Security audit

E2b Sandbox Runtime

Security checks for vulnerabilities and agentic risk

Overview

This skill should be reviewed carefully because it mixes an E2B sandbox runtime with unrelated finance/ZVT automation while granting broad command, network, credential, and persistence authority.

Install only after reviewing the mixed E2B and finance/ZVT scope. Use it only if you intentionally want a broad sandbox/runtime assistant that may install packages, run commands, expose ports, handle tokens, preserve state, and generate finance workflow code; otherwise wait for the publisher to split or reconcile the artifacts and narrow the triggers.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The file is presented as an E2B sandbox runtime skill, but the bulk of its behavior, architecture, preconditions, validators, and user-facing text are for a finance/ZVT quant-strategy generator. This kind of identity mismatch is dangerous because it can cause the host agent to invoke the skill under the wrong trust assumptions, execute unrelated finance workflows, or solicit/install unintended dependencies and commands.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The human-facing sections explicitly advertise A-share quant strategy assistance rather than sandbox-runtime operations. That makes the skill socially misleading: users and calling agents may grant permissions or provide inputs expecting one capability while the installed content drives a different workflow.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The architecture section documents a finance data/trading pipeline while the skill claims to be an E2B sandbox runtime. Contradictory architecture increases the chance that downstream agents enforce the wrong safeguards, ask the wrong preconditions, or generate/routinely execute code for an unintended domain.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The summary explicitly advertises file upload/edit/watch capabilities, long-running background servers with port exposure, and one-off shell command execution, but it does not warn users about the security implications or define safety boundaries. In an agent skill that executes AI-generated code inside a cloud sandbox, these capabilities materially increase the risk of abuse such as unauthorized file modification, data exposure via open ports, or harmful command execution if users are not clearly informed and protected.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The execute trigger matches very broad verbs like run/execute/fetch/collect, which are common in benign conversation and many unrelated tasks. In a skill that can lead to command execution and environment manipulation, overly broad activation materially increases the risk of accidental invocation and unintended side effects.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: Use-case trigger terms like run, exec, shell, command, server, watch, and write are extremely generic and likely to collide with ordinary requests. Because this skill can perform sandbox actions, ambiguous trigger terms create a real accidental-execution surface rather than a mere UX issue.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: Advertising single-word sample triggers like run, exec, shell, server, and port trains users and host systems toward ambiguous invocations. In a skill with execution capability, that increases the likelihood of confused-deputy behavior and invocation of the wrong workflow.

Static analysis

No suspicious patterns detected.