SkillLite
A lightweight Rust self-evolution engine with a built-in OS-level sandbox, zero dependencies, and fully local execution — so your agent improves without giving up safety.
Evidence shows a coherent three-layer defense: install-time scan, two-phase confirm, OS-native isolation (Seatbelt/bwrap/seccomp), process whitelist, and rlimits, so least_privilege and user_confirmation get 2; but Security Level 1 explicitly allows unsandboxed direct execution with no stated default or risk warning — deducted. data_flow_transparency stays at the architecture-diagram level with no data-flow documentation: 1. sensitive_data_handling is thin: claw migrate mentions optional secrets transfer with no redaction guidance: 1. dependency_security is supported by cargo-deny/cargo-audit in CI: 2, though actual dependency manifests are not in evidence. external_effects: an allow_network flag and skill add pulling from GitHub exist with insufficient network-side disclosure: 1. rollback is only asserted ('rollbackable') with no mechanism shown: 1. source_attribution: author email present but publisher unverified and copyright reads 'SkillLite Team' with a 2026 year: 1.
self_consistency: the narrative is coherent, but the README claims 'zero dependencies' while requirements.txt lists openai/mcp, and a stray test-edit comment (2026-02-26) remains in the file: 2. dependency_availability: PyPI publication, multi-platform CI builds and smoke tests: 2. failure_messages: SDK tests show structured error returns for missing binary and IPC exceptions: 2, though Rust-side source is not in evidence to confirm.
audience_and_scenarios: path-based entry points (sandbox/MCP, full stack, desktop) serve IDE users and framework integrators well: 3. capability_boundaries: three security levels and a platform support table are clear: 2. trigger_precision: SKILL.md metadata and entry-point auto-detection rules are explicit: 2. environment_fit: native on macOS/Linux, Windows only via WSL2 bridge, and sandbox primitives are not equivalent across platforms — deducted to 2.
information_architecture: bilingual docs tree and path navigation are good, but the README snapshot is truncated and the crate table incomplete: 2. install_notes: pip install, init, init-cursor, MCP wiring commands are complete: 3. naming_stability: skilllite/skilllite-sandbox are consistent, but a legacy SKILLBOX_USE_IPC compat variable remains: 2. examples_and_faq: tutorial table and code examples are rich; no FAQ: 2. known_limitations: only honest benchmark-methodology caveats; no systematic limitations doc: 1. license: full MIT text but vague 'SkillLite Team' copyright with 2026 year: 2. versioning_changelog: version 0.1.29 present, no CHANGELOG in evidence: 1. maintenance_responsibility: thorough CI, single author email, contributing guide referenced; bus factor of one: 2.
output_usability: SDK returns uniform JSON structures (success/exit_code/stdout) backed by tests: 2. marginal_value: the sandbox+self-evolution combination is genuinely differentiated; the standalone MCP binary lowers adoption barriers: 2. cost_benefit: detailed perf comparison and microbenchmarks, but all vendor self-measured — deducted for lack of third-party verification: 2.
claim_traceability: reproduction commands (security_vs.py, benchmark_runner.py, CI workflows) make claims traceable to scripts: 2, but the Rust sandbox core source is not in the evidence. cross_source_corroboration: the 20/20 security score and perf comparisons are all self-run; the LangChain catalog reference and external PR link cannot be confirmed from this repo: 1. fact_inference_separation: marketing phrases ('most secure', '3-5x faster') mix with measurement data, though some sections include honest methodology caveats (process RSS vs MicroVM PSS): 1.
- This is a static review; no sandbox or security tests were executed. The 20/20 security score and performance comparisons are vendor self-measurements, not independently verified.
- Security Level 1 permits fully unsandboxed direct execution; verify the default level and enforce Level 3 in production.
- The README claims 'zero dependencies' while the Python SDK requires openai and mcp, and requirements.txt contains a leftover test-edit comment, indicating repo hygiene issues.
