ClawHub
Back to skill

Security audit

Cloudsway ScaleBox Sandbox

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward guide for using ScaleBox cloud sandboxes, with expected API calls and credential use for that service.

Install only if you intend to use ScaleBox and are comfortable giving the agent access to a ScaleBox API key. Use a limited, revocable key, verify the CLI source, prefer a pinned SDK version, and upload only files you intentionally want processed in the cloud sandbox.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:224
Finding

Unpinned Third-Party SDK Installation Creates Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 224-228
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

markdown
### 3.1 Installation

```bash
pip install scalebox-sdk
text

### Technical Analysis

The Skill instructs users to install `scalebox-sdk` from the default Python package index without specifying an exact version, validating package hashes, or requiring a trusted package source. Although the document later mentions SDK version `0.1.9`, the installation command does not enforce that version.

Consequently, the installed package and its transitive dependencies may change after the Skill has been reviewed. If the package publisher account, package repository, release process, or a transitive dependency is compromised, following this instruction could install attacker-controlled code. Malicious package code may execute through installation-time build hooks or when the package is subsequently imported by the documented Python workflow.

### Attack Path

1. An attacker compromises the `scalebox-sdk` publishing account, distribution channel, or one of its unpinned transitive dependencies.
2. The attacker publishes a malicious release that remains compatible with the unrestricted package name.
3. A user follows the documented `pip install scalebox-sdk` command.
4. The package manager resolves and installs the attacker-controlled release.
5. Malicious code executes during a source build or when the documented `import scalebox` statement is run.
6. The code accesses resources available to the installing user, potentially including the configured `SCALEBOX_API_KEY`, local files, and network connectivity.

### Impact Assessment

Exploitation could result in arbitrary code execution with the privileges of the user running `pip` or the Python program. The accessible scope may include local user files, environment variables, development cre
...[truncated 189 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the reviewed SDK release explicitly:
    bash
    python -m pip install "scalebox-sdk==0.1.9"
  • Verify that the pinned version is still the intended trusted release before publishing the instruction.
  • Distribute a constraints or requirements file containing cryptographic hashes and install with hash enforcement:
    bash
    python -m pip install --require-hashes -r requirements.txt
  • Pin and hash all transitive dependencies rather than only the top-level SDK.
  • Direct users to a verified official package source and document how to validate package provenance or signatures when available.
  • Recommend installation inside a dedicated virtual environment using a non-privileged account.
  • Avoid exposing production credentials during dependency installation. Set SCALEBOX_API_KEY only when the verified SDK is executed, and use a narrowly scoped, revocable key.
  • Add automated dependency scanning and periodic integrity review for the pinned SDK and its dependency tree.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

Use API to specify custom_ports when creating the sandbox:

bash
curl -X POST "https://api.scalebox.dev/v1/sandboxes" \
  -H "X-API-Key: $SCALEBOX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

Use API to specify custom_ports when creating the sandbox:

bash
curl -X POST "https://api.scalebox.dev/v1/sandboxes" \
  -H "X-API-Key: $SCALEBOX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

Use API to specify custom_ports when creating the sandbox:

bash
curl -X POST "https://api.scalebox.dev/v1/sandboxes" \
  -H "X-API-Key: $SCALEBOX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

Use API to specify custom_ports when creating the sandbox:

bash
curl -X POST "https://api.scalebox.dev/v1/sandboxes" \
  -H "X-API-Key: $SCALEBOX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

Use API to specify custom_ports when creating the sandbox:

bash
curl -X POST "https://api.scalebox.dev/v1/sandboxes" \
  -H "X-API-Key: $SCALEBOX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

bash
# Create sandbox
curl -X POST "https://api.scalebox.dev/v1/sandboxes" \
  -H "X-API-Key: $SCALEBOX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"template": "base", "name": "my-sandbox", "timeout": 600}'

Static analysis

No suspicious patterns detected.