pibox

• Outcome: Review
• Latest audit: Oct 22, 2026 · 2:43 PM UTC
• Version: 0.20.2

Overview

This coding-agent integration needs review because its server examples weaken network isolation around powerful command and file access.

Require distinct, nonempty API and MCP tokens before startup. For local servers, use bridge networking with loopback-only port publishing; omit host networking for ordinary Telegram and cron use. Inspect a pinned installer, select a verified image digest, and limit mounted workspaces and credentials. Enable recurring jobs only when intended, and remember that the configured LLM provider receives task content.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (34)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md

n reach it gets full agent-execution and workspace file-read/write/delete access. NEVER expose such an instance on a network or to untrusted agents; set the token and bind to loopback / behind an authenticating proxy.
- **No auth when `PIBOX_MCP_MODE_TOKEN` is unset.** Same story for the MCP surface (`/mcp/` or the sidecar) — empty token means unauthenticated `run_prompt`/file-tool access, and it does not fall back to `PIBOX_API_MODE_TOKEN`. Set it explicitly.
- **Destructive & irreversible.** `DELETE /run/{id}`, `DELETE /files/{path}`, and the MCP `delete_file` tool remove state with no undo (canceled runs can't be resumed; deleted files are gone). An agent must NEVER call these unless the user explicitly asked for that exact action; confirm the specific target first, scope it to the current task, and never enumerate-then-bulk-delete. On a shared/multi-tenant instance a deletion can destroy another caller's in-flight run or workspace file — treat these routes as admin-only.

## When T

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md

n reach it gets full agent-execution and workspace file-read/write/delete access. NEVER expose such an instance on a network or to untrusted agents; set the token and bind to loopback / behind an authenticating proxy.
- **No auth when `PIBOX_MCP_MODE_TOKEN` is unset.** Same story for the MCP surface (`/mcp/` or the sidecar) — empty token means unauthenticated `run_prompt`/file-tool access, and it does not fall back to `PIBOX_API_MODE_TOKEN`. Set it explicitly.
- **Destructive & irreversible.** `DELETE /run/{id}`, `DELETE /files/{path}`, and the MCP `delete_file` tool remove state with no undo (canceled runs can't be resumed; deleted files are gone). An agent must NEVER call these unless the user explicitly asked for that exact action; confirm the specific target first, scope it to the current task, and never enumerate-then-bulk-delete. On a shared/multi-tenant instance a deletion can destroy another caller's in-flight run or workspace file — treat these routes as admin-only.

## When T

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Host networking removes network-namespace isolation, allowing the coding-agent container to reach host loopback services and potentially exposing its API on host interfaces depending on the server bind address. It is not equivalent to privileged mode or proof of container escape, but the example unnecessarily weakens isolation and does not enforce the documented loopback-binding recommendation.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

PIBOX_API_MODE=1. FastAPI server on :8080 (override PIBOX_API_MODE_PORT). Requires PIBOX_AVAILABLE_MODELS=<csv> — the server refuses to boot without it (no sensible default; pi can drive any provider's models).

bash

docker run -d --network host \
  -e PIBOX_API_MODE=1 \
  -e PIBOX_API_MODE_TOKEN=your-secret \
  -e PIBOX_AVAILABLE_MODELS=glm-4.6,glm-4.5-air \

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

No auth when PIBOX_API_MODE_TOKEN is unset. With it empty the API is UNAUTHENTICATED — anyone who can reach it gets run-the-agent and workspace file-read/write/delete access. NEVER expose such an instance on a network or to untrusted agents; set the token and bind to loopback / behind an authenticating proxy.

Destructive & irreversible. DELETE /run/{id} kills the in-flight subprocess with no undo, and DELETE /files/{path} deletes a workspace file with no undo. An agent must NEVER call either unless the user explicitly asked for that exact action; confirm the specific target first; scope it to the current task; never enumerate-then-bulk-delete. On a shared/multi-tenant instance this can disrupt or destroy another caller's run or data — treat these routes as admin-only.

bash

# sync run

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

No auth when PIBOX_API_MODE_TOKEN is unset. With it empty the API is UNAUTHENTICATED — anyone who can reach it gets run-the-agent and workspace file-read/write/delete access. NEVER expose such an instance on a network or to untrusted agents; set the token and bind to loopback / behind an authenticating proxy.

