[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71EPZ2SMPE253B6X5P8VE16":3,"skill-same:01M71EPZ2SMPE253B6X5P8VE16":70},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":50,"repositoryHtmlUrl":51,"repositoryHomepageUrl":6,"ownerHtmlUrl":52,"ownerBlogUrl":53,"ownerDescription":54,"updatedAt":55,"install":56,"resources":69},"01M71EPZ2SMPE253B6X5P8VE16","deno-sandbox",null,"Use when building features that execute untrusted user code, AI-generated code, or need isolated code execution environments. Covers the @deno\u002Fsandbox SDK.","iDorgham\u002FWorkspace-Factory","iDorgham","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F136521493?v=4","01M6CNGBDAHE4ARW3YJEF4X2FD","Dorgham","01M71E8H3CXZ7DJX59MTM9JEB2",1,"MIT","https:\u002F\u002Fgithub.com\u002FiDorgham\u002FWorkspace-Factory\u002Fblob\u002Fmaster\u002F.ai\u002Fskills\u002Fofficial_denoland_deno_sandbox\u002Fskill.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"sandbox","deno","deno sandbox","sdk","code","sandbox sdk","execution","user","generated","execute","use","code execution","environments","features","when","2026-11-10 10:12:30",false,"---\nname: deno-sandbox\ndescription: Use when building features that execute untrusted user code, AI-generated code, or need isolated code execution environments. Covers the @deno\u002Fsandbox SDK.\nlicense: MIT\nmetadata:\n  author: denoland\n  version: \"1.1\"\n---\n\n# Deno Sandboxes\n\n## Overview\n\nDeno Sandboxes provide secure, isolated environments for running untrusted code. Each sandbox runs in its own Linux microVM (using Firecracker, the same technology as AWS Lambda) with a separate filesystem, network, and process space. This makes them ideal for code playgrounds, AI agent tool execution, and multi-tenant applications.\n\nReference: https:\u002F\u002Fdeno.com\u002Fdeploy\u002Fsandboxes\n\n## When to Use Sandboxes\n\nUse Deno Sandboxes when you need to:\n\n- Run user-submitted code safely\n- Execute AI-generated code\n- Build code playground platforms\n- Create multi-tenant code execution environments\n- Run automated tests in isolation\n\n## Scope Boundaries\n\nThis skill applies **only** to Deno Sandbox (`@deno\u002Fsandbox`) questions. Follow these rules:\n\n- If the user asks about **Docker containers, Node.js vm2\u002Fvm, Web Workers, AWS Lambda isolation, or any other isolation technology**, answer using that technology directly. Do not suggest Deno Sandboxes as an alternative.\n- Do not include `@deno\u002Fsandbox` imports, `Sandbox.create()`, or `sandbox.spawn()` in responses about other isolation technologies.\n- Only recommend Deno Sandboxes when the user explicitly asks about them or is building code execution features in a Deno project.\n\n## Getting Started\n\n### Installation\n\n```bash\ndeno add jsr:@deno\u002Fsandbox\n```\n\n### Basic Usage\n\n```typescript\nimport { Sandbox } from \"@deno\u002Fsandbox\";\n\n\u002F\u002F Create a sandbox (auto-disposed when scope ends)\nawait using sandbox = await Sandbox.create();\n\n\u002F\u002F Run a command\nconst child = await sandbox.spawn(\"echo\", { args: [\"Hello from sandbox!\"] });\nconst output = await child.output();\n\nconsole.log(new TextDecoder().decode(output.stdout));\n\u002F\u002F Output: Hello from sandbox!\n```\n\n## Core Concepts\n\n### Sandbox Lifecycle\n\nSandboxes are resources that must be disposed when done. **Always** use `await using` for automatic cleanup:\n\n```typescript\nawait using sandbox = await Sandbox.create();\n\u002F\u002F Sandbox is automatically destroyed when this scope ends\n```\n\nCRITICAL: Never show `const sandbox = await Sandbox.create()` without `await using`. Always use the `await using` pattern for sandbox creation. Do not show manual disposal alternatives.