The model cannot write and run its own code
It can call skill scripts that already exist on the server, choosing the script and its arguments, but it never authors a program.
The sandbox to run one (path jail, scrubbed environment, network isolation, resource limits) is already built and tested. The tool that would let a model use it is not.