sandbox-selfheal-guard

• Outcome: Review
• Latest audit: Jul 26, 2026 · 11:30 PM UTC
• Version: 2.0.1

Overview

This skill is aimed at sandbox recovery, but it can automatically change the host environment and download large model files without clear upfront user control.

Install only if you are comfortable with a runner that may install apt packages, create ~/.shim/npx, alter PATH for its process, rebuild ~/llama.cpp, and download large GGUF files into your home directory. Prefer running it in a disposable sandbox or after adding explicit prompts and stronger hash verification for downloaded models.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The manifest describes a sandbox self-heal/guard capability, but this script uses sudo apt-get to install binaries and creates an executable shim in the user's PATH. Those are strong environment-modifying capabilities that are not inherently required just to prevent snapshot-eviction hangs or enforce timeouts, and they materially expand what the skill can do on the host.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The description claims a byte-verified GGUF manifest, which implies integrity verification of model artifacts. In practice, the script stores expected byte counts and compares only stat -c%s output, then downloads from remote URLs with curl if sizes differ; this is weaker than true content verification and does not ensure artifact integrity.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The markdown embeds a shell script that automatically runs `sudo apt-get install`, creates files under `$HOME/.shim`, rebuilds binaries, and downloads model files with `curl`. While some actions are logged to `/tmp/selfheal.log`, the skill description does not clearly warn the user up front that it may modify the system and fetch large external files.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: At L05-L06, the script automatically runs `sudo apt-get install` and creates or overwrites `$HOME/.shim/npx`, which are safety-relevant system and file changes. Although it appends to a log file, there is no user-facing prompt, visible disclosure, or inline comment/docstring warning the user that the script may install packages and modify files in the home directory.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: At L11, the script silently fetches large files from Hugging Face via `curl` and writes them into `~/` when files are missing or size-mismatched. This is a network transfer and file-write operation affecting user storage, but the only notice is a log entry to `/tmp/selfheal.log`, not a visible warning or confirmation to the user.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

for bin in cmake g++ curl; do
  if ! command -v $bin >/dev/null; then
    echo "missing $bin → apt-get install" | tee -a $LOG
    sudo apt-get update -qq && sudo apt-get install -y -qq $bin
  fi
done

• Confidence: 70% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

for bin in cmake g++ curl; do
  if ! command -v $bin >/dev/null; then
    echo "missing $bin → apt-get install" | tee -a $LOG
    sudo apt-get update -qq && sudo apt-get install -y -qq $bin
  fi
done

• Confidence: 70% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# selfheal_runner.sh — actual library bundled in v2.1.0
LOG=/tmp/selfheal.log
echo "$(date -Iseconds) selfheal pre-flight" >> $LOG
for bin in cmake g++ curl; do command -v $bin >/dev/null || { sudo apt-get update -qq && sudo apt-get install -y -qq $bin; echo "installed $bin" >> $LOG; }; done
if [ ! -x "$HOME/.shim/npx" ]; then mkdir -p "$HOME/.shim"; printf '#!/bin/bash\nexec /usr/bin/npx --yes "$@"\n' > "$HOME/.shim/npx"; chmod +x "$HOME/.shim/npx"; echo "shim recreated" >> $LOG; fi
export PATH="$HOME/.shim:$PATH"
CLI=~/llama.cpp/build/bin/llama-completion

• Confidence: 70% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# selfheal_runner.sh — actual library bundled in v2.1.0
LOG=/tmp/selfheal.log
echo "$(date -Iseconds) selfheal pre-flight" >> $LOG
for bin in cmake g++ curl; do command -v $bin >/dev/null || { sudo apt-get update -qq && sudo apt-get install -y -qq $bin; echo "installed $bin" >> $LOG; }; done
if [ ! -x "$HOME/.shim/npx" ]; then mkdir -p "$HOME/.shim"; printf '#!/bin/bash\nexec /usr/bin/npx --yes "$@"\n' > "$HOME/.shim/npx"; chmod +x "$HOME/.shim/npx"; echo "shim recreated" >> $LOG; fi
export PATH="$HOME/.shim:$PATH"
CLI=~/llama.cpp/build/bin/llama-completion

• Confidence: 70% confidence
• Finding: sudo

Chaining Abuse

High

• Category: Tool Misuse

Content

for bin in cmake g++ curl; do
  if ! command -v $bin >/dev/null; then
    echo "missing $bin → apt-get install" | tee -a $LOG
    sudo apt-get update -qq && sudo apt-get install -y -qq $bin
  fi
done

• Confidence: 75% confidence
• Finding: && sudo

Chaining Abuse

High

• Category: Tool Misuse

Content

# selfheal_runner.sh — actual library bundled in v2.1.0
LOG=/tmp/selfheal.log
echo "$(date -Iseconds) selfheal pre-flight" >> $LOG
for bin in cmake g++ curl; do command -v $bin >/dev/null || { sudo apt-get update -qq && sudo apt-get install -y -qq $bin; echo "installed $bin" >> $LOG; }; done
if [ ! -x "$HOME/.shim/npx" ]; then mkdir -p "$HOME/.shim"; printf '#!/bin/bash\nexec /usr/bin/npx --yes "$@"\n' > "$HOME/.shim/npx"; chmod +x "$HOME/.shim/npx"; echo "shim recreated" >> $LOG; fi
export PATH="$HOME/.shim:$PATH"
CLI=~/llama.cpp/build/bin/llama-completion

• Confidence: 75% confidence
• Finding: && sudo

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.