The Agent Skills Directory

[EXTERNAL_DOWNLOADS] (LOW): The skill references the installation of @cloudflare/sandbox via npm and the use of the docker.io/cloudflare/sandbox image. These are downgraded to LOW/INFO per [TRUST-SCOPE-RULE] as Cloudflare is a verified trusted organization.
[COMMAND_EXECUTION] (LOW): The skill documents methods for executing shell commands (sandbox.exec) and code (sandbox.runCode). While these are high-risk capabilities, they are the primary purpose of the sandbox SDK and are documented here as part of a legitimate developer toolset.
[Indirect Prompt Injection] (HIGH): Evaluation of attack surface for data processed at runtime.
Ingestion points: sandbox.runCode(code, ...) and sandbox.writeFile(path, content) in SKILL.md take arbitrary strings likely generated by an LLM.
Boundary markers: Absent in the provided code patterns.
Capability inventory: Shell command execution (exec), arbitrary code execution (runCode), file system writes/reads (writeFile, readFile), and network port exposure (exposePort).
Sanitization: No sanitization or validation of the input strings is described in the skill instructions.
Analysis: As a code execution tool, this skill presents a high-tier vulnerability surface if the agent uses it to execute code derived from untrusted external data (e.g., summarizing a webpage and then 'writing' a script). The sandbox environment itself is the primary security control.

sandbox-sdk