E2B Sandbox

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:14 AM UTC
• Version: 1.0.0

Overview

The skill appears purpose-aligned, but it gives agents broad E2B cloud sandbox control and installs persistent local configuration with some dependency and scoping concerns.

Install only if you intend to let an agent create and control E2B cloud sandboxes. Use a limited E2B key, avoid passing sensitive local data unless needed, review the mcporter config entry before and after registration, and update or audit dependencies before using it in high-trust workflows.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Known Vulnerable Dependency: tar==7.5.13 — 6 advisory(ies): CVE-2026-59873 (node-tar: Decompression/parse DoS via unlimited input); CVE-2026-59874 (node-tar: Negative tar entry size causes infinite loop in archive replace); CVE-2026-59875 (node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records) +3 more

Critical

• Category: Supply Chain
• Confidence: 90% confidence

Finding

tar 7.5.13 has multiple reported parsing and decompression denial-of-service flaws, some severe. This is especially concerning in an E2B sandbox-management skill because archive handling is common in code upload, environment packaging, snapshotting, and file transfer workflows, making malformed tar input a plausible attack vector against agent or service availability.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==5.0.5 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-45149 (brace-expansion: Large numeric range defeats documented `max` DoS protection); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 83% confidence

Finding

brace-expansion 5.0.5 has multiple reported algorithmic complexity and memory exhaustion issues. Because this skill manages sandboxes and may process file patterns or build contexts through transitive tooling, malformed glob-like input could trigger resource exhaustion in the agent process.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 84% confidence

Finding

fast-uri 3.1.0 is flagged for multiple host confusion and SSRF-related parsing flaws. In a skill specifically designed to spin up remote sandboxes and potentially interact with internet-facing services, incorrect URI parsing can materially increase the risk of bypassing host validation or making unintended outbound requests.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: hono==4.12.14 — 16 advisory(ies): CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie); CVE-2026-71848 (Hono: Algorithmic Complexity DoS in Language Middleware) +13 more

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

hono 4.12.14 carries numerous advisories affecting routing, cookies, and middleware behavior. Since MCP SDK bundles Hono-based server components, a skill that may expose local or remote HTTP control surfaces inherits meaningful web-layer risk if those features are reachable by untrusted users or services.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

ip-address 10.1.0 is reported vulnerable to address parsing inconsistencies and XSS in HTML-emitting methods. In this skill context, the parsing ambiguity is the more relevant issue because sandbox/network tooling often relies on IP validation, and discrepancies can enable policy bypass or misclassification of internal versus external addresses.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill exposes significant capabilities—most notably use of an environment-provided API key and the ability to create, execute within, expose ports from, snapshot, and destroy remote sandboxes—yet it declares no explicit tool scope or permission boundaries. In an agent setting, that omission weakens least-privilege controls and can let downstream tasks invoke sensitive remote-compute actions without clear policy enforcement or operator visibility.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/e2b-notes.md (reported line 32)May include surrounding context.

md

The server uses the E2B JavaScript SDK and covers the common OpenClaw-agent actions:

- create a sandbox
- reconnect to a sandbox by id or saved label
- run one-shot commands inside the sandbox
- derive public host URLs for exposed ports

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The execInSandbox function runs a caller-supplied command via sandbox.commands.run(cmd, ...), which can perform impactful actions inside the sandbox. There is no confirmation prompt, warning comment, or user-visible disclosure in this file explaining that arbitrary commands will be executed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The killSandbox function invokes sandbox.kill() and removes the local record, which is a destructive and potentially irreversible operation. This file contains no confirmation prompt, user-facing warning, or explanatory comment indicating that the action will terminate the sandbox and delete its tracked state entry.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script unconditionally writes to a user-scoped OpenClaw configuration file and replaces or modifies the mcpServers[e2b-sandbox] entry without prompting, backup, merge safeguards, or validation of existing settings. In a developer tooling context, silently altering persistent config is dangerous because it can override trusted server definitions, break existing workspace behavior, or register a command that will later execute automatically under the user's account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill tells users to provide an E2B_API_KEY but does not clearly warn that this secret authorizes access to an external cloud sandbox service where code execution, networking, and potentially user data may occur. That missing disclosure can lead operators or agents to supply a powerful credential without understanding the trust boundary shift to a third-party remote environment.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @hono/node-server==1.19.14 — 1 advisory(ies): GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode)

Low

• Category: Supply Chain
• Confidence: 75% confidence

Finding

The lockfile pins @hono/node-server 1.19.14, which is reported vulnerable to a Windows-specific path traversal in serve-static. Even though this is only a dependency manifest and not proof the vulnerable code path is used, including a known vulnerable package in a skill that may expose HTTP services from a sandbox creates real attack surface if static file serving is enabled on Windows hosts.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: body-parser==2.2.2 — 1 advisory(ies): CVE-2026-12590 (body-parser vulnerable to denial of service when invalid limit value silently di)

Low

• Category: Supply Chain
• Confidence: 62% confidence

Finding

body-parser 2.2.2 is flagged for a denial-of-service issue tied to invalid limit handling. In a lockfile this is still a real supply-chain weakness, though exploitability depends on whether the skill exposes request parsing to untrusted clients through an HTTP endpoint.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: qs==6.15.1 — 3 advisory(ies): CVE-2026-82417 (qs: Denial of Service via Attacker Controlled isBuffer); CVE-2026-8723 (qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/u); CVE-2026-82562 (qs array-limit bypass via bracket-key comma parsing)

Low

• Category: Supply Chain
• Confidence: 64% confidence

Finding

qs 6.15.1 is flagged for several denial-of-service issues involving parsing or stringify edge cases. This is relevant only if attacker-controlled query/body structures reach Express/body-parser code paths, but in that case it could degrade availability of the skill's control plane.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency uses a caret range, which permits automatic installation of newer compatible versions rather than a single reviewed artifact. This increases supply-chain risk because a compromised or buggy upstream release could be pulled into the skill without explicit review, though the package.json alone does not indicate active exploitation.

Content

Scanner excerpt · package.json (reported line 6)May include surrounding context.

json

"private": true,
  "type": "module",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.17.4",
    "e2b": "^2.14.1"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The e2b dependency is also specified with a caret range, allowing semver-compatible upstream updates to be installed implicitly. In this skill's context, that is more concerning than usual because the package manages remote cloud sandboxes, so a malicious or flawed update could affect sandbox provisioning, credentials, or command execution paths.

Content

Scanner excerpt · package.json (reported line 7)May include surrounding context.

json

"type": "module",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.17.4",
    "e2b": "^2.14.1"
  }
}