Security audit

Powershell Sandbox

Security checks for vulnerabilities and agentic risk

Overview

This package presents itself as a safe PowerShell sandbox, but the core sandbox implementation is missing while the docs and tests still claim security readiness.

Do not rely on this package to run untrusted PowerShell. Treat it as incomplete documentation until the real sandbox implementation is included, tested end to end, and reviewed under an operating-system isolation model.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: test/sandbox.test.js:33
Finding: Missing Sandbox Implementation Is Treated as a Passing Test
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: test/sandbox.test.js:55
Finding: Security Tests Do Not Exercise the Advertised Sandbox Controls
Content: View full analysis
{ const isBlocked = blockedPatterns[index].test(cmd); assert(isBlocked, `Should block: ${cmd.substring(0, 30)}...`); }); console.log(' ✅ Security restrictions work correctly'); this.passed++; ``` `test/sandbox.test.js:83-101`: ```javascript // Test timeout validation const validTimeouts = [1, 5, 30, 60, 300]; const invalidTimeouts = [-1, 0, null, undefined, 'abc']; validTimeouts.forEach(t => { assert(typeof t === 'number' && t > 0, `Should accept timeout: ${t}`); }); invalidTimeouts.forEach(t => { const isValid = typeof t === 'number' && t > 0; assert(!isValid, `Should reject invalid timeout: ${t}`); }); console.log(' ✅ Timeout control validation works correctly'); this.passed++; ``` `test/sandbox.test.js:108-124`: ```javascript // Test output size limiting logic const maxOutputSize = 10000; // 10KB const largeOutput = 'x'.repeat(15000); const truncated = largeOutput.length > maxOutputSize ? largeOutput.substring(0, maxOutputSize) + '\n... (truncated)' : largeOutput; assert(truncated.length <= maxOutputSize + 20, 'Output should be truncated'); as ...[truncated 3444 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill claims to provide a sandbox with command whitelisting, path isolation, and safe execution, but the only concrete execution example shown is a plain Start-Job invocation with timeout handling. Start-Job alone does not enforce command restrictions, filesystem confinement, or language/runtime isolation, so users may trust a security boundary that does not actually exist and execute untrusted PowerShell with near-normal capabilities.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file presents all user-facing instructions, warnings, and examples exclusively in Chinese, which effectively forces a specific language for use of the skill. Under the policy, locale or language constraints should be opt-in or clearly justified as region-specific, and neither is documented here.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: 文档把 System.Management.Automation.* 列为禁止类型，意图表达对 PowerShell 内部能力的限制；但后面的执行示例依赖 PowerShell Job 机制运行任意脚本，这正属于相关内部执行能力的一部分。对于“安全沙箱”定位而言，这种表述会让读者误以为这些能力被整体禁止，而实际执行路径仍然依赖它们。
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document makes strong security assurances such as 'ready for production use' and 'safe for untrusted scripts' while also listing missing security tests like file path isolation, output limits, and .NET type restriction validation. This can mislead operators into deploying the sandbox in a higher-trust context than warranted, increasing the chance that untrusted scripts bypass incomplete controls or abuse untested attack surfaces.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The natural-language description is written entirely in Chinese, which imposes a specific language/locale presentation without indicating any user choice or opt-in. Under the policy, language constraints should either offer a choice or be clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.