You are specifically allowing the iframe to communicate with the parent window by specifying allow-same-origin in the sandbox attribute. Isolating code is a solved problem if you use a separate domain and allow the browser's cross domain policies to do their job.

Calling this Sandbox.js is pretty irresponsible. The term is well defined and well understood. You can't just use the name because it sounds nice.

If you take the output, put that into a file on a different (sub-)domain and request it as iframe src from there, you can use the Cross-Origin-Policy to your advantage und have window.parent only respond to window.postMessage(), not direct manipulation. This will secure your parent, but will still allow for phishing inside the iframe.