- Publisher identity is unverified; the 'SkillLite Team' copyright with a 2026 year should be independently confirmed.
- Windows is supported only via WSL2 bridge, and Seatbelt/bwrap primitives are not equivalent across platforms — validate behavior on your target platform before production use.
- 'Rollbackable' is asserted only; no rollback mechanism details appear in evidence — review the implementation before relying on it.
What does this agent do, and when should you use it?
SkillLite is a self-evolving agent engine written in Rust, built from two welded layers: a self-evolution engine (feedback → reflect → evolve → verify) on top, and a full-chain security sandbox underneath. Prompts, memory, and skills may evolve, but they always run behind an immutable compiled core, and every evolved artifact must pass L3 security scanning plus OS-level isolation before execution. The sandbox uses OS-native mechanisms (Seatbelt / bubblewrap / seccomp) and scores 20/20 on the project's 20-item runtime security suite. The project ships as a single binary (full version ~6.2 MB, lightweight sandbox ~3.6 MB) claiming zero dependencies and fully local execution, with ~40 ms warm start and ~10 MB memory. It installs via pip (`pip install skilllite`), embeds into existing IDEs and agents as an MCP server for Cursor, Claude Desktop, or OpenCode, and is also callable through a Python SDK or CLI.
SkillLite reads skill directories containing SKILL.md, executes entry scripts in an OS-native sandbox (auto-detecting main.py / main.js / main.ts / main.sh), and returns JSON results. At install time it applies three defenses: static rule scanning, LLM-assisted analysis, and PyPI/OSV supply-chain audit; before execution it runs two-phase confirmation and hash integrity checks; at runtime it enforces a process-exec whitelist, filesystem/network/IPC lockdown, and rlimit-based CPU/memory/fork/file-size limits. The evolution engine (skilllite-evolution crate) collects feedback, reflects, produces new prompts/memory/skills, and gates them through quality checks and audit logs — the core binary never self-modifies. Users interact via skilllite chat, execute skills directly with run_skill(), start a stdio MCP server with skilllite mcp, or plug skills into LangGraph's create_react_agent through the langchain-skilllite adapter. Skills can be added from GitHub repos (skilllite add owner/repo), local directories, or ZIP packages, with migration support from OpenClaw-style layouts.
- A developer running untrusted agent skills inside Cursor or Claude Desktop gets an install-scanned, OS-isolated sandbox via
pip install skilllite[mcp]+skilllite mcp, without adopting a full framework - A team building multi-agent apps with LangChain/LangGraph mounts skills into create_react_agent using langchain-skilllite's SkillLiteToolkit with sandbox_level=3
- A solo user who wants an agent that measurably improves over time enables the evolution engine, knowing every evolved prompt, memory entry, and skill passes the same L3 scan and sandbox as manual installs
- Teams with an existing OpenClaw skill ecosystem migrate skills, SOUL/MEMORY Markdown, and optional .env keys using
skilllite claw migrate - A framework author who only needs a minimal local code-execution sandbox uses the standalone skilllite-sandbox binary (~3.6 MB) or embeds it as a Rust crate
- Privacy-sensitive or offline setups point base_url at a local Ollama instance for fully local operation
What are this agent's strengths and limitations?
