cloudflare-sandbox
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The core functionality of the skill involves executing shell commands and scripts within isolated Ubuntu containers via the
sandbox.exec()andsandbox.runCode()methods. This behavior is the primary intended use case for the SDK and is well-documented with safety warnings. - [INDIRECT_PROMPT_INJECTION]: The skill presents a potential attack surface by ingesting and executing external data (commands and code) in several templates (e.g.,
templates/chat-agent.ts,templates/basic-executor.ts). The provided remediation guidance inreferences/advanced.mdandreferences/common-errors.mdeffectively mitigates this risk by recommending allowlist-based validation and the use of a restricted Code Interpreter API. - [EXTERNAL_DOWNLOADS]: The skill facilitates the cloning of remote git repositories using the
gitCheckoutmethod. This feature is intended for development workflows such as CI/CD pipelines and workspace initialization. - [DATA_EXFILTRATION]: Patterns for backing up and restoring workspace data using Cloudflare R2 and KV are provided. The skill includes explicit warnings and implementation patterns to prevent the accidental logging or exposure of sensitive environment variables and API keys.
Audit Metadata