Destructive & irreversible. DELETE /run/{id} kills the in-flight subprocess with no undo, and DELETE /files/{path} deletes a workspace file with no undo. An agent must NEVER call either unless the user explicitly asked for that exact action; confirm the specific target first; scope it to the current task; never enumerate-then-bulk-delete. On a shared/multi-tenant instance this can disrupt or destroy another caller's run or data — treat these routes as admin-only.

bash

# sync run

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

This server example shares the host network and does not enforce a loopback-only listener. If SECRET is empty, the documented fail-open authentication behavior can combine with a reachable listener to expose agent execution and workspace modification; host networking also grants access to host loopback services.

Content

Scanner excerpt · SKILL.md (reported line 301)May include surrounding context.

Long-running server, drive it with curl:

bash

docker run -d --network host -e PIBOX_API_MODE=1 -e PIBOX_API_MODE_TOKEN=$SECRET \
  -e PIBOX_AVAILABLE_MODELS=glm-4.6 -e ANTHROPIC_AUTH_TOKEN=$TOKEN \
  -e ANTHROPIC_BASE_URL=$BASE_URL -v "$PWD/workspace:/workspace" psyb0t/pibox:latest
curl -s http://localhost:8080/run -H "Authorization: Bearer $SECRET" \

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The Telegram and cron workflow uses host networking without a demonstrated need for an inbound host-network listener. This unnecessarily lets agent-executed code reach services bound to host loopback, although it does not itself grant privileged-container capabilities or establish a container escape.

Content

Scanner excerpt · SKILL.md (reported line 326)May include surrounding context.

Chat + Telegram + scheduled digest, all on one box:

bash

docker run -d --network host \
  -e PIBOX_TELEGRAM_MODE=1 -e PIBOX_TELEGRAM_MODE_TOKEN=$BOT_TOKEN \
  -e PIBOX_CRON_MODE=1 -e PIBOX_CRON_MODE_FILE=/config/cron.yaml \
  -e ANTHROPIC_AUTH_TOKEN=$TOKEN -e ANTHROPIC_BASE_URL=$BASE_URL \

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The pipe connects unverified remote content directly to a host shell, allowing that content to execute arbitrary commands as the invoking user. This is a conventional but unsafe installation pattern, not evidence of malicious intent, and duplicates the other remote-installer findings.

Content

Scanner excerpt · references/setup.md (reported line 16)May include surrounding context.

Install the wrapper for interactive and one-shot use:

bash

curl -fsSL https://raw.githubusercontent.com/psyb0t/docker-pibox/main/install.sh | bash

Install pibox, codexbox, and claudebox in the same command directory,

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

Host networking removes network-namespace isolation and may expose the API directly on host interfaces, depending on its bind address. It also permits container processes to reach host loopback services; this is a network-isolation weakness, not proof of privileged execution or container escape.

Content

Scanner excerpt · references/setup.md (reported line 40)May include surrounding context.

REST / OpenAI-compatible / MCP server

bash

docker run -d --name pibox --network host \
  -e PIBOX_API_MODE=1 \
  -e PIBOX_API_MODE_TOKEN=your-secret \
  -e PIBOX_AVAILABLE_MODELS=glm-4.6,glm-4.5-air \

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

This recommendation repeats the host-networking weakness rather than identifying a separate exploit. Calling host networking convenient for local use can mislead operators because it does not restrict a service to localhost, and the suggested -p 8080:8080 alternative normally publishes on all host interfaces.

Content

Scanner excerpt · references/setup.md (reported line 53)May include surrounding context.

psyb0t/pibox:latest

text

`--network host` is convenient for local use; for anything else publish the port explicitly (`-p 8080:8080`) instead.

**Verify:** `curl http://localhost:8080/healthz` returns `{"ok": true, "adapter": "pi"}`.

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · references/setup.md (reported line 189)May include surrounding context.

LiteLLM example:

bash

docker run --rm --network host \
  -e PIBOX_PROVIDER_BASE_URL=http://127.0.0.1:4000/v1 \
  -e PIBOX_PROVIDER_API=openai-completions \
  -e PIBOX_PROVIDER_API_KEY=your-litellm-virtual-key \

Docker image referenced without tag or digest: 'docker run -d'.