\n\n### Running Processes\n\nThe `spawn` method runs commands inside the sandbox:\n\n```typescript\nconst child = await sandbox.spawn(\"deno\", {\n  args: [\"run\", \"script.ts\"],\n  stdin: \"piped\", \u002F\u002F Enable stdin\n  stdout: \"piped\", \u002F\u002F Capture stdout\n  stderr: \"piped\" \u002F\u002F Capture stderr\n});\n\n\u002F\u002F Wait for completion and get output\nconst output = await child.output();\nconsole.log(\"Exit code:\", output.code);\nconsole.log(\"Stdout:\", new TextDecoder().decode(output.stdout));\nconsole.log(\"Stderr:\", new TextDecoder().decode(output.stderr));\n```\n\n### Streaming I\u002FO\n\nFor interactive processes or long-running commands:\n\n```typescript\nconst child = await sandbox.spawn(\"deno\", {\n  args: [\"repl\"],\n  stdin: \"piped\",\n  stdout: \"piped\"\n});\n\n\u002F\u002F Write to stdin\nconst writer = child.stdin!.getWriter();\nawait writer.write(new TextEncoder().encode(\"console.log('Hello')\\n\"));\nawait writer.close();\n\n\u002F\u002F Read from stdout\nconst reader = child.stdout!.getReader();\nwhile (true) {\n  const { done, value } = await reader.read();\n  if (done) break;\n  console.log(new TextDecoder().decode(value));\n}\n```\n\n### Killing Processes\n\n```typescript\nconst child = await sandbox.spawn(\"sleep\", { args: [\"60\"] });\n\n\u002F\u002F Kill with SIGTERM (default)\nawait child.kill();\n\n\u002F\u002F Or with specific signal\nawait child.kill(\"SIGKILL\");\n\n\u002F\u002F Wait for exit\nconst status = await child.status;\nconsole.log(\"Exited with signal:\", status.signal);\n```\n\n## Common Patterns\n\n### Running User Code Safely\n\n```typescript\nimport { Sandbox } from \"@deno\u002Fsandbox\";\n\nasync function runUserCode(code: string): Promise\u003Cstring> {\n  await using sandbox = await Sandbox.create();\n\n  \u002F\u002F Write user code to a file in the sandbox\n  await sandbox.fs.writeFile(\"\u002Ftmp\u002Fuser_code.ts\", code);\n\n  \u002F\u002F Run with restricted permissions\n  const child = await sandbox.spawn(\"deno\", {\n    args: [\n      \"run\",\n      \"--allow-none\", \u002F\u002F No permissions\n      \"\u002Ftmp\u002Fuser_code.ts\"\n    ],\n    stdout: \"piped\",\n    stderr: \"piped\"\n  });\n\n  const output = await child.output();\n\n  if (output.code !== 0) {\n    throw new Error(new TextDecoder().decode(output.stderr));\n  }\n\n  return new TextDecoder().decode(output.stdout);\n}\n```\n\n### Code Playground\n\n```typescript\nimport { Sandbox } from \"@deno\u002Fsandbox\";\n\ninterface ExecutionResult {\n  success: boolean;\n  output: string;\n  error?: string;\n  executionTime: number;\n}\n\nasync function executePlayground(code: string): Promise\u003CExecutionResult> {\n  const start = performance.now();\n\n  await using sandbox = await Sandbox.create();\n\n  await sandbox.fs.writeFile(\"\u002Fplayground\u002Fmain.ts\", code);\n\n  const child = await sandbox.spawn(\"deno\", {\n    args: [\"run\", \"--allow-net\", \"\u002Fplayground\u002Fmain.ts\"],\n    stdout: \"piped\",\n    stderr: \"piped\"\n  });\n\n  const output = await child.output();\n  const executionTime = performance.now() - start;\n\n  return {\n    success: output.code === 0,\n    output: new TextDecoder().decode(output.stdout),\n    error: output.code !== 0 ? new TextDecoder().decode(output.stderr) : undefined,\n    executionTime\n  };\n}\n```\n\n### AI Agent Tool Execution\n\n```typescript\nimport { Sandbox } from \"@deno\u002Fsandbox\";\n\nasync function executeAgentTool(toolCode: string, input: unknown): Promise\u003Cunknown> {\n  await using sandbox = await Sandbox.create();\n\n  \u002F\u002F Create a wrapper that handles input\u002Foutput\n  const wrapper = `\n    const input = ${JSON.stringify(input)};\n    const tool = await import(\"\u002Ftool.ts\");\n    const result = await tool.default(input);\n    console.log(JSON.stringify(result));\n  `;\n\n  await sandbox.fs.writeFile(\"\u002Ftool.ts\", toolCode);\n  await sandbox.fs.writeFile(\"\u002Frun.ts\", wrapper);\n\n  const child = await sandbox.spawn(\"deno\", {\n    args: [\"run\", \"--allow-net\", \"\u002Frun.ts\"],\n    stdout: \"piped\",\n    stderr: \"piped\"\n  });\n\n  const output = await child.output();\n\n  if (output.code !== 0) {\n    throw new Error(new TextDecoder().decode(output.stderr));\n  }\n\n  return JSON.parse(new TextDecoder().decode(output.stdout));\n}\n```\n\n## Sandbox Features\n\n### Resource Configuration\n\nSandboxes have configurable resources:\n\n- **Default:** 2 vCPUs, 512MB memory, 10GB disk\n- Startup time: Under 200ms\n\n### What's Included\n\nEach sandbox comes with:\n\n- TypeScript\u002FJavaScript runtime (Deno)\n- Full Linux environment\n- Network access (can be restricted)\n- Temporary filesystem\n\n### Security Features\n\n- **Firecracker microVMs** - Same technology as AWS Lambda\n- **Full isolation** - Separate kernel, filesystem, network\n- **No data leakage** - Sandboxes can't access host system\n- **Enforced policies** - Control outbound connections\n\n## Deploying Sandboxes\n\nSandboxes can be deployed directly to Deno Deploy:\n\n```bash\ndeno deploy --prod\n```\n\nThe sandbox SDK works seamlessly in the Deno Deploy environment.\n\n## API Reference\n\nFor the complete API, run:\n\n```bash\ndeno doc jsr:@deno\u002Fsandbox\n```\n\nKey classes:\n\n- `Sandbox` - Main class for creating\u002Fmanaging sandboxes\n- `ChildProcess` - Represents a running process\n- `Client` - For managing Deploy resources (apps, volumes)\n\n## Quick Reference\n\n| Task           | Code                                           |\n| -------------- | ---------------------------------------------- |\n| Create sandbox | `await using sandbox = await Sandbox.create()` |\n| Run command    | `sandbox.spawn(\"cmd\", { args: [...] })`        |\n| Get output     | `const output = await child.output()`          |\n| Write file     | `await sandbox.fs.writeFile(path, content)`    |\n| Read file      | `await sandbox.fs.readFile(path)`              |\n| Kill process   | `await child.kill()`                           |\n| Check status   | `const status = await child.status`            |\n\n## Common Mistakes\n\n**Forgetting automatic disposal**\n\n```typescript\n\u002F\u002F ❌ Wrong - always use \"await using\" for sandbox creation\n\u002F\u002F Never write: const sandbox = await Sandbox.create() without \"await using\"\n\n\u002F\u002F ✅ Correct - use \"await using\" for automatic cleanup\nawait using sandbox = await Sandbox.create();\nawait sandbox.spawn(\"echo\", { args: [\"hello\"] });\n\u002F\u002F sandbox automatically disposed when scope ends\n```\n\n**Giving user code too many permissions**\n\n```typescript\n\u002F\u002F ❌ Wrong - gives untrusted code full access\nconst child = await sandbox.spawn(\"deno\", {\n  args: [\"run\", \"--allow-all\", \"\u002Ftmp\u002Fuser_code.ts\"]\n});\n\n\u002F\u002F ✅ Correct - restrict permissions to what's needed\nconst child = await sandbox.spawn(\"deno\", {\n  args: [\"run\", \"--allow-none\", \"\u002Ftmp\u002Fuser_code.ts\"] \u002F\u002F No permissions\n});\n\n\u002F\u002F Or if network is truly needed:\nconst child = await sandbox.spawn(\"deno\", {\n  args: [\"run\", \"--allow-net\", \"\u002Ftmp\u002Fuser_code.ts\"] \u002F\u002F Only network\n});\n```\n\n**Not handling process output properly**\n\n```typescript\n\u002F\u002F ❌ Wrong - forgetting to pipe stdout\u002Fstderr\nconst child = await sandbox.spawn(\"deno\", { args: [\"run\", \"script.ts\"] });\nconst output = await child.output();\n\u002F\u002F output.stdout is empty because we didn't pipe it!\n\n\u002F\u002F ✅ Correct - pipe the streams you need\nconst child = await sandbox.spawn(\"deno\", {\n  args: [\"run\", \"script.ts\"],\n  stdout: \"piped\",\n  stderr: \"piped\"\n});\nconst output = await child.output();\nconsole.log(new TextDecoder().decode(output.stdout));\n```\n\n**Not setting timeouts for user code execution**\n\n```typescript\n\u002F\u002F ❌ Wrong - user code could run forever\nconst child = await sandbox.spawn(\"deno\", {\n  args: [\"run\", \"\u002Ftmp\u002Fuser_code.ts\"]\n});\nawait child.output(); \u002F\u002F Could hang indefinitely\n\n\u002F\u002F ✅ Correct - implement timeout handling\nconst child = await sandbox.spawn(\"deno\", {\n  args: [\"run\", \"\u002Ftmp\u002Fuser_code.ts\"],\n  stdout: \"piped\",\n  stderr: \"piped\"\n});\n\n\u002F\u002F Set a timeout to kill the process\nconst timeoutId = setTimeout(() => child.kill(), 5000); \u002F\u002F 5 second limit\n\ntry {\n  const output = await child.output();\n  return output;\n} finally {\n  clearTimeout(timeoutId);\n}\n```\n\n**Trusting sandbox output without validation**\n\n```typescript\n\u002F\u002F ❌ Wrong - directly using untrusted output as code\nconst result = await runUserCode(code);\n\u002F\u002F Never execute or inject untrusted output!\n\n\u002F\u002F ✅ Correct - validate and sanitize output\nconst result = await runUserCode(code);\ntry {\n  const parsed = JSON.parse(result); \u002F\u002F Parse as data, not code\n  if (isValidResponse(parsed)) {\n    return parsed;\n  }\n} catch {\n  throw new Error(\"Invalid response from sandbox\");\n}\n```\n","# Deno Sandboxes\n\n## Overview\n\nDeno Sandboxes provide secure, isolated environments for running untrusted code. Each sandbox runs in its own Linux microVM (using Firecracker, the same technology as AWS Lambda) with a separate filesystem, network, and process space. This makes them ideal for code playgrounds, AI agent tool execution, and multi-tenant applications.\n\nReference: https:\u002F\u002Fdeno.com\u002Fdeploy\u002Fsandboxes\n\n## When to Use Sandboxes\n\nUse Deno Sandboxes when you need to:\n\n- Run user-submitted code safely\n- Execute AI-generated code\n- Build code playground platforms\n- Create multi-tenant code execution environments\n- Run automated tests in isolation\n\n## Scope Boundaries\n\nThis skill applies **only** to Deno Sandbox (`@deno\u002Fsandbox`) questions. Follow these rules:\n\n- If the user asks about **Docker containers, Node.js vm2\u002Fvm, Web Workers, AWS Lambda isolation, or any other isolation technology**, answer using that technology directly. Do not suggest Deno Sandboxes as an alternative.\n- Do not include `@deno\u002Fsandbox` imports, `Sandbox.create()`, or `sandbox.spawn()` in responses about other isolation technologies.\n- Only recommend Deno Sandboxes when the user explicitly asks about them or is building code execution features in a Deno project.\n\n## Getting Started\n\n### Installation\n\n```bash\ndeno add jsr:@deno\u002Fsandbox\n```\n\n### Basic Usage\n\n```typescript\nimport { Sandbox } from \"@deno\u002Fsandbox\";\n\n\u002F\u002F Create a sandbox (auto-disposed when scope ends)\nawait using sandbox = await Sandbox.create();\n\n\u002F\u002F Run a command\nconst child = await sandbox.spawn(\"echo\", { args: [\"Hello from sandbox!\"] });\nconst output = await child.output();\n\nconsole.log(new TextDecoder().decode(output.stdout));\n\u002F\u002F Output: Hello from sandbox!\n```\n\n## Core Concepts\n\n### Sandbox Lifecycle\n\nSandboxes are resources that must be disposed when done. **Always** use `await using` for automatic cleanup:\n\n```typescript\nawait using sandbox = await Sandbox.create();\n\u002F\u002F Sandbox is automatically destroyed when this scope ends\n```\n\nCRITICAL: Never show `const sandbox = await Sandbox.create()` without `await using`. Always use the `await using` pattern for sandbox creation. Do not show manual disposal alternatives.\n\n### Running Processes\n\nThe `spawn` method runs commands inside the sandbox:\n\n```typescript\nconst child = await sandbox.spawn(\"deno\", {\n  args: [\"run\", \"script.ts\"],\n  stdin: \"piped\", \u002F\u002F Enable stdin\n  stdout: \"piped\", \u002F\u002F Capture stdout\n  stderr: \"piped\" \u002F\u002F Capture stderr\n});\n\n\u002F\u002F Wait for completion and get output\nconst output = await child.output();\nconsole.log(\"Exit code:\", output.code);\nconsole.log(\"Stdout:\", new TextDecoder().decode(output.stdout));\nconsole.log(\"Stderr:\", new TextDecoder().decode(output.stderr));\n```\n\n### Streaming I\u002FO\n\nFor interactive processes or long-running commands:\n\n```typescript\nconst child = await sandbox.spawn(\"deno\", {\n  args: [\"repl\"],\n  stdin: \"piped\",\n  stdout: \"piped\"\n});\n\n\u002F\u002F Write to stdin\nconst writer = child.stdin!.getWriter();\nawait writer.write(new TextEncoder().encode(\"console.log('Hello')\\n\"));\nawait writer.close();\n\n\u002F\u002F Read from stdout\nconst reader = child.stdout!.getReader();\nwhile (true) {\n  const { done, value } = await reader.read();\n  if (done) break;\n  console.log(new TextDecoder().decode(value));\n}\n```\n\n### Killing Processes\n\n```typescript\nconst child = await sandbox.spawn(\"sleep\", { args: [\"60\"] });\n\n\u002F\u002F Kill with SIGTERM (default)\nawait child.kill();\n\n\u002F\u002F Or with specific signal\nawait child.kill(\"SIGKILL\");\n\n\u002F\u002F Wait for exit\nconst status = await child.status;\nconsole.log(\"Exited with signal:\", status.signal);\n```\n\n## Common Patterns\n\n### Running User Code Safely\n\n```typescript\nimport { Sandbox } from \"@deno\u002Fsandbox\";\n\nasync function runUserCode(code: string): Promise\u003Cstring> {\n  await using sandbox = await Sandbox.create();\n\n  \u002F\u002F Write user code to a file in the sandbox\n  await sandbox.fs.writeFile(\"\u002Ftmp\u002Fuser_code.ts\", code);\n\n  \u002F\u002F Run with restricted permissions\n  const child = await sandbox.spawn(\"deno\", {\n    args: [\n      \"run\",\n      \"--allow-none\", \u002F\u002F No permissions\n      \"\u002Ftmp\u002Fuser_code.ts\"\n    ],\n    stdout: \"piped\",\n    stderr: \"piped\"\n  });\n\n  const output = await child.output();\n\n  if (output.code !== 0) {\n    throw new Error(new TextDecoder().decode(output.stderr));\n  }\n\n  return new TextDecoder().decode(output.stdout);\n}\n```\n\n### Code Playground\n\n```typescript\nimport { Sandbox } from \"@deno\u002Fsandbox\";\n\ninterface ExecutionResult {\n  success: boolean;\n  output: string;\n  error?: string;\n  executionTime: number;\n}\n\nasync function executePlayground(code: string): Promise\u003CExecutionResult> {\n  const start = performance.now();\n\n  await using sandbox = await Sandbox.create();\n\n  await sandbox.fs.writeFile(\"\u002Fplayground\u002Fmain.ts\", code);\n\n  const child = await sandbox.spawn(\"deno\", {\n    args: [\"run\", \"--allow-net\", \"\u002Fplayground\u002Fmain.ts\"],\n    stdout: \"piped\",\n    stderr: \"piped\"\n  });\n\n  const output = await child.output();\n  const executionTime = performance.now() - start;\n\n  return {\n    success: output.code === 0,\n    output: new TextDecoder().decode(output.stdout),\n    error: output.code !== 0 ? new TextDecoder().decode(output.stderr) : undefined,\n    executionTime\n  };\n}\n```\n\n### AI Agent Tool Execution\n\n```typescript\nimport { Sandbox } from \"@deno\u002Fsandbox\";\n\nasync function executeAgentTool(toolCode: string, input: unknown): Promise\u003Cunknown> {\n  await using sandbox = await Sandbox.create();\n\n  \u002F\u002F Create a wrapper that handles input\u002Foutput\n  const wrapper = `\n    const input = ${JSON.stringify(input)};\n    const tool = await import(\"\u002Ftool.ts\");\n    const result = await tool.default(input);\n    console.log(JSON.stringify(result));\n  `;\n\n  await sandbox.fs.writeFile(\"\u002Ftool.ts\", toolCode);\n  await sandbox.fs.writeFile(\"\u002Frun.ts\", wrapper);\n\n  const child = await sandbox.spawn(\"deno\", {\n    args: [\"run\", \"--allow-net\", \"\u002Frun.ts\"],\n    stdout: \"piped\",\n    stderr: \"piped\"\n  });\n\n  const output = await child.output();\n\n  if (output.code !== 0) {\n    throw new Error(new TextDecoder().decode(output.stderr));\n  }\n\n  return JSON.parse(new TextDecoder().decode(output.stdout));\n}\n```\n\n## Sandbox Features\n\n### Resource Configuration\n\nSandboxes have configurable resources:\n\n- **Default:** 2 vCPUs, 512MB memory, 10GB disk\n- Startup time: Under 200ms\n\n### What's Included\n\nEach sandbox comes with:\n\n- TypeScript\u002FJavaScript runtime (Deno)\n- Full Linux environment\n- Network access (can be restricted)\n- Temporary filesystem\n\n### Security Features\n\n- **Firecracker microVMs** - Same technology as AWS Lambda\n- **Full isolation** - Separate kernel, filesystem, network\n- **No data leakage** - Sandboxes can't access host system\n- **Enforced policies** - Control outbound connections\n\n## Deploying Sandboxes\n\nSandboxes can be deployed directly to Deno Deploy:\n\n```bash\ndeno deploy --prod\n```\n\nThe sandbox SDK works seamlessly in the Deno Deploy environment.\n\n## API Reference\n\nFor the complete API, run:\n\n```bash\ndeno doc jsr:@deno\u002Fsandbox\n```\n\nKey classes:\n\n- `Sandbox` - Main class for creating\u002Fmanaging sandboxes\n- `ChildProcess` - Represents a running process\n- `Client` - For managing Deploy resources (apps, volumes)\n\n## Quick Reference\n\n| Task           | Code                                           |\n| -------------- | ---------------------------------------------- |\n| Create sandbox | `await using sandbox = await Sandbox.create()` |\n| Run command    | `sandbox.spawn(\"cmd\", { args: [...] })`        |\n| Get output     | `const output = await child.output()`          |\n| Write file     | `await sandbox.fs.writeFile(path, content)`    |\n| Read file      | `await sandbox.fs.readFile(path)`              |\n| Kill process   | `await child.kill()`                           |\n| Check status   | `const status = await child.status`            |\n\n## Common Mistakes\n\n**Forgetting automatic disposal**\n\n```typescript\n\u002F\u002F ❌ Wrong - always use \"await using\" for sandbox creation\n\u002F\u002F Never write: const sandbox = await Sandbox.create() without \"await using\"\n\n\u002F\u002F ✅ Correct - use \"await using\" for automatic cleanup\nawait using sandbox = await Sandbox.create();\nawait sandbox.spawn(\"echo\", { args: [\"hello\"] });\n\u002F\u002F sandbox automatically disposed when scope ends\n```\n\n**Giving user code too many permissions**\n\n```typescript\n\u002F\u002F ❌ Wrong - gives untrusted code full access\nconst child = await sandbox.spawn(\"deno\", {\n  args: [\"run\", \"--allow-all\", \"\u002Ftmp\u002Fuser_code.ts\"]\n});\n\n\u002F\u002F ✅ Correct - restrict permissions to what's needed\nconst child = await sandbox.spawn(\"deno\", {\n  args: [\"run\", \"--allow-none\", \"\u002Ftmp\u002Fuser_code.ts\"] \u002F\u002F No permissions\n});\n\n\u002F\u002F Or if network is truly needed:\nconst child = await sandbox.spawn(\"deno\", {\n  args: [\"run\", \"--allow-net\", \"\u002Ftmp\u002Fuser_code.ts\"] \u002F\u002F Only network\n});\n```\n\n**Not handling process output properly**\n\n```typescript\n\u002F\u002F ❌ Wrong - forgetting to pipe stdout\u002Fstderr\nconst child = await sandbox.spawn(\"deno\", { args: [\"run\", \"script.ts\"] });\nconst output = await child.output();\n\u002F\u002F output.stdout is empty because we didn't pipe it!\n\n\u002F\u002F ✅ Correct - pipe the streams you need\nconst child = await sandbox.spawn(\"deno\", {\n  args: [\"run\", \"script.ts\"],\n  stdout: \"piped\",\n  stderr: \"piped\"\n});\nconst output = await child.output();\nconsole.log(new TextDecoder().decode(output.stdout));\n```\n\n**Not setting timeouts for user code execution**\n\n```typescript\n\u002F\u002F ❌ Wrong - user code could run forever\nconst child = await sandbox.spawn(\"deno\", {\n  args: [\"run\", \"\u002Ftmp\u002Fuser_code.ts\"]\n});\nawait child.output(); \u002F\u002F Could hang indefinitely\n\n\u002F\u002F ✅ Correct - implement timeout handling\nconst child = await sandbox.spawn(\"deno\", {\n  args: [\"run\", \"\u002Ftmp\u002Fuser_code.ts\"],\n  stdout: \"piped\",\n  stderr: \"piped\"\n});\n\n\u002F\u002F Set a timeout to kill the process\nconst timeoutId = setTimeout(() => child.kill(), 5000); \u002F\u002F 5 second limit\n\ntry {\n  const output = await child.output();\n  return output;\n} finally {\n  clearTimeout(timeoutId);\n}\n```\n\n**Trusting sandbox output without validation**\n\n```typescript\n\u002F\u002F ❌ Wrong - directly using untrusted output as code\nconst result = await runUserCode(code);\n\u002F\u002F Never execute or inject untrusted output!\n\n\u002F\u002F ✅ Correct - validate and sanitize output\nconst result = await runUserCode(code);\ntry {\n  const parsed = JSON.parse(result); \u002F\u002F Parse as data, not code\n  if (isValidResponse(parsed)) {\n    return parsed;\n  }\n} catch {\n  throw new Error(\"Invalid response from sandbox\");\n}\n```\n",{"name":5,"license":15,"metadata":44,"description":7},{"author":45,"version":46},"denoland","1.1","master","c2e410e11df4d80d885e0ecf0583ef3c926df736",".ai\u002Fskills\u002Fofficial_denoland_deno_sandbox",0,"https:\u002F\u002Fgithub.com\u002FiDorgham\u002FWorkspace-Factory","https:\u002F\u002Fgithub.com\u002FiDorgham","Dorgham.me","hey I'm Dorgham \r\nI code, I create, and AI codes back. \r\nMaybe we can give AI the chance!! now we begin. 🚀🤖\r\n... . . . git commit -m \"Hello, Future\" ","2026-05-04 18:39:09",{"source":8,"skillName":5,"commands":57,"prompt":67,"zipAvailable":68},[58,61,64],{"tool":59,"command":60},"npx","npx skills add iDorgham\u002FWorkspace-Factory --skill deno-sandbox",{"tool":62,"command":63},"bunx","bunx skills add iDorgham\u002FWorkspace-Factory --skill deno-sandbox",{"tool":65,"command":66},"pnpm","pnpm dlx skills add iDorgham\u002FWorkspace-Factory --skill deno-sandbox","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FiDorgham\u002FWorkspace-Factory\u002Fblob\u002Fmaster\u002F.ai\u002Fskills\u002Fofficial_denoland_deno_sandbox\u002Fskill.md",true,[],[71,103,126,147,166,189],{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":75,"categories":76,"keywords":82,"publishedAt":102},"01M71P8WVBMB2X3D24R0YT0B0E","vercel-react-view-transitions","Guide for implementing smooth, native-feeling animations using React's View Transition API (`\u003CViewTransition>` component, `addTransitionType`, and CSS view transition pseudo-elements). Use this skill whenever the user wants to add page transitions, animate route changes, create shared element animations, animate enter\u002Fexit of components, animate list reorder, implement directional (forward\u002Fback) navigation animations, or integrate view transitions in Next.js. Also use when the user mentions view transitions, `startViewTransition`, `ViewTransition`, transition types, or asks about animating between UI states in React without third-party animation libraries.","https:\u002F\u002Fgithub.com\u002FiDorgham\u002FWorkspace-Factory\u002Fblob\u002Fmaster\u002Ffactory\u002Flibrary\u002Fskills\u002Fofficial_vercel_labs_react_view_transitions\u002Fskill.md",[77],{"categoryNo":78,"categoryName":79,"taxonomyType":80,"taxonomyTypeDesc":81},"01JBSEEDCAT000000000000009","前端开发","SCENARIO","使用场景",[83,84,85,86,87,88,89,90,91,92,93,94,95,96,38,97,98,99,100,101],"react","vercel react view transitions","view","react view transitions","vercel","transitions","shared","back","Animation","css","types","states","element","implementing","components","api","route","create","libraries","2026-11-10 13:02:02",{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":110,"publishedAt":102},"01M71P8TDGHZ289TSAC5VTG2EW","vercel-react-native-skills","React Native and Expo best practices for building performant mobile apps. Use when building React Native components, optimizing list performance, implementing animations, or working with native modules. Triggers on tasks involving React Native, Expo, mobile performance, or native platform APIs.","https:\u002F\u002Fgithub.com\u002FiDorgham\u002FWorkspace-Factory\u002Fblob\u002Fmaster\u002Ffactory\u002Flibrary\u002Fskills\u002Fofficial_vercel_labs_react_native_skills\u002Fskill.md",[109],{"categoryNo":78,"categoryName":79,"taxonomyType":80,"taxonomyTypeDesc":81},[83,111,112,87,113,114,115,116,96,117,38,118,97,119,120,121,122,123,124,125],"react native","native","vercel react native skills","react native skills","modules","performance","apps","tasks","mobile","expo","list","mobile performance","platform","animations","for",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":133,"publishedAt":102},"01M71P8QK4JF5BYRGYDDGPZQG9","vercel-react-best-practices","React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React\u002FNext.