What problem does it solve? Running the external Control Tower / LinuxArena benchmark against glovebox's sbx microVM sandbox is expensive, paid per cell, and easy to misconfigure — a wrong matrix cell, missing credential, or unmeasured precondition wastes real money and yields no ΔS/ΔU measurement. This Skill encodes the dispatch mechanics, mandatory offline preflight checks, and failure-diagnosis rules so each paid run actually measures marginal defense. ## Core Features & Use Cases - Suite selection and dispatch: Choose between ct-inspect-e2e (live microVM measurement), ct-inspect-seams (cheap API probe), and breakout-ctf, then dispatch evals.yaml via the GitHub Actions MCP tool with correctly stringified cells_json. - Mandatory offline preflight: Run env preflight over every environment, resolve OpenRouter provider pins against live endpoint metadata, and audit measurement preconditions before spending on a dispatch. - Cost and correctness guardrails: Enforce guarded-only cells by default, reuse bare-arm reference numbers, set max_actions for reachability smokes, and use the free ctscript/submit scripted model for provisioning questions. - Use Case: You want to measure whether a new sbx allowlist change reduces attack success. The Skill walks you through the offline checks, builds a guarded-default/honest+attack matrix on your PR branch, dispatches it, and tells you how to read the .eval transcripts and verdict lines. ## Quick Start Ask the agent to run the Control Tower eval, for example: "Run a guarded-default CT smoke across all environments on my current branch using the free scripted model."
