Security audit

Code Sandbox

Security checks for vulnerabilities and agentic risk

Overview

This skill is a code runner marketed as a secure sandbox, but it executes submitted code directly on the host with insufficient containment.

Review before installing. Use this only for code you already trust or inside a separate disposable container or VM with no secrets in the environment and restricted filesystem and network access. Do not expose it to strangers or agent-generated code until real containment, resource limits, and cleanup controls are implemented.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/sandbox.js:246
Finding: Submitted Code Executes with Unrestricted Host Access
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/sandbox.js:222
Finding: Timeout Handling Does Not Reliably Terminate Descendants and Skips Cleanup
Content: View full analysis
{ const process = exec(command, options, (error, stdout, stderr) => { if (error) { resolve({ error, stdout, stderr }); } else { resolve({ error: null, stdout, stderr }); } }); // Timeout handling setTimeout(() => { process.kill(); reject(new Error(`Execution timeout after ${timeout}ms`)); }, timeout); }); } ``` The Node.js executor then performs cleanup only on the normal path: ```javascript try { // Create temp directory const tmpPath = await this.createTempDir(); const codeFile = path.join(tmpPath, 'script.js'); // Write code to file await fs.writeFile(codeFile, request.code, 'utf8'); // Execute with Node.js const result = await this.executeWithTimeout( `node "${codeFile}"`, { cwd: tmpPath, maxBuffer: 10 * 1024 * 1024, // 10MB buffer env: { ...process.env, NODE_ENV: 'sandbox' }, }, timeout ); // Cleanup await this.cleanupTempDir(tmpPath); return { success: !result.error, output: result.stdout || '', error: result.error ? result.error.message : '', exitCode: result.error?.code || 0, executionTime: Date.now() - startTime, memoryUsed: 0, // Would need process monitoring for accurate measurement }; } catch (error) { return { success: false, output: '', error: error.message, exitCode: -1, executionTime: Date.now() - startTime, memoryUsed: 0, }; } ``` Equivalent cleanup patterns are used by the Python, Go, and Rust executors. ### Technical Analysis `child_process.exec()` launches the requested command through a shell. Ca ...[truncated 2549 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file advertises a secure, isolated sandbox with Docker, Job Objects, and vm2, but the implementation actually writes attacker-controlled code to disk and executes it directly on the host using Node, Python, Go, and Rust toolchains. This is dangerous because callers may trust the safety claims and run untrusted code that can access the host filesystem, network, processes, and other local resources with the privileges of the service.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The Node executor passes the full parent environment into untrusted code via env: { ...process.env, NODE_ENV: 'sandbox' }, which can leak API keys, tokens, cloud credentials, internal URLs, and other secrets directly to attacker-controlled code. Because the code is not actually sandboxed, the executed program can immediately exfiltrate those secrets or use them to pivot into external systems.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is marketed as a 'Secure code execution sandbox' while the same document later admits it lacks critical protections such as network isolation, strong containment, and enforced memory controls. This can cause operators or downstream agents to trust it for untrusted-code execution, creating a dangerous mismatch between perceived and actual security boundaries.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation claims resource limits and security features including CPU/memory constraints, but later states memory limit enforcement is not implemented and stronger isolation is only planned. This inconsistency may lead users to run hostile workloads under false assumptions, enabling denial-of-service, data access, or network abuse from insufficiently isolated code.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file presents the skill-related testing report in Chinese only, beginning with the title and continuing throughout the document. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in, and this file does not indicate any optional language selection or region-specific justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The report documents a code-execution sandbox that records execution history while also explicitly noting missing protections such as no containerization, no memory enforcement, no network isolation, and no read-only filesystem mode. Because it says the prototype can be used and does not prominently warn against untrusted code at the point where execution and history features are described, users may deploy or use it unsafely, leading to code execution abuse, data exposure, or host compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The implementation persists supplied source code to temporary files on disk before execution, but there is no disclosure to users that their code may be stored locally. This can expose sensitive source content through forensic recovery, backups, endpoint monitoring, race/access by other local users if permissions are weak, or incomplete cleanup after crashes/timeouts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill executes arbitrary user-supplied code locally through interpreters and compilers, yet presents itself as a sandbox service and even includes a demo path that runs code immediately. In an agent-skill context, this is especially dangerous because users or downstream components may invoke it expecting containment, resulting in silent local code execution on the host.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/sandbox.js:227