Novita Sandbox

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:56 PM UTC
• Version: 0.1.8

Overview

This remote sandbox skill is coherent for isolated browsing and code execution, but needs Review because it can upload arbitrary local files to Novita and overwrite local files from sandbox output without enforced path limits or confirmation.

Review this before installing if you will use it around private workspaces or credentials. Use a dedicated environment, pin the Novita SDK to a reviewed version, give it only the Novita API key it needs, avoid uploading secrets or broad workspace files, download only into a disposable staging directory, and kill sandboxes when finished to clear preserved state and stop billing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sandbox.py:132

Finding

Unrestricted Local File Upload and Overwrite Crosses the Sandbox Security Boundary

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1

Finding

Novita SDK Dependency Is Not Reproducibly Pinned

Content

View full analysis

=1.0.5 ``` The same installation constraint is presented in `SKILL.md:39-45`: ```bash pip3 install "novita-sandbox>=1.0.5" # Or: pip3 install -r skills/novita-sandbox/scripts/requirements.txt ``` ### Technical Analysis The requirement specifies only a minimum version. It therefore permits installation of any future `novita-sandbox` release satisfying `>=1.0.5`. This contradicts the documentation's statement that the SDK version is “tested and pinned.” No lockfile, upper version bound, or cryptographic package hashes are provided. Consequently, installation is not reproducible and the reviewed source does not uniquely identify the code that will execute during package installation or at runtime. This dependency is security-sensitive because it receives the Novita API key and implements sandbox creation, network communication, command execution, and file transfer. A compromised, malicious, or unexpectedly incompatible future release could alter those operations or access information available to the local Python process. ### Attack Path 1. A future or compromised package release is published under the `novita-sandbox` package name. 2. The release version satisfies the broad `>=1.0.5` constraint. 3. A user follows the documented installation command without a previously constrained environment or trusted lockfile. 4. The package manager selects and installs the newer release. 5. Package installation hooks, imported module code, or runtime SDK behavior executes with the privileges of the installing or invoking user. 6. Malicious or compromised code could access the API key, manipulate transferred files, redirect network operations, or execute other actions allowed to the Python process. This finding does not establish that the current package i ...[truncated 683 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims it is not for reading or writing local user files, yet it documents upload and download operations that necessarily read from and write to local paths. That mismatch can mislead users or higher-level agents into trusting the skill in contexts where local workspace isolation matters, creating a path for unintended exfiltration of local files to the remote sandbox or untrusted artifacts being written back locally.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

**Important:** This skill requires `novita-sandbox>=1.0.5`. Do NOT modify `scripts/sandbox.py` — the SDK version is tested and pinned.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.

bash

python3 skills/novita-sandbox/scripts/sandbox.py create --template browser-chromium --timeout 120
python3 skills/novita-sandbox/scripts/sandbox.py exec <sandbox_id> \
  "curl -sL https://example.com" --timeout 30

JS-rendered pages (puppeteer)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill exposes direct host filesystem access via open(args.local_path, ...) in both upload and download operations, despite the manifest explicitly stating it is not for reading or writing local user files. In an agent setting, this creates a path for a remote-execution-focused tool to exfiltrate local files into the sandbox or overwrite arbitrary local files from sandbox-controlled content, breaking the intended trust boundary.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

For a skill whose stated purpose is remote sandbox execution and browsing, host filesystem access is unnecessary and materially expands the attack surface. If an agent can be induced to use upload or download, untrusted sandbox workloads can indirectly read from or write to the local machine, enabling data theft or local file tampering.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill invokes capabilities that interact with environment variables and local file operations, but it declares no explicit tool scope or permissions boundary. In a security-sensitive skill that handles untrusted code and browsing, missing scope declarations increase the chance that an agent can overreach into local resources or expose secrets because the enforcement contract is unclear.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The code creates sandboxes with secure=False and allow_internet_access=True while presenting the tool as a secure sandbox for untrusted code and browser activity. This mismatch can cause operators or higher-level agents to assume stronger isolation than is actually configured, increasing the likelihood of risky use of the environment and broader data exposure over the network.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The download command writes sandbox-provided content directly to an arbitrary host path without any confirmation, path restriction, or warning. In this context, the sandbox may contain untrusted code output, so writing it onto the host can overwrite files, plant malicious scripts, or place attacker-controlled content in sensitive locations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The kill command performs an irreversible destructive action by destroying a sandbox, but the implementation provides no confirmation prompt or warning at execution time. The CLI help says 'Destroy a sandbox,' but there is no stronger user disclosure in code for this destructive operation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified with a lower-bound range (>=1.0.5) instead of an exact version, so future installs may pull in different releases than were originally reviewed or tested. In a security-sensitive sandbox skill, this increases supply-chain and reproducibility risk because a later compromised, vulnerable, or behavior-changing package version could be installed automatically.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

novita-sandbox>=1.0.5