docker-sandbox
Fail
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the user or agent to run
curl -fsSL https://box.ascii.dev/install | sh. This executes a remote script directly in the shell with full user privileges, a critical security risk that allows an unverified external server to run arbitrary code on the host machine. - [EXTERNAL_DOWNLOADS]: The skill downloads and executes code from the unverified domain
https://box.ascii.dev. This domain is not identified as a recognized trusted organization or well-known service in the skill configuration. - [COMMAND_EXECUTION]: The skill invokes local shell commands for installation and leverages the third-party
boxCLI to manage virtual machines and execute code on remote systems via SSH.
Recommendations
- HIGH: Downloads and executes remote code from: https://box.ascii.dev/install - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata