Sandboxed Python Runner

Who the node is. The id is the key the DOT pins.

id

sandboxed-python-runner

name

Sandboxed Python Runner

type

shell-tool

phases

none declared

What it does, and the prose the agent is handed when the graph runs.

action18 words

Run the supplied script inside the sandbox and return what it printed, whatever that turns out to be.

spec122 words

Run the script you are given in the configured sandbox and capture its standard output, its standard error and its exit status. Emit all three on result, unchanged. Do not edit the script to make it run, do not install a package it imports, and do not retry it with a change of your own: a script that failed is a result, and repairing it here hides the failure from whichever node was meant to see it. The sandbox has no network and a working directory that does not survive the run; do not attempt to write outside it. Truncate nothing: if the output is large, emit it in full, because the node reading it decides what matters and you do not.in full above

model

whatever the graph supplies

agent

Runner

skill

not named

tools

Python sandbox

mcp

none

params

timeout_ms: 30000, tool_command: python3 -I -

What arrives, what leaves, which nodes it expects to hear from, and what may not.

inputs

script : code

outputs

result : json

dependencies

none

cannot

no type is refused

will_not

edit the script to make it run, install a package the script imports, retry a failed script with a change of its own

The keys the static analysis reads. Nothing here instructs the agent.

risk_markers

arbitrary-code-execution

notes50 words

A shell-tool, so params.tool_command is the command actually run and the node compiles to the runner's tool handler rather than to a prompted stage. The risk marker is the heaviest in the vocabulary and it is correct here: the script is decided at run time and not by the blueprint.

The card's own version, and who wrote it.

version

1.0.0

author

autogen

provenance

not stated