Multi-Agent Sandbox

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:47 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed setup guide, but it asks users to create persistent host network bridges and broad agent permissions that weaken the sandbox boundary it claims to provide.

Review this carefully before installing. It is not clearly malicious, but it makes host-level and persistent networking changes, grants broad agent/session capabilities, uses a remote installer script, enables broad Discord intents, and documents root SSH with host-key checking disabled. Use a dedicated host or test environment, restrict Docker networking to the intended container, avoid bridging the gateway unless strictly required, use a non-root VPS account, pin and verify installers, keep SSH host-key verification enabled, and document how to disable and remove the services.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:268

Finding

Unpinned Remote Installation Script Is Executed Directly by a Shell

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:157

Finding

Persistent Network Bridges Expose Host and VPS Services to Docker Workloads

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:293

Finding

SSH Server Identity Verification Is Disabled for a Root Connection

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:52

Finding

Sandbox Agent Is Granted Excessive Session and Agent-Orchestration Capabilities

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:209

Finding

Discord Bot Is Instructed to Enable Unnecessary Privileged Gateway Intents

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

bash ca-certificates curl git jq
openssh-client
python3 ripgrep
&& rm -rf /var/lib/apt/lists/*

text

Rebuild and force-recreate containers:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

bash ca-certificates curl git jq
openssh-client
python3 ripgrep
&& rm -rf /var/lib/apt/lists/*

text

Rebuild and force-recreate containers:

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

bash ca-certificates curl git jq
openssh-client
python3 ripgrep
&& rm -rf /var/lib/apt/lists/*

text

Rebuild and force-recreate containers:

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

bash

docker build -f Dockerfile.sandbox -t openclaw-sandbox:bookworm-slim .
docker ps --format "{{.ID}} {{.Image}}" | grep sandbox | awk '{print $1}' | xargs -r docker rm -f

Step 4 — Socat Bridges

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Piping a remote script directly into sh executes unreviewed network content with full installer privileges, creating a strong supply-chain and content-injection risk. If the remote endpoint, transport, or DNS is compromised, the operator may run attacker-controlled code on every machine involved in the multi-agent infrastructure.

Content

Scanner excerpt · SKILL.md (reported line 271)May include surrounding context.

Install on all machines:

bash

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up --ssh

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | sh chain is dangerous because it turns a remote fetch directly into code execution without review or integrity verification. This is especially sensitive here because the commands are run on infrastructure hosts that provide cross-agent connectivity and persistence.

Content

Scanner excerpt · SKILL.md (reported line 271)May include surrounding context.

Install on all machines:

bash

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up --ssh

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill claims the sandbox isolates private data, but it explicitly grants the sandbox broad messaging and session tools such as sessions_send, sessions_history, sessions_list, and message. Those capabilities create a practical exfiltration path from the sandbox workspace to other agents or external channels, so the isolation claim is overstated unless strict data-flow controls are added.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

Enable, start, and open firewall:

bash

sudo systemctl daemon-reload
sudo systemctl enable --now socat-bridge-docker0-gateway socat-bridge-docker0-vps-ssh
sudo ufw allow in on docker0 to 172.17.0.1 port 18789 proto tcp comment "socat-gateway"
sudo ufw allow in on docker0 to 172.17.0.1 port 2222 proto tcp comment "socat-vps-ssh"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.

Enable, start, and open firewall:

bash

sudo systemctl daemon-reload
sudo systemctl enable --now socat-bridge-docker0-gateway socat-bridge-docker0-vps-ssh
sudo ufw allow in on docker0 to 172.17.0.1 port 18789 proto tcp comment "socat-gateway"
sudo ufw allow in on docker0 to 172.17.0.1 port 2222 proto tcp comment "socat-vps-ssh"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

Enable, start, and open firewall:

bash

sudo systemctl daemon-reload
sudo systemctl enable --now socat-bridge-docker0-gateway socat-bridge-docker0-vps-ssh
sudo ufw allow in on docker0 to 172.17.0.1 port 18789 proto tcp comment "socat-gateway"
sudo ufw allow in on docker0 to 172.17.0.1 port 2222 proto tcp comment "socat-vps-ssh"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.

Enable, start, and open firewall:

bash

sudo systemctl daemon-reload
sudo systemctl enable --now socat-bridge-docker0-gateway socat-bridge-docker0-vps-ssh
sudo ufw allow in on docker0 to 172.17.0.1 port 18789 proto tcp comment "socat-gateway"
sudo ufw allow in on docker0 to 172.17.0.1 port 2222 proto tcp comment "socat-vps-ssh"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.

Enable, start, and open firewall:

bash

sudo systemctl daemon-reload
sudo systemctl enable --now socat-bridge-docker0-gateway socat-bridge-docker0-vps-ssh
sudo ufw allow in on docker0 to 172.17.0.1 port 18789 proto tcp comment "socat-gateway"
sudo ufw allow in on docker0 to 172.17.0.1 port 2222 proto tcp comment "socat-vps-ssh"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 279)May include surrounding context.

Enable, start, and open firewall:

bash

sudo systemctl daemon-reload
sudo systemctl enable --now socat-bridge-docker0-gateway socat-bridge-docker0-vps-ssh
sudo ufw allow in on docker0 to 172.17.0.1 port 18789 proto tcp comment "socat-gateway"
sudo ufw allow in on docker0 to 172.17.0.1 port 2222 proto tcp comment "socat-vps-ssh"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The skill instructs operators to enable persistent host services that automatically recreate network bridges across reboots. Persistence is intentional here, but it still increases attack surface because a misconfigured or later-compromised bridge remains available continuously and survives restarts.

Content

Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.

bash

sudo systemctl daemon-reload
sudo systemctl enable --now socat-bridge-docker0-gateway socat-bridge-docker0-vps-ssh
sudo ufw allow in on docker0 to 172.17.0.1 port 18789 proto tcp comment "socat-gateway"
sudo ufw allow in on docker0 to 172.17.0.1 port 2222 proto tcp comment "socat-vps-ssh"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documented SSH command uses StrictHostKeyChecking=no, which disables host identity verification and makes man-in-the-middle interception much easier. In this design, the SSH path bridges containers to a shared VPS, so trust on first use or disabled verification materially weakens the boundary protecting shared workspace access.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The key-constraints section states "all exec runs through Docker, never on host," which reads as a broad safety/property claim. However, the skill's actual procedure depends on host modifications including systemd service creation, UFW changes, Tailscale installation, and Docker image rebuilds, so the statement overstates the effective boundary described by the overall instructions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.