does

When installed, the agent runs code it does not trust (such as a generated script or a pull request's test suite) inside a short-lived smolvm microVM. The repo is mounted read-only, the only writable place is an output folder, and by default the workload has no network access. The agent then checks both inside and outside the VM that isolation held and that nothing is left running.

Great for

  • Developers who want an AI agent to run generated or third-party code without risking their machine
  • Reviewers testing a pull request's test suite in isolation
  • People who need network access granted to a workload one host at a time

Skip it if

  • Setting up a long-lived development environment you re-enter across sessions (the skill is built for throwaway runs; its own description says to use another approach)
  • Anyone on macOS v1.24.0 or later relying on the offline route, which the file says fails to boot (issue 1819), or on Windows, where the offline shape is unavailable
  • Treating the sandbox as perfect: scripts run on your host and the isolation depends on smolvm and libkrun behaving as described

Try asking

  • “Run this generated Python script in a throwaway machine with no network and collect its output.”
  • “Test this pull request's test suite against the repo without letting it modify my files.”
  • “Run this script, but allow it to reach api.example.com only, then verify the result.”
  • “Cancel the sandboxed run that is still going and confirm no VM is left running.”
Step-by-step guide: how to use Throwaway Machine SandboxInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 10 original files, the Apache-2.0 licence and an attribution note.

    throwaway-machine.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip throwaway-machine.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip throwaway-machine.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run preflight.sh first and check device_budget_ok and offline_shape before planning mounts, since x86_64 guests have a small device limit through v1.22.2.
  • Keep the repo mount and output mount in a single directory tree where possible, and always verify from both inside the guest and the host.
  • Record the vm_pid printed by run.sh, and use cleanup.sh --cancel to stop a run rather than Ctrl-C, especially before v1.20.2.

What's inside

  • README.md
  • references/macos.md
  • references/traps.md
  • references/windows.md
  • scripts/bake.sh
  • scripts/cleanup.sh
  • scripts/preflight.sh
  • scripts/run.sh
  • scripts/verify.sh
  • SKILL.md

Redistributed unmodified from smol-machines/smolvm under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-11-02. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.