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.","https:\u002F\u002Fgithub.com\u002FiDorgham\u002FWorkspace-Factory\u002Fblob\u002Fmaster\u002Ffactory\u002Flibrary\u002Fskills\u002Fofficial_vercel_labs_react_best_practices\u002Fskill.md",[132],{"categoryNo":78,"categoryName":79,"taxonomyType":80,"taxonomyTypeDesc":81},[83,134,135,87,136,116,137,38,28,118,97,138,139,140,141,142,143,144,145,146],"react best practices","vercel react best practices","best practices","writing","data fetching","react components","next","refactoring","data","patterns","Optimization","guidelines","triggers",{"skillNo":148,"name":149,"nameZh":6,"description":150,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":151,"categories":152,"keywords":154,"publishedAt":102},"01M71P8HVEA70K5N6ZVJCG2ED3","vercel-composition-patterns","React composition patterns that scale. Use when refactoring components with boolean prop proliferation, building flexible component libraries, or designing reusable APIs. Triggers on tasks involving compound components, render props, context providers, or component architecture. Includes React 19 API changes.","https:\u002F\u002Fgithub.com\u002FiDorgham\u002FWorkspace-Factory\u002Fblob\u002Fmaster\u002Ffactory\u002Flibrary\u002Fskills\u002Fofficial_vercel_labs_composition_patterns\u002Fskill.md",[153],{"categoryNo":78,"categoryName":79,"taxonomyType":80,"taxonomyTypeDesc":81},[155,87,156,143,157,158,159,160,146,161,162,34,38,163,118,97,164,165,98,83],"Composition","composition patterns","vercel composition patterns","react composition patterns","react 19","render","boolean","component architecture","reusable","architecture","react composition",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":175,"publishedAt":102},"01M71P60XXKKP222ZFJRG7R373","supabase-postgres-best-practices","Postgres performance optimization and best practices from Supabase. Use this skill when writing, reviewing, or optimizing Postgres queries, schema designs, or database configurations.","https:\u002F\u002Fgithub.com\u002FiDorgham\u002FWorkspace-Factory\u002Fblob\u002Fmaster\u002Ffactory\u002Flibrary\u002Fskills\u002Fofficial_supabase_supabase_postgres_best_practices\u002Fskill.md",[172],{"categoryNo":173,"categoryName":174,"taxonomyType":80,"taxonomyTypeDesc":81},"01JBSEEDCAT000000000000010","后端与接口",[176,177,178,179,136,180,181,182,125,144,116,183,184,137,185,34,186,187,188,38],"postgres best practices","supabase","postgres","supabase postgres best practices","categories","postgres performance","advanced","correct","schema","impact","Rules","critical","database",{"skillNo":190,"name":191,"nameZh":6,"description":192,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":193,"categories":194,"keywords":196,"publishedAt":212},"01M71P2ZCEJD0PKC458YTP1FJW","portable-text-serialization","Render and serialize Portable Text to React, Svelte, Vue, Astro, HTML, Markdown, and plain text. Use when implementing Portable Text rendering in any frontend framework, building custom serializers for non-standard block types, converting Portable Text to HTML strings server-side, converting Portable Text to Markdown, extracting plain text from Portable Text, or troubleshooting rendering issues with marks, blocks, lists, or custom types.","https:\u002F\u002Fgithub.com\u002FiDorgham\u002FWorkspace-Factory\u002Fblob\u002Fmaster\u002Ffactory\u002Flibrary\u002Fskills\u002Fofficial_sanity_io_portable_text_serialization\u002Fskill.md",[195],{"categoryNo":78,"categoryName":79,"taxonomyType":80,"taxonomyTypeDesc":81},[197,198,199,200,201,93,202,160,203,96,204,205,38,83,206,207,208,209,210,211],"text","portable text serialization","portable","serialization","extracting","strings","issues","frontend","svelte","sanity","astro","server","markdown","rendering","vue","2026-11-10 10:56:23"]