ClawHub
Back to skill

Security audit

Sandbox Manager

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real sandbox-management tool, but it handles powerful credentials and remote sandbox actions with broader persistence and weaker user controls than users should accept without review.

Install only if you trust the Baidu sandbox service, the custom pip index, and the publisher. Prefer setting secrets through a safer secret manager or tightly permissioned skill-specific file instead of ~/.env, avoid passing real API keys or COMATE tokens on the command line, review the configured E2B_DOMAIN before use, and confirm sandbox kill commands because they destroy sandbox state.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:51
Finding
Third-Party Packages Are Installed Without Cryptographic Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:51-54` and `scripts/create_sandbox.py:42-44` **Vulnerability Type**: Supply-chain exposure through dependencies installed from a custom package index without artifact hashes **Risk Level**: Medium ### Vulnerable Code From `SKILL.md:51-54`: ```bash pip3.9 install e2b==1.11.2+baidu --index=https://pip.baidu-int.com/simple/ pip3.9 install e2b-code-interpreter==1.5.2 --index=https://pip.baidu-int.com/simple/ pip3.9 install load_dotenv==0.1.0 --index=https://pip.baidu-int.com/simple/ ``` The same installation instructions are emitted by `scripts/create_sandbox.py:42-44`: ```python print("pip3.9 install e2b==1.11.2+baidu --index=https://pip.baidu-int.com/simple/") print("pip3.9 install e2b-code-interpreter==1.5.2 --index=https://pip.baidu-int.com/simple/") print("pip3.9 install load_dotenv==0.1.0 --index=https://pip.baidu-int.com/simple/") ``` ### Technical Analysis The dependency versions are pinned, but the package artifacts and their transitive dependencies are not protected with cryptographic hashes. Installation therefore relies entirely on the integrity of the configured custom package index, its DNS and TLS environment, and the continued integrity of every published artifact. Python packages can execute code during installation and whenever imported. These scripts subsequently import `dotenv` and `e2b_code_interpreter`, making compromise or substitution of either distribution a direct code-execution path. The distribution named `load_dotenv` also warrants explicit provenance verification because the imported module name is `dotenv`, which may otherwise be associated with differently named distributions. This finding does not establish that the referenced packages are currently malicious. It identifies the absence of controls that would prevent a compromised or incorrectly published artifact from being accepted. ### Attack Path 1. An attacker compromises the custom package index, a publis ...[truncated 961 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Provide a reviewed lock file containing exact versions for direct and transitive dependencies. 2. Record SHA-256 hashes for every permitted artifact and install with `pip --require-hashes`. 3. Verify the provenance and intended distribution name of the package that supplies the `dotenv` module. 4. Use a controlled package mirror with authenticated publishing, immutable artifacts, audit logging, and malware scanning. 5. Install dependencies in an isolated virtual environment under a nonprivileged account. 6. Add automated dependency provenance and vulnerability checks to the release process. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/configure.py:15
Finding
Sandbox API Key Is Stored Without Enforced Restrictive File Permissions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/configure.py:15-37` **Vulnerability Type**: Insecure plaintext credential storage and unsafe file replacement **Risk Level**: Medium ### Vulnerable Code ```python env_path = os.path.expanduser('~/.env') # Read existing configuration existing = {} if os.path.exists(env_path): with open(env_path, 'r') as f: for line in f: line = line.strip() if line and not line.startswith('#') and '=' in line: key, value = line.split('=', 1) existing[key.strip()] = value.strip() # Update configuration existing['E2B_API_KEY'] = api_key existing['E2B_DOMAIN'] = domain # Write file with open(env_path, 'w') as f: f.write(f"E2B_API_KEY={api_key}\n") f.write(f"E2B_DOMAIN={domain}\n") # Write other configuration for key, value in existing.items(): if key not in ['E2B_API_KEY', 'E2B_DOMAIN']: f.write(f"{key}={value}\n") ``` ### Technical Analysis The API key is written in plaintext to `~/.env`, but the code does not create the file with an explicit restrictive mode such as `0600` and does not repair the permissions of an existing file. Effective access therefore depends on the current umask and any pre-existing file permissions. The code also checks and opens the path normally, without rejecting symbolic links and without using an atomic, no-follow replacement. If an attacker with access to the same environment can prepare `~/.env` as a symbolic link, the script follows that link and truncates the linked user-writable target. The file also preserves unrelated values from the existing general-purpose `.env`, increasing the amount of configuration data processed and rewritten by a credential-management operation. ### Attack Path Credential-disclosure path: 1. The user runs the configuration script with a permissive umask or already has a broadly readable `~/.env`. 2. The script writes the E2B API key without appl ...[truncated 1186 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Store the API key in an operating-system credential manager or dedicated secret store where available. 2. If a file is required, use a dedicated configuration path rather than a general-purpose `~/.env`. 3. Reject symbolic links with `os.lstat()` and open files using no-follow semantics where supported. 4. Write to a securely created temporary file in the same directory, set its mode to `0600`, flush and synchronize it, and atomically replace the destination. 5. Explicitly enforce `0600` after replacement and verify that the resulting file is owned by the current user. 6. Avoid parsing and rewriting unrelated secrets from an existing general-purpose environment file. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/configure.py:45
Finding
Authentication Secrets Are Accepted Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/configure.py:45-53`, `scripts/create_sandbox.py:171-174`, and `README.md:9` **Vulnerability Type**: Sensitive credential exposure through process arguments, shell history, and logs **Risk Level**: Medium ### Vulnerable Code From `scripts/configure.py:45-53`: ```python if __name__ == '__main__': import argparse parser = argparse.ArgumentParser(description='Configure sandbox API Key') parser.add_argument('api_key', help='API Key') parser.add_argument('--domain', '-d', default='agent-sandbox.baidu-int.com', help='Sandbox domain') args = parser.parse_args() configure_api_key(args.api_key, args.domain) ``` From `scripts/create_sandbox.py:171-174`: ```python parser.add_argument( '--comate-token', help='Comate authentication Token (for iCode permission injection)' ) ``` The README explicitly recommends the affected pattern at `README.md:9`: ```bash python3.9 scripts/configure.py <your_api_key> ``` The configuration script also emits a key prefix at `scripts/configure.py:38-40`: ```python print(f"✅ API Key saved to: {env_path}") print(f" API Key: {api_key[:10]}...") print(f" Domain: {domain}") ``` ### Technical Analysis Command-line arguments are not an appropriate transport for long-lived authentication secrets. Depending on the operating system and local security configuration, process arguments may be visible to other users through process inspection. They are also commonly retained in shell history, terminal capture, audit systems, endpoint telemetry, job logs, and support transcripts. The Comate token is subsequently injected into the remote sandbox as `COMATE_AUTH_TOKEN`. Although that behavior is documented, accepting the token through `--comate-token` exposes it locally before the sandbox is created. Printing the first ten characters of the API key does not reveal the complete secret, but it unnecessarily discloses stable key material in logs and ca ...[truncated 1103 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Read interactive secrets using `getpass.getpass()` so they are not echoed or placed in process arguments. 2. For automation, accept secrets through a protected file descriptor, operating-system credential store, or secret-manager integration. 3. If environment variables must be supported, document their local exposure limitations and avoid inheriting them into unrelated child processes. 4. Remove all key-prefix output; report only whether a credential is configured. 5. Update the README so examples never place real secrets in command-line arguments. 6. Add token rotation and immediate revocation guidance for users who have already used the command-line interface. ]]>

T09 · Insecure Skill Coding Practices

Note
Location
scripts/configure.py:9
Finding
Unrestricted API Domain Configuration Can Redirect Authenticated SDK Traffic<![CDATA[ ## Vulnerability Details **File Location**: `scripts/configure.py:9-40` and `scripts/configure.py:49-53` **Vulnerability Type**: Unvalidated service-endpoint configuration **Risk Level**: Low ### Vulnerable Code ```python def configure_api_key(api_key, domain="agent-sandbox.baidu-int.com"): """ Configure sandbox API Key Args: api_key: API Key domain: Sandbox domain """ env_path = os.path.expanduser('~/.env') # Read existing configuration existing = {} if os.path.exists(env_path): with open(env_path, 'r') as f: for line in f: line = line.strip() if line and not line.startswith('#') and '=' in line: key, value = line.split('=', 1) existing[key.strip()] = value.strip() # Update configuration existing['E2B_API_KEY'] = api_key existing['E2B_DOMAIN'] = domain # Write file with open(env_path, 'w') as f: f.write(f"E2B_API_KEY={api_key}\n") f.write(f"E2B_DOMAIN={domain}\n") # Write other configuration for key, value in existing.items(): if key not in ['E2B_API_KEY', 'E2B_DOMAIN']: f.write(f"{key}={value}\n") print(f"✅ API Key saved to: {env_path}") print(f" API Key: {api_key[:10]}...") print(f" Domain: {domain}") ``` The unrestricted value is exposed through the command-line interface: ```python parser.add_argument('--domain', '-d', default='agent-sandbox.baidu-int.com', help='Sandbox domain') args = parser.parse_args() configure_api_key(args.api_key, args.domain) ``` ### Technical Analysis The script permits any string to be stored as `E2B_DOMAIN` alongside the genuine API key. No allowlist, hostname validation, scheme restriction, or confirmation is applied. The project subsequently loads `E2B_DOMAIN` and uses the E2B SDK for authenticated operations. Based on the configuration's declared purpose, the domain cont ...[truncated 1443 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove custom endpoint support unless it is operationally required. 2. If multiple endpoints are necessary, enforce an explicit allowlist of trusted fully qualified domain names. 3. Normalize and validate the endpoint before storage, require HTTPS, and reject embedded credentials, paths, query strings, fragments, and unexpected ports. 4. Display a prominent confirmation before changing away from the production endpoint. 5. Store endpoint configuration separately from credentials so an imported configuration cannot silently redirect a genuine key. 6. Confirm that the downstream SDK validates TLS certificates and never forwards credentials across redirects to a different origin. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (18)

Credential Access

High
Category
Privilege Escalation
Content
# 方式一: 通过脚本配置
python3.9 scripts/configure.py <your_api_key>

