Run agents in disposable microVM sandboxes with network allowlists and secret injection using Matchlock
Launch risky agent work inside disposable microVMs when you need stronger isolation, sealed egress, and host-side secret injection instead of direct host access.
npx skills add agentskillexchange/skills --skill run-agents-in-disposable-microvm-sandboxes-with-network-allowlists-and-secret-injection-using-matchlock
brew tap jingkaihe/essentials && brew install matchlock, then run matchlock diagnose and complete any required host setup before launching a sandboxed agent run.Use Matchlock when an agent must run code, install packages, and touch external APIs, but you do not want it operating directly on the host. The workflow is explicit: install Matchlock, verify host support, declare allowed hosts and secret mappings, run the agent inside a disposable microVM, and tear the environment down when the task is done.
What this skill actually does
The skill boundary is concrete and narrower than a generic VM or sandbox product listing. This is about microVM-based agent execution with network allowlisting and in-flight secret injection, not general virtualization, not a broad agent framework, and not a generic container runtime card.