fanbox-agent

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This document exposes powerful remote-control capabilities (reading other terminals, sending arbitrary commands, creating autorun/scheduled tasks and programmatic bypass of confirmations) that can be readily abused for data exfiltration, credential theft, remote code execution/backdoors and persistent compromise.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 该 skill 的运行时会通过 curl "$FANBOX_CTL/read?id=t2&lines=100" 读取 FanBox 终端窗口的最近输出并将其作为可用文本（output）返回给 LLM/流程，从而间接摄入可由外部用户在窗口中生成的自由文本（如 claude/TUI 交互或命令回显）。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill issues runtime curl calls to the FanBox control endpoints (e.g. "$FANBOX_CTL/send" and "$FANBOX_CTL/create") which directly send prompts/commands to child agents or execute commands in remote terminals, so these external URLs control agent prompts and execution.