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The detector incorrectly identifies Docker options as the image, but the complete command uses the mutable image reference psyb0t/pibox:latest. An unexpected or compromised image update could execute with access to the mounted writable workspace and supplied provider credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md

-e PIBOX_API_MODE_TOKEN=your-secret \
  -e PIBOX_AVAILABLE_MODELS=glm-4.6,glm-4.5-air \
  -e ANTHROPIC_AUTH_TOKEN=your-token \
  -e ANTHROPIC_BASE_URL=https://api.z.ai/api/anthropic \
  -e ANTHROPIC_MODEL=glm-4.6 \
  -v "$PWD/workspace:/workspace" \
  psyb0t/pibox:latest

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 282)May include surrounding context.

md

| `ANTHROPIC_BASE_URL` | Endpoint override (default `https://api.anthropic.com`) |
| `ANTHROPIC_MODEL` | Default model when the caller doesn't specify one |

Z.AI's GLM models are a fast/cheap default: `ANTHROPIC_BASE_URL=https://api.z.ai/api/anthropic` + `ANTHROPIC_MODEL=glm-4.6`.

pi's thinking levels (`--thinking`): `off`, `minimal`, `low`, `medium`, `high`, `xhigh`. Exposed as `/effort` in Telegram mode and `thinking` in API/OAI requests.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

bash

# sync run
curl -s http://localhost:8080/run \
  -H "Authorization: Bearer your-secret" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "say HELLO", "workspace": "/workspace"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md

RUN_ID=$(curl -s http://localhost:8080/run \
  -H "Authorization: Bearer your-secret" -H "Content-Type: application/json" \
  -d '{"prompt": "long task", "async": true}' | jq -r .runId)
curl -s "http://localhost:8080/run/result?runId=%24RUN_ID" \
  -H "Authorization: Bearer your-secret"

# cancel it

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

http://localhost:8080/files/notes/hello.txt curl -sS -H "Authorization: Bearer your-secret"
http://localhost:8080/files/notes | jq curl -sS -X DELETE -H "Authorization: Bearer your-secret"
http://localhost:8080/files/notes/hello.txt

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.

Raw JSON-RPC (debugging, non-MCP-aware callers):

bash

curl -s http://localhost:8080/mcp/ \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Authorization: Bearer your-mcp-token" \

Docker image referenced without tag or digest: 'docker run --rm'.

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The complete command includes an image tag, contrary to the literal finding, but uses the mutable tag psyb0t/pibox:latest. When that tag resolves to a changed image, the one-shot container receives provider credentials and writable access to the current directory.

Content

No source excerpt is available for this finding.

Docker image referenced without tag or digest: 'docker run -d'.

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

Although the detector truncates the command before the image name, the actual image is psyb0t/pibox:latest rather than an immutable digest. A compromised or unreviewed image update could access provider credentials, modify workspace files, and operate through the host network.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 304)May include surrounding context.

docker run -d --network host -e PIBOX_API_MODE=1 -e PIBOX_API_MODE_TOKEN=$SECRET
-e PIBOX_AVAILABLE_MODELS=glm-4.6 -e ANTHROPIC_AUTH_TOKEN=$TOKEN
-e ANTHROPIC_BASE_URL=$BASE_URL -v "$PWD/workspace:/workspace" psyb0t/pibox:latest curl -s http://localhost:8080/run -H "Authorization: Bearer $SECRET"
-H "Content-Type: application/json" -d '{"prompt": "run the tests and report failures"}'

text

Docker image referenced without tag or digest: 'docker run -d'.

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The command specifies psyb0t/pibox:latest, so the literal missing-tag detection is inaccurate, but an immutable image pin is absent. An altered image would receive Telegram and provider credentials alongside writable workspace access.

Content

No source excerpt is available for this finding.

The installation instructions execute a remote script on the host without a trust or execution warning.

Medium

• Category: Output Handling
• Confidence: 99% confidence

Finding

The installation instructions immediately execute a remote script from a mutable main branch on the host. Compromise of the source or repository could run arbitrary commands with the invoking user's privileges, affecting host files and credentials.

Content

No source excerpt is available for this finding.

Docker image referenced without tag or digest: 'docker run -d'.

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The scanner matched an incomplete command, but the full command uses the mutable image reference psyb0t/pibox:latest. A changed or compromised image can execute code with access to the mounted workspace, provider credentials, and host network.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/setup.md (reported line 47)May include surrounding context.

md

-e PIBOX_MCP_MODE=1 \
  -e PIBOX_MCP_MODE_TOKEN=your-mcp-secret \
  -e ANTHROPIC_AUTH_TOKEN=your-token \
  -e ANTHROPIC_BASE_URL=https://api.z.ai/api/anthropic \
  -e ANTHROPIC_MODEL=glm-4.6 \
  -v "$PWD/workspace:/workspace" \
  psyb0t/pibox:latest

Static analysis

No suspicious patterns detected.