Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only Cloudflare Sandbox SDK helper with expected sandbox lifecycle, file, command, and port-exposure guidance, and no hidden execution or persistence behavior.
Install this if you are working with Cloudflare Sandbox SDK or sandboxed code execution. Treat destroy(), deleteFile(), exec(), package installation, and exposed preview ports as powerful sandbox operations: use user- or session-scoped sandbox IDs and confirm destructive cleanup when preserving sandbox state matters.
The manifest description says to load this skill when "building AI code execution, code interpreters, CI/CD systems, interactive dev environments, or executing untrusted code," which spans several broad, common software tasks without clear boundaries or exclusion conditions. This makes invocation scope ambiguous and increases the chance the skill is selected for loosely related requests.
This markdown file describes sandbox.destroy() as immediately terminating and deleting all state, but provides no warning or cautionary note for users about irreversible data loss. The same reference style presents these operations as neutral API calls, which omits safety-critical disclosure expected for destructive behaviors in markdown documentation.
The file documents writeFile, mkdir, and deleteFile operations, including deletion, but does not include any warning that these calls change or remove filesystem contents. For markdown skill documentation, omission of warnings about behaviors affecting user data or system integrity is in scope for this rule.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
RUN npm install -g typescript
RUN apt-get update && apt-get install -y ffmpeg && rm -rf /var/lib/apt/lists/*
EXPOSE 8080 # Required for local dev port exposure
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
RUN npm install -g typescript
RUN apt-get update && apt-get install -y ffmpeg && rm -rf /var/lib/apt/lists/*
EXPOSE 8080 # Required for local dev port exposure
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
RUN npm install -g typescript
RUN apt-get update && apt-get install -y ffmpeg && rm -rf /var/lib/apt/lists/*
EXPOSE 8080 # Required for local dev port exposure
No suspicious patterns detected.