rivet-sandbox-agent
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The documentation references multiple APIs for executing shell commands and managing processes, such as 'Run a one-shot command' (post_v1_processes_run) and 'Create a long-lived managed process' (post_v1_processes).
- [REMOTE_CODE_EXECUTION]: The skill facilitates the operation of coding agents (e.g., Amp, Codex, Claude) that are designed to execute code and commands dynamically within the sandbox environment.
- [DATA_EXFILTRATION]: The documentation describes several data-access capabilities that could be used for exposure if compromised, including reading files (get_v1_fs_file), capturing desktop screenshots (get_v1_desktop_screenshot), and reading the system clipboard (get_v1_desktop_clipboard).
- [INDIRECT_PROMPT_INJECTION]: The skill serves as a platform for agents to process potentially untrusted data (like source code or web content) while maintaining high-privilege system access.
- Ingestion points: Untrusted data enters the context through files, URLs, or external repositories being processed by the agents (referenced in 'File System' and 'WebRTC signaling' documentation).
- Boundary markers: None explicitly defined in the provided documentation structure to separate untrusted data from agent instructions.
- Capability inventory: Comprehensive, including process management (SIGKILL/SIGTERM), file system writes (post_v1_fs_upload_batch), and desktop interaction (post_v1_desktop_keyboard_type).
- Sanitization: While the documentation mentions a 'sandbox', the instructions do not detail specific sanitization or filtering of embedded instructions within processed content.
Audit Metadata