Security audit

E2B Desktop

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate E2B desktop-control purpose, but its shell wrappers can execute injected local Python code and its VNC streaming is unauthenticated by default.

Review before installing. Use this only in an isolated environment, avoid passing untrusted or raw model-generated strings to the scripts, prefer authenticated streaming, avoid displaying secrets in the sandbox desktop, and pin/review the e2b-desktop dependency. The issues look like serious unsafe implementation choices, not artifact-backed deception or intentional exfiltration.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/run_command.sh:7
Finding: Local Python Code Injection Through Unsafe Heredoc Interpolation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/stream_start.sh:8
Finding: Unauthenticated VNC Desktop Streaming Enabled by Default
Content: View full analysis
&2; exit 1 ;; esac done ``` ```python require_auth = "$AUTH" == "true" desktop.stream.start(require_auth=require_auth) if require_auth: auth_key = desktop.stream.get_auth_key() url = desktop.stream.get_url(auth_key=auth_key) print(f"AUTH_KEY={auth_key}") else: url = desktop.stream.get_url() print(f"STREAM_URL={url}") ``` ### Technical Analysis The standalone streaming script initializes `AUTH` to false, so a normal invocation starts the VNC stream without password protection. The sandbox creation script also starts a stream without specifying an authentication requirement when `--stream` is selected. The resulting stream URL is printed to standard output. URLs commonly propagate into terminal logs, CI logs, agent transcripts, shell captures, and monitoring systems. If possession of the unauthenticated URL is sufficient to access the stream, leakage of that URL allows access without a separate credential. ### Attack Path 1. A user or agent starts a sandbox with `--stream`, or invokes `stream_start.sh` without `--auth`. 2. The SDK starts a stream without requiring authentication. 3. The script p ...[truncated 808 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:10
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/start_sandbox.sh:45
Finding: Sandbox State File Created Without Explicit Permission or Symlink Protections
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 80% confidence
Finding: The skill exposes meaningful capabilities around environment handling and persistent state (E2B_API_KEY, ~/.e2b_state) but does not declare any explicit tool scope or permission boundaries. In an agent setting, missing scope declarations can cause the skill to be invoked with broader-than-expected access, making misuse or accidental data handling harder to control and audit.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill is explicitly designed to capture screenshots and stream a live VNC view, which can expose any sensitive data displayed in the sandbox, including credentials, tokens, documents, or user activity. Without a clear warning or consent guidance, downstream users or agents may enable visual capture in contexts where on-screen data should not be recorded or shared.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documented run_command.sh interface allows arbitrary shell command execution inside the sandbox, which is inherently dangerous because it can download malware, exfiltrate data available in the sandbox, or pivot through any credentials or network access present there. Although command execution is central to the skill's purpose, the lack of an explicit warning or usage constraints makes accidental or unsafe use more likely in autonomous agent workflows.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 89% confidence
Finding: The script persists the sandbox identifier in a predictable file under ~/.e2b_state, creating session state that can be reused by other local processes or later invocations. In a computer-use skill that manages remote desktop sandboxes, this increases the chance of unintended sandbox reuse, cross-task state leakage, or unauthorized interaction if another process or user on the same host can read or overwrite that file.
Content: Scanner excerpt · scripts/start_sandbox.sh (reported line 2)May include surrounding context.
sh
#!/usr/bin/env bash # start_sandbox.sh - Create a new E2B Desktop sandbox # Usage: start_sandbox.sh [--resolution WxH] [--timeout SECS] [--stream] # # Outputs sandbox ID and optionally stream URL.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 90% confidence
Finding: The script starts with authentication disabled by default and only enables protection when the caller explicitly passes --auth. In a skill whose purpose is to expose and control a live desktop/VNC stream, this increases the chance that an operator or automation forgets to require auth, potentially exposing the sandbox session URL to unauthorized viewers or controllers depending on how the backend stream service is configured.
Content: Scanner excerpt · scripts/stream_start.sh (reported line 8)May include surrounding context.
sh
set -e AUTH=false while [[ $# -gt 0 ]]; do case "$1" in --auth) AUTH=true; shift ;;

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The script prints f"Waited {$MS}ms" inside Python, but $MS is shell-style syntax, not valid Python f-string interpolation. This contradicts the apparent intent of the surrounding code and comment, because the message implies it will report the waited duration even though it will instead print a literal or malformed value rather than the actual milliseconds.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.