app-platform-sandbox

[Skill Scanner] Installation of third-party script detected All findings: [CRITICAL] command_injection: Installation of third-party script detected (SC006) [AITech 9.1.4] [CRITICAL] command_injection: Installation of third-party script detected (SC006) [AITech 9.1.4] [CRITICAL] command_injection: Installation of third-party script detected (SC006) [AITech 9.1.4] This skill document describes a legitimate sandboxing SDK whose capabilities (arbitrary command execution, file I/O, public port exposure, custom images, and pool management) match its stated purpose. There are no signs of obfuscated or covert malicious code in this documentation. The primary risks are inherent to the feature set: running untrusted code and untrusted images, possible snapshotting of secrets, and exposing network ports. Those are operational/security risks rather than indicators of supply-chain malware in the provided files. Recommend ensuring strong access controls, network egress restrictions, and guidance to avoid storing secrets in sandboxes/snapshots. LLM verification: This Skill's intent and documented capabilities are aligned: it legitimately provides sandboxed container execution and hot-pool features. The content itself does not contain obfuscated or directly malicious code or hardcoded secrets. However, the feature set inherently enables high-risk actions (arbitrary code execution inside containers, unbounded network egress, pulling third-party/custom images, operations using cloud credentials). The documentation also includes unpinned pip installs and re