ai-sandbox
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of shell commands within various sandbox environments (Docker, local process, Daytona). Examples include provisioning steps like
pnpm installandcorepack enable. ThelocalProcessSandboxprovider specifically runs commands on the host machine without isolation; however, the documentation correctly labels this as intended for local development only. - [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill automates the cloning of external Git repositories into the sandbox workspace and the installation of their dependencies. While these actions fetch external code, they are core features of the sandbox environment management and are initiated based on developer configuration.
- [INDIRECT_PROMPT_INJECTION]: The skill establishes a data ingestion surface by reading content from external Git repositories and projecting it into instructions (e.g.,
AGENTS.md) that an agent may process, which could be leveraged for indirect prompt injection if the source repository contains malicious instructions. - Ingestion points: Git source repositories defined in
defineWorkspace. - Boundary markers: None explicitly documented in the instruction set.
- Capability inventory: The sandbox environment provides full file system access and shell execution capabilities to the agent harness.
- Sanitization: Not explicitly addressed in the provided documentation.
Audit Metadata