ClawHub
Back to skill

Security audit

Lybic Sandbox

Security checks for vulnerabilities and agentic risk

Overview

This skill openly teaches agents to manage Lybic cloud sandboxes, including powerful actions that users should supervise carefully.

Install this only if you intend to let an agent operate Lybic cloud sandboxes with your account. Use a least-privileged API key, avoid hardcoding secrets, review commands before deleting projects or sandboxes, and treat HTTP port mappings as internet exposure. Prefer a pinned SDK version in a dedicated environment when possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:81
Finding

Unpinned Third-Party SDK Creates a Supply-Chain Risk

Content
View full analysis
Remediation
View remediation
" ``` 2. Publish a requirements or lock file containing cryptographic hashes and install with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Record the expected package index explicitly and prevent fallback to untrusted indexes where appropriate. 4. Review the pinned package and its transitive dependencies before updating the lock file. 5. Run the SDK in a dedicated virtual environment or container with only the credentials and filesystem access required for the requested task. 6. Scope Lybic API keys to the minimum necessary permissions and rotate them if dependency compromise is suspected. 7. Keep the installation command consistent across `SKILL.md`, `README.md`, and `examples/README.md`. ]]>

T09 · Insecure Skill Coding Practices

Note
Location
examples/06_http_port_mapping.py:15
Finding

User-Supplied Sandbox Identifier Is Embedded in a Shell Here-Document

Content
View full analysis
/tmp/index.html << 'EOF' Lybic Sandbox Server

🎉 Hello from Lybic Sandbox!

Sandbox ID: {sandbox_id}

EOF """ # Create the HTML file result = await client.sandbox.execute_process( sandbox_id, executable="sh", args=["-c", html_code] ) ``` ### Technical Analysis The value of `sandbox_id` originates from interactive input and is interpolated into a string that is passed to `sh -c`. The quoted here-document marker (`<< 'EOF'`) prevents ordinary shell expansion inside the HTML body, but it does not protect against a value containing newline characters and a forged `EOF` terminator. For example, a structurally malicious value could terminate the here-document and append shell commands before starting another valid shell construct. The prior call to `client.sandbox.get(sandbox_id)` significantly limits practical exploitation because the supplied identifier must be accepted by the Lybic API. If the service strictly restricts sandbox identifiers to a safe pattern such as `SBX-` followed by alphanumeric characters, the injection path is not reachable. The example does not enforce or document that constraint locally, however, and therefore r ...[truncated 1505 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown quick reference includes deletion operations for sandboxes without any accompanying warning about data loss, cleanup impact, or irreversibility. Under the markdown-file criteria, descriptions that omit warnings about actions affecting user data or system state should be flagged.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documentation demonstrates creating a public HTTP port mapping and printing a public URL without warning that this exposes a service on the internet. In a sandbox/agent-execution skill, this is more dangerous because users may run ad hoc web apps, admin panels, or debug servers that bind to localhost and incorrectly assume they remain private once mapped.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The markdown includes a project deletion example with no cautionary text about permanent removal or organizational impact. This omission is relevant because the action may affect stored resources and user data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README documents highly capable remote sandbox control features including GUI automation, arbitrary code execution, file transfer, and public port forwarding, but provides no safety guidance, authorization boundaries, or warnings about destructive or externally exposed actions. In an agent skill context, this omission increases the risk that downstream users or autonomous agents will use the capability unsafely, leading to accidental system changes, data exfiltration, or unintended internet exposure.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill describes capabilities that can read and manipulate files, execute code, and perform remote operations, but it does not declare any explicit tool scope or permissions boundary. In an agent ecosystem, missing scope declarations can cause overbroad access or make it harder for the host to enforce least privilege, increasing the risk of unintended local file access or unsafe execution paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill explicitly promotes downloading files from URLs, forwarding ports to public URLs, and enabling external access, but it provides no user-facing warning about data exposure, privacy, or the risks of exposing services externally. In a skill that controls cloud sandboxes and GUI automation, this context makes the omission more dangerous because it can facilitate exfiltration, remote exposure of internal services, or unsafe handling of untrusted content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code performs real device interactions including tap, swipe, text entry, and navigation actions on the connected Android sandbox. Although it logs each step, it does not warn the user that these actions may alter application state, submit input, or affect data within apps, which is relevant safety disclosure for automation code.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · examples/06_http_port_mapping.py (reported line 133)May include surrounding context.

python
print(f"❌ Error deleting mapping: {e}")
        else:
            print("\n💡 Mapping kept active. You can delete it later or it will be")
            print("   automatically removed when the sandbox is deleted.")


if __name__ == '__main__':

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The example configuration sets endpoint="https://api.lybic.cn", which imposes a specific regional endpoint in the natural-language documentation without offering user choice or explaining that the skill is region-specific. This can violate the language/locale policy criterion when a locale constraint is forced implicitly rather than presented as an opt-in or documented requirement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill instructs users to provide organization ID and API key values, including an example of manually passing credentials in code, but it does not warn against hardcoding, logging, or otherwise mishandling secrets. Because this skill enables control over cloud sandboxes and potentially external network exposure, leaked credentials could permit unauthorized sandbox creation, access, or misuse of the associated account.

Content

No source excerpt is available for this finding.