- Full-chain defense is a genuine differentiator: install-time scan, pre-execution confirmation, and runtime OS isolation in one binary, where E2B, Docker, and Claude SRT mostly provide runtime isolation only
- Concrete, documented performance: 40 ms warm start, 492 ms cold start, ~10 MB RSS — an order of magnitude better than Docker (194 ms / ~100 MB) and SRT (596 ms / ~84 MB) per its benchmarks
- Modular delivery: skilllite-sandbox works standalone as a binary, MCP server, or Rust crate that any framework (LangChain, AutoGen, CrewAI) can adopt without the full stack
- Evolved artifacts are not security-exempt: prompts, memory, and skills go through the same L3 checks + sandbox as manual installs, with auditability and rollback
- Multiple entry points lower adoption cost: MCP for existing IDEs, Python SDK, CLI, and an optional desktop GUI, each with documented paths
- Runtime depends on a host Python interpreter: sandbox RSS (~10-11 MB) is dominated by the embedded Python process, so skill execution requires Python
- Windows support goes through a WSL2 Bridge rather than native, and the sandbox mechanisms (Seatbelt/bwrap/seccomp) are inherently macOS/Linux-only
- Benchmarks are self-reported on macOS ARM64 release builds; the README itself notes the no-Python launch benchmark is not directly comparable to MicroVM metrics, and cross-platform figures lack independent verification
- Security comparison scores (e.g., Docker 2/20) come from the project's own test scripts and may favor SkillLite's configuration over competitors' defaults
- LLM-assisted install scanning and the evolution engine require a configured LLM API (BASE_URL/API_KEY); fully offline use is limited to local providers like Ollama
- Skill dependencies are declared via the compatibility field instead of standard requirements.txt, adding format friction when migrating from other skill ecosystems (though OpenClaw migration commands exist)
How do you install or deploy this agent?
Recommended: pip install skilllite, then skilllite init (installs the sandbox binary, creates skills/, downloads skills) and verify with skilllite list. For MCP integration: pip install "skilllite[mcp]", then skilllite init and skilllite mcp, wiring the host with skilllite init-cursor or skilllite init-opencode. Zero-config start: skilllite quickstart (auto-detects LLM, sets up skills, launches chat). Building from source requires Rust via rustup; cargo install --path skilllite gives the full build, or cargo install --path skilllite --bin skilllite-sandbox --no-default-features --features sandbox_binary for sandbox+MCP only. Configure .env with BASE_URL, API_KEY, and MODEL (supports OpenAI, DeepSeek, Qwen, Moonshot, and local Ollama). Platforms: macOS, Linux, and Windows via WSL2 Bridge.
How do you use this agent?
Direct skill execution in Python: from skilllite import run_skill; result = run_skill('./skills/calculator', '{"operation": "add", "a": 15, "b": 27}'), with output in result['text']. Conversational agent: from skilllite import chat; result = chat('Calculate 15 * 27', skills_dir='skills'), or CLI skilllite chat. Skill management: skilllite add owner/repo from GitHub, skilllite run <dir> '<>' for direct execution, skilllite scan <dir> for security scanning, skilllite evolution status for evolution metrics. A custom skill is a directory with SKILL.md (metadata in frontmatter; dependencies declared in the compatibility field rather than requirements.txt). LangChain integration: pip install langchain-skilllite, then build tools via SkillLiteToolkit.from_directory('./skills', sandbox_level=3, confirmation_callback=...). Security levels: 1 = no sandbox, 2 = sandbox only, 3 = sandbox + static scan (high-severity issues require confirmation).
How does this agent compare with similar options?
The README positions SkillLite against several categories: vs agent frameworks (AutoGen, CrewAI, LangGraph) — orchestration but no built-in evolution or sandbox; vs sandbox tools (E2B, Docker, Claude SRT) — isolation but no intelligence layer; vs evolution platforms (OpenClaw Foundry, EvoAgentX) — evolution without security constraints on evolved artifacts. It also notes Claude Code Sandbox uses the same underlying sandbox tech (Seatbelt + bubblewrap). If you only need safe execution, E2B/Docker are more battle-tested; if you want evolution plus safety together, SkillLite is the focused option.
FAQ
Do I have to adopt the full SkillLite agent stack?
Which LLM providers are supported, and can it run fully offline?
Can evolution bypass the security checks?
Does it work on Windows?
Are the security comparison scores trustworthy?
cd benchmark && python3 security_vs.py), and the README acknowledges its no-Python launch benchmark is not directly comparable to MicroVM figures. Run the scripts yourself before committing.