claudebox

• Outcome: Review
• Latest audit: Oct 22, 2026 · 2:43 PM UTC
• Version: 2.8.5

Overview

Review before installing: the default setup bypasses permission prompts and gives the coding agent Docker access that extends beyond the chosen workspace.

Use a dedicated environment or deployment without the host Docker socket, especially for untrusted content. Separate workspace folders do not safely separate unrelated users. Review and pin the installer and dependencies before execution, configure independent API/MCP tokens and Telegram allowlists, and consider which credentials and files the agent can access.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Docker Socket Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The documented standard wrapper exposes the host Docker socket to an agent that bypasses permission prompts, allowing it to direct the host daemon to create containers and mount host filesystems. With a conventional rootful Docker daemon, malicious prompts or compromised workspace content could therefore lead to host-level compromise; the explicit warning acknowledges but does not enforce this trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

- **No auth when the per-mode token is unset.** `CLAUDEBOX_API_MODE_TOKEN` and `CLAUDEBOX_MCP_MODE_TOKEN` each default to no auth if unset — see [HTTP REST API mode](#http-rest-api-mode) and [MCP server mode](#mcp-server-mode) for details and the exact capability exposed unauthenticated in each case.
- **File operations include removal.** Deleting a workspace file has no undo — only remove files the current task created, and only when the user asked.
- **The standard wrapper mounts `/var/run/docker.sock`** so Claude can control the host Docker daemon. Server Compose examples omit it. See [Server modes (API / OpenAI / MCP / Telegram / Cron)](references/setup.md#server-modes-api--openai--mcp--telegram--cron), and do not use the wrapper for untrusted prompts.
- **`--permission-mode bypassPermissions` is on by default** — Claude has full, unrestricted shell/file/docker access inside the container by design (see [When NOT To Use](#when-not-to-use)). Don't treat the container boundary as a

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

- **Interactive shell** — `claudebox` drops you into the native `claude` CLI, container-backed, with automatic session resumption.
- **One-shot exec**: `claudebox -p "prompt" [flags]`, non-interactive, prompt in / structured output out, for scripts and CI.
- **HTTP REST API** — `CLAUDEBOX_API_MODE=1`. `POST /run`, async runs polled via `GET /run/result?runId=`, `GET/PUT/DELETE /files/{path}`, workspace isolation.
- **OpenAI-compatible endpoint** — same API-mode server, `/openai/v1/chat/completions` + `/openai/v1/models`. Streaming SSE, multi-turn, multimodal image input.
- **MCP server** — `CLAUDEBOX_MCP_MODE=1`, 5 tools over streamable HTTP. Mounts at `/mcp/` on the API port when `CLAUDEBOX_API_MODE=1` is also set; otherwise runs standalone as a sidecar process on its own port (`CLAUDEBOX_MCP_MODE_PORT`, default `8081`), coexisting with Telegram/Cron/interactive mode.
- **Telegram bot** — `CLAUDEBOX_TELEGRAM_MODE=1`, per-chat isolated workspaces, file/photo/video/voice ingestion, sla

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

curl -X DELETE "http://localhost:8080/files/myproject/src/old.py" -H "Authorization: Bearer token"

text

`DELETE /files/{path}` removes a file under `/workspace` (no undo). Confirm the target path first, only remove files the current task created, and on a shared instance don't touch another caller's workspace — see [Security & safety](#security--safety).

**Introspection and lifecycle:**

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

Piping the HTTP response into Bash turns remotely controlled content into executable commands without an inspection boundary. This is the same underlying supply-chain exposure as the SC2 finding on line 10, not evidence of a separate malicious chaining attack. The wrapper's documented Docker-socket access and permission-prompt bypass increase the consequences of trusting compromised installation artifacts.

Content

Scanner excerpt · references/setup.md (reported line 10)May include surrounding context.

You need Bash, Docker, curl, SSH key-generation tools, and permission to install the wrapper. Authenticate with Claude Code or supply ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN.

bash

curl -fsSL https://raw.githubusercontent.com/psyb0t/docker-claudebox/master/install.sh | bash

For full:

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The full-install pipeline gives the downloaded script immediate execution with the user's privileges, allowing compromised upstream content to read files, steal accessible credentials, or modify the installation. It duplicates the SC2 exposure on line 17 rather than establishing independent chaining abuse or malicious intent. The legitimate setup context explains the command but does not provide integrity protection.

Content

Scanner excerpt · references/setup.md (reported line 17)May include surrounding context.

bash

export CLAUDEBOX_FULL=1
curl -fsSL https://raw.githubusercontent.com/psyb0t/docker-claudebox/master/install.sh | bash

For a reviewed install, obtain a local checkout, inspect install.sh and its adjacent wrapper.sh, then run bash install.sh. The remote installer fetches its wrapper from an embedded release ref unless CLAUDEBOX_INSTALL_REF overrides it. The wrapper and image are updated separately. See installation and wrapper behavior before changing image selection or reusing a container.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

text

```bash
curl -X POST http://localhost:8080/run \
  -H "Authorization: Bearer your-secret-token" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "what does this repo do", "workspace": "myproject"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 302)May include surrounding context.

Raw JSON-RPC for debugging (streamable-HTTP handshake — initialize then reuse the returned mcp-session-id):

bash

curl -s -D - -X POST "http://localhost:8080/mcp/" \
  -H "Authorization: Bearer your-mcp-token" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 419)May include surrounding context.

Fire-and-poll a long refactor over HTTP

bash

RUN_ID=$(curl -s -X POST http://localhost:8080/run -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"prompt": "refactor the auth module", "workspace": "myproject", "async": true}' | jq -r .runId)

until curl -s "http://localhost:8080/run/result?runId=%24RUN_ID" -H "Authorization: Bearer $TOKEN" | jq -e '.status != "running"' >/dev/null; do

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The command executes an external installer directly from a mutable master branch without review or integrity verification. A compromised repository or malicious upstream change could execute commands with the installing user's privileges and access available credentials or workspace files. Installation is legitimate for this skill and a reviewed alternative is documented, but neither eliminates the unsafe quick-install path.

Content

Scanner excerpt · references/setup.md (reported line 10)May include surrounding context.

You need Bash, Docker, curl, SSH key-generation tools, and permission to install the wrapper. Authenticate with Claude Code or supply ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN.

bash

curl -fsSL https://raw.githubusercontent.com/psyb0t/docker-claudebox/master/install.sh | bash

For full:

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The full-install example also immediately executes an unverified installer fetched from a mutable master branch. Upstream compromise could therefore lead to arbitrary code execution as the installing user; the effect of CLAUDEBOX_FULL cannot be determined from this file. The documented review option helps informed users but does not protect users following this example.

Content

Scanner excerpt · references/setup.md (reported line 17)May include surrounding context.

bash

export CLAUDEBOX_FULL=1
curl -fsSL https://raw.githubusercontent.com/psyb0t/docker-claudebox/master/install.sh | bash

For a reviewed install, obtain a local checkout, inspect install.sh and its adjacent wrapper.sh, then run bash install.sh. The remote installer fetches its wrapper from an embedded release ref unless CLAUDEBOX_INSTALL_REF overrides it. The wrapper and image are updated separately. See installation and wrapper behavior before changing image selection or reusing a container.

Static analysis

No suspicious patterns detected.