opp-repl-sandbox — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited opp-repl-sandbox (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
opp_sandbox wraps a command in a bubblewrap (bwrap) container: read-only system + sources, a writable working directory, dropped capabilities. Qtenv GUI still works. It is the recommended way to expose execute_python to an autonomous agent with reduced blast radius.
Upstream reference: https://github.com/omnetpp/opp_repl/blob/main/doc/mcp_server.md (the "Running inside opp_sandbox" section)
bubblewrap (bwrap) installed(sudo apt install bubblewrap). Not available on macOS.
opp_sandbox [options] [--] <command> [args...]
| Option | Meaning |
|---|---|
-m, --mount DIR ... | Mount additional directories read-only |
-w, --writable DIR ... | Mount additional directories read-write |
-h, --help | Print help |
-- | End of options; everything after is the command |
Example — a sandboxed REPL with the MCP server, no token needed:
opp_sandbox -w ~/workspace -- \ opp_repl --load "opp/*.opp" --mcp-port 9966
opp_sandbox bind-mounts a read-only sentinel at /.opp_sandbox. opp_repl detects it (is_running_in_sandbox()) and waives the bearer-token requirement for the MCP server — bubblewrap isolation substitutes for auth. Outside the sandbox, TCP MCP still requires --mcp-token-hash or --mcp-bypass-token-hash-check (see opp-repl-mcp-server).
fuse-overlayfs mounts must be created before entering the sandbox (the jail restricts FUSE). Pre-mount with opp_mount, run inside the sandbox, then opp_unmount afterwards:
opp_mount "~/workspace/opp/.opp" opp_sandbox -w ~/workspace -- opp_repl --load "opp/.opp" --mcp-socket opp_unmount
See opp-repl-overlay-builds for the overlay mechanics.
socket transport's 0600 permissions and a venv instead.
overlay roots) needs an explicit -w mount, or you'll get read-only-filesystem errors.
it as a full security boundary for hostile code.
opp-repl-mcp-server — auth model the sandbox interacts with.opp-repl-overlay-builds — opp_mount / opp_unmount pre-mounting.opp-repl-shared-terminal — a different way to share one live REPL.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.