skills.rest
patriksimekpatriksimekCommunity·4 Agent Skills Included

vm2

Safely run untrusted JavaScript code inside Node.js applications

Runs untrusted JavaScript code in an isolated sandbox inside Node.js without risking your main application. Blocks sandbox escapes, controls module and filesystem access, and enforces timeouts and memory limits. Includes agent skills that triage security advisories, patch vulnerabilities, red-team the sandbox, and merge verified fixes.
4,095|330
↗
npx skills add patriksimek/vm2 --all -g -y
Available:

Gives the AI agent a full map of the sandbox architecture, security principles, and a mandatory checklist to follow whenever it changes boundary code or fixes vulnerabilities.

All Skills in This Repository (4)

Pure Emerald Level Indicators
📦 In Repo
patriksimekpatriksimek

fix-vulnerability

Automate vm2 vulnerability remediation from GHSA or CVE advisories.

Community
Advanced
📦 In Repo
patriksimekpatriksimek

hacker

Identify and exploit vm2 sandbox escape vectors with reproducible test cases.

Community
Advanced
📦 In Repo
patriksimekpatriksimek

maintainer

Triages, deduplicates, and manages GitHub Security Advisories for the vm2 repository.

Community
Advanced
📦 In Repo
patriksimekpatriksimek

merge-fix

Squash-merge confirmed vm2 vulnerability fixes from private GHSA forks into local main.

Community
Advanced

Frequently Asked Questions

FAQPage Schema
How to install vm2?▼

Run `npx skills add patriksimek/vm2 --all -g -y` in your terminal to install all skills in this suite globally.

What does vm2 do?▼

vm2 lets you run untrusted JavaScript code in a sandboxed environment inside Node.js, blocking access to the host process, filesystem, and modules unless you explicitly allow them.

Is vm2 safe for running arbitrary user code?▼

vm2 patches known escapes actively, but in-process sandboxing has limits. For fully untrusted code, combine it with stronger isolation like containers or separate processes.

How do the AI agent skills help maintain vm2?▼

The skills let an AI agent triage security advisories, reproduce and patch vulnerabilities, red-team the sandbox for new escapes, and merge confirmed fixes safely.

Does vm2 support TypeScript or CoffeeScript?▼

Yes. You can pass a compiler option to run TypeScript or CoffeeScript inside the sandbox, as long as the matching compiler package is installed.

Related Repositories in Software Engineering

View All in Software Engineering→
openclawopenclaw
388.4k

openclaw

Run a personal AI assistant across your devices and chat apps

Official📦 120 Skills
obraobra
280.0k

superpowers

Gives coding agents a disciplined workflow from idea to merged code

Community📦 15 Skills
facebookfacebook
248.4k

react

AI agent skills for building, testing, and porting React core

Official📦 14 Skills