# 方式二: 手动写入 ~/.env
echo "E2B_API_KEY=<your_api_key>" > ~/.env
echo "E2B_DOMAIN=agent-sandbox.baidu-int.com" >> ~/.env
```
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
# 方式一: 通过脚本配置
python3.9 scripts/configure.py <your_api_key>

# 方式二: 手动写入 ~/.env
echo "E2B_API_KEY=<your_api_key>" > ~/.env
echo "E2B_DOMAIN=agent-sandbox.baidu-int.com" >> ~/.env
```
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
# 方式一: 通过脚本配置
python3.9 scripts/configure.py <your_api_key>

# 方式二: 手动写入 ~/.env
echo "E2B_API_KEY=<your_api_key>" > ~/.env
echo "E2B_DOMAIN=agent-sandbox.baidu-int.com" >> ~/.env
```
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
**配置 API Key**:
```bash
# Agent 会自动将 API Key 写入 ~/.env 文件
# 格式如下:
E2B_API_KEY=<your_api_key>
E2B_DOMAIN=agent-sandbox.baidu-int.com
Confidence
98% confidence
Finding
Writing an API key to ~/.env is a credential-handling weakness because .env files are commonly read by many tools and may have overly broad visibility. In this skill's context, the key grants access to remote sandbox resources, so compromise could enable unauthorized sandbox creation, access to exposed services, or abuse of associated billing and internal integrations.

Credential Access

High
Category
Privilege Escalation
Content
api_key: API Key
        domain: 沙箱域名
    """
    env_path = os.path.expanduser('~/.env')

    # 读取现有配置
    existing = {}
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
api_key: API Key
        domain: 沙箱域名
    """
    env_path = os.path.expanduser('~/.env')

    # 读取现有配置
    existing = {}
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
api_key: API Key
        domain: 沙箱域名
    """
    env_path = os.path.expanduser('~/.env')

    # 读取现有配置
    existing = {}
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
print("\n请按以下步骤配置:")
        print("1. 访问 https://console.cloud.baidu-int.com/aitools/sandbox-square")
        print("2. 进入空间后点击『沙箱』→『API Key 管理』")
        print("3. 获取 API Key 后,让 Agent 帮你配置到 ~/.env 文件")
        return False

    print(f"✅ API Key 已配置: {api_key[:10]}...")
Confidence
82% confidence
Finding
The script instructs the user to let an Agent configure the API key into ~/.env, which can normalize handing secret-management actions to an automated agent with broad local file access. In an agentic environment, this increases the chance of credential exposure, accidental overwrite of existing secrets, or unsafe storage of high-value tokens in plaintext home-directory files.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The markdown documents executing arbitrary commands in a sandbox and killing a sandbox instance, both of which can affect data or system state. Although later notes mention data loss after sandbox destruction, there is no direct warning near these commands about command risk or confirmation before destructive deletion.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill exposes capabilities that can read environment variables and read/write local files, yet it declares no explicit tool scope or permission boundary. In an agent setting, this increases the chance the skill is invoked with broader access than users expect, enabling unintended access to local secrets or filesystem contents.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger list includes broad terms like 'sandbox' and 'aio', which can cause accidental invocation for unrelated user requests. Misrouting to this skill is risky because the skill can install packages, create remote sandbox instances, and manipulate local credential files, so even benign overmatching can lead to unnecessary privileged actions.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill states that the agent will automatically write the API key into ~/.env, but it does not clearly warn about the security implications of storing credentials in a general-purpose local file. This can expose secrets to other tools, processes, users, backups, or future agent runs that read the same file.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
This script writes API credentials into the user's global ~/.env file, which affects unrelated tools and sessions outside the sandbox-manager skill. Modifying a global environment file for a narrowly scoped sandbox configuration increases the blast radius of mistakes, can overwrite existing values, and may expose credentials to other processes that source ~/.env.

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
The file’s natural-language interface, help text, and user-facing output are entirely in Chinese, beginning with the module description on these lines. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The `kill_sandbox` function unconditionally destroys the target sandbox by calling `sbx.kill()` after only printing a progress message. Because this is an irreversible operation affecting sandbox state, the script should provide a clear warning or confirmation prompt before proceeding.

Natural-Language Policy Violations

Low
Confidence
91% confidence
Finding
The instructions say to speak to the agent using Chinese example phrases only, and the document overall is written as if Chinese is the required interaction language. There is no indication that other languages are supported or that Chinese is optional, which can violate language/locale choice policy.

Natural-Language Policy Violations

Low
Confidence
94% confidence
Finding
The user-facing docstrings, argument descriptions, and CLI description are written only in Chinese, which imposes a specific language on users without offering a language choice or documenting a justified locale constraint. This matches the policy category for language or locale restrictions in natural-language content.

Natural-Language Policy Violations

Low
Confidence
92% confidence
Finding
The file’s docstrings, CLI description, help text, and runtime messages are written in Chinese, which imposes a specific language on users without any opt-in or stated regional constraint. This matches the language/locale policy concern for natural-language behavior embedded in code.

Static analysis

No suspicious patterns detected.