Security audit

Sandbox Manager

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real sandbox-management tool, but it handles powerful credentials and remote sandbox actions with broader persistence and weaker user controls than users should accept without review.

Install only if you trust the Baidu sandbox service, the custom pip index, and the publisher. Prefer setting secrets through a safer secret manager or tightly permissioned skill-specific file instead of ~/.env, avoid passing real API keys or COMATE tokens on the command line, review the configured E2B_DOMAIN before use, and confirm sandbox kill commands because they destroy sandbox state.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:51
Finding: Third-Party Packages Are Installed Without Cryptographic Integrity Verification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/configure.py:15
Finding: Sandbox API Key Is Stored Without Enforced Restrictive File Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/configure.py:45
Finding: Authentication Secrets Are Accepted Through Command-Line Arguments
Content: View full analysis
``` The configuration script also emits a key prefix at `scripts/configure.py:38-40`: ```python print(f"✅ API Key saved to: {env_path}") print(f" API Key: {api_key[:10]}...") print(f" Domain: {domain}") ``` ### Technical Analysis Command-line arguments are not an appropriate transport for long-lived authentication secrets. Depending on the operating system and local security configuration, process arguments may be visible to other users through process inspection. They are also commonly retained in shell history, terminal capture, audit systems, endpoint telemetry, job logs, and support transcripts. The Comate token is subsequently injected into the remote sandbox as `COMATE_AUTH_TOKEN`. Although that behavior is documented, accepting the token through `--comate-token` exposes it locally before the sandbox is created. Printing the first ten characters of the API key does not reveal the complete secret, but it unnecessarily discloses stable key material in logs and ca ...[truncated 1103 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/configure.py:9
Finding: Unrestricted API Domain Configuration Can Redirect Authenticated SDK Traffic
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 13)May include surrounding context.
方式一: 通过脚本配置

python3.9 scripts/configure.py <your_api_key>

方式二: 手动写入 ~/.env

echo "E2B_API_KEY=<your_api_key>" > ~/.env echo "E2B_DOMAIN=agent-sandbox.baidu-int.com" >> ~/.env

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 14)May include surrounding context.
方式一: 通过脚本配置

python3.9 scripts/configure.py <your_api_key>

方式二: 手动写入 ~/.env

echo "E2B_API_KEY=<your_api_key>" > ~/.env echo "E2B_DOMAIN=agent-sandbox.baidu-int.com" >> ~/.env

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 15)May include surrounding context.
方式一: 通过脚本配置

python3.9 scripts/configure.py <your_api_key>

方式二: 手动写入 ~/.env

echo "E2B_API_KEY=<your_api_key>" > ~/.env echo "E2B_DOMAIN=agent-sandbox.baidu-int.com" >> ~/.env

text

Credential Access

High

Category: Privilege Escalation
Confidence: 98% confidence
Finding: Writing an API key to ~/.env is a credential-handling weakness because .env files are commonly read by many tools and may have overly broad visibility. In this skill's context, the key grants access to remote sandbox resources, so compromise could enable unauthorized sandbox creation, access to exposed services, or abuse of associated billing and internal integrations.
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
配置 API Key:

bash
# Agent 会自动将 API Key 写入 ~/.env 文件 # 格式如下: E2B_API_KEY=<your_api_key> E2B_DOMAIN=agent-sandbox.baidu-int.com

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/configure.py (reported line 17)May include surrounding context.
python
api_key: API Key domain: 沙箱域名 """ env_path = os.path.expanduser('~/.env') # 读取现有配置 existing = {}

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/create_sandbox.py (reported line 18)May include surrounding context.
python
api_key: API Key domain: 沙箱域名 """ env_path = os.path.expanduser('~/.env') # 读取现有配置 existing = {}

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/manage_sandbox.py (reported line 91)May include surrounding context.
python
api_key: API Key domain: 沙箱域名 """ env_path = os.path.expanduser('~/.env') # 读取现有配置 existing = {}

Credential Access

High

Category: Privilege Escalation
Confidence: 82% confidence
Finding: The script instructs the user to let an Agent configure the API key into ~/.env, which can normalize handing secret-management actions to an automated agent with broad local file access. In an agentic environment, this increases the chance of credential exposure, accidental overwrite of existing secrets, or unsafe storage of high-value tokens in plaintext home-directory files.
Content: Scanner excerpt · scripts/create_sandbox.py (reported line 28)May include surrounding context.
python
print("\n请按以下步骤配置:") print("1. 访问 https://console.cloud.baidu-int.com/aitools/sandbox-square") print("2. 进入空间后点击『沙箱』→『API Key 管理』") print("3. 获取 API Key 后,让 Agent 帮你配置到 ~/.env 文件") return False print(f"✅ API Key 已配置: {api_key[:10]}...")

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The markdown documents executing arbitrary commands in a sandbox and killing a sandbox instance, both of which can affect data or system state. Although later notes mention data loss after sandbox destruction, there is no direct warning near these commands about command risk or confirmation before destructive deletion.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill exposes capabilities that can read environment variables and read/write local files, yet it declares no explicit tool scope or permission boundary. In an agent setting, this increases the chance the skill is invoked with broader access than users expect, enabling unintended access to local secrets or filesystem contents.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger list includes broad terms like 'sandbox' and 'aio', which can cause accidental invocation for unrelated user requests. Misrouting to this skill is risky because the skill can install packages, create remote sandbox instances, and manipulate local credential files, so even benign overmatching can lead to unnecessary privileged actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill states that the agent will automatically write the API key into ~/.env, but it does not clearly warn about the security implications of storing credentials in a general-purpose local file. This can expose secrets to other tools, processes, users, backups, or future agent runs that read the same file.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This script writes API credentials into the user's global ~/.env file, which affects unrelated tools and sessions outside the sandbox-manager skill. Modifying a global environment file for a narrowly scoped sandbox configuration increases the blast radius of mistakes, can overwrite existing values, and may expose credentials to other processes that source ~/.env.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file’s natural-language interface, help text, and user-facing output are entirely in Chinese, beginning with the module description on these lines. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The kill_sandbox function unconditionally destroys the target sandbox by calling sbx.kill() after only printing a progress message. Because this is an irreversible operation affecting sandbox state, the script should provide a clear warning or confirmation prompt before proceeding.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The instructions say to speak to the agent using Chinese example phrases only, and the document overall is written as if Chinese is the required interaction language. There is no indication that other languages are supported or that Chinese is optional, which can violate language/locale choice policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The user-facing docstrings, argument descriptions, and CLI description are written only in Chinese, which imposes a specific language on users without offering a language choice or documenting a justified locale constraint. This matches the policy category for language or locale restrictions in natural-language content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file’s docstrings, CLI description, help text, and runtime messages are written in Chinese, which imposes a specific language on users without any opt-in or stated regional constraint. This matches the language/locale policy concern for natural-language behavior embedded in code.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Credential Access

方式一: 通过脚本配置

方式二: 手动写入 ~/.env

Credential Access

方式一: 通过脚本配置

方式二: 手动写入 ~/.env

Credential Access

方式一: 通过脚本配置

方式二: 手动写入 ~/.env

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Missing User Warnings

Undeclared Tool Scope

Vague Triggers

Missing User Warnings

Description-Behavior Mismatch

Natural-Language Policy Violations

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations