ai-sandbox

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The workspace source "https://github.com/owner/repo" is cloned into the sandbox at runtime (defineWorkspace.source) and the sandbox runs setup commands there (e.g., pnpm install / pnpm test), so the fetched repo content can directly control agent context/prompts and cause remote-executed code to run.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (low risk: 0.30). The document explicitly recommends using sudo in provider setup ("must use sudo -n") and exposes non-isolated host execution (localProcessSandbox()), which encourages elevated or host-modifying operations, but it does not instruct the agent to create users, edit systemctl/ssh configs, or actively bypass security—so the risk is present but limited.