setup-review-sandbox
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download security keys and repository metadata from gvisor.dev and storage.googleapis.com. These are well-known domains associated with the gVisor project and Google Cloud storage.- [COMMAND_EXECUTION]: The skill executes repository-local scripts, specifically tools/review-sandbox/build-image.sh and .claude/tools/sandbox. These are used to construct the toolchain container image and manage the sandbox lifecycle.- [PRIVILEGE_ESCALATION]: The documentation includes several sudo commands for the user to execute manually in their terminal. These commands are necessary for system-level configuration, such as installing packages, managing the Docker daemon, and loading the veth kernel module. The skill does not attempt to execute these commands automatically.- [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill is intended to prepare an environment for running untrusted pull request code.
- Boundary markers: Isolation is enforced via gVisor (runsc) on Linux and a virtual machine on macOS to prevent guest code from affecting the host.
- Capability inventory: The skill uses docker run, docker build, and custom bash scripts to manage the lifecycle of the sandbox containers.
- Sanitization: The security model relies on kernel-level isolation provided by gVisor to mitigate the risks associated with executing untrusted code.
Audit Metadata