The Agent Skills Directory

[COMMAND_EXECUTION]: The DockerSandbox.exec() method contains a critical shell injection vulnerability. The logic intended to escape single quotes (command.replace(/'/g, "'\\''")) fails when the resulting string is wrapped in single quotes for a host-level execSync call. This allows an attacker to terminate the argument string and execute arbitrary commands on the host machine.
[COMMAND_EXECUTION]: The DockerSandbox.start() method is vulnerable to host-level command injection. It directly interpolates configuration properties such as workDir, image, and allowedEnvVars into the shell command string passed to execSync without sanitization or escaping.
[PRIVILEGE_ESCALATION]: The sandbox escape vulnerability in DockerSandbox allows an agent restricted to a container to execute commands with the privileges of the host user, representing a significant privilege escalation risk.
[COMMAND_EXECUTION]: The AgentSandbox implementation uses a fragile, keyword-based blocklist for command filtering. This is a poor security practice that is easily bypassed by shell metacharacters, subshells, or encoded inputs.
[DYNAMIC_EXECUTION]: The skill makes heavy use of execSync to run arbitrary strings as shell commands. While intended for sandboxing, the lack of robust input validation in the provided templates poses a direct risk if an AI agent populates these commands with unvalidated user input.

agent-sandbox