Skip to content
Report library
Purpose / Other

Sandbox Stable Skill Security Audit

What the author says it does (original text)

Build or maintain Cloudflare Sandbox apps on the stable @cloudflare/sandbox package. Use sandbox-next for preview apps and sandbox-migrate-to-next for stable-to-preview migrations.

Independent security check

Security risks found

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

The string-based command interface can enable command injection when given untrusted input

Source references: 2
What we found

The Skill defines `sandbox.exec(command)` as executing a complete command string and demonstrates a shell-style command, without also requiring user-controlled arguments to be separated, rejected, or safely encoded.

Why this matters

If generated application code concatenates request parameters, chat content, filenames, or other untrusted text into that command string, an attacker could execute additional commands inside the isolated container, read or alter its files, and use whatever outbound network access the container has. The supplied evidence does not show escape to the host.

What this evidence establishes

The source confirms that `exec` accepts a command string and shows a fixed-string example, but it never instructs the agent to concatenate user input or shows an untrusted data flow. The interface alone therefore does not establish command injection. The risk would arise only if an application later interpolates unvalidated user input into that string, potentially allowing extra commands inside the sandbox. Users can ask the author to document every command argument’s source and restrict execution to fixed commands or strictly validated parameters.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:37In the instructionsOpen original file
- `await sandbox.exec(command)` takes a **command string** and resolves when the command **finishes**, with buffered `stdout` / `stderr` / `exitCode` (and related fields).- Long-running and streaming work use the **stable** command APIs (`startProcess`, `execStream`, and related helpers)—not the `@next` single-handle model. Open the Commands docs; do not invent `@next` `output()` handles on stable.- **Sessions** can preserve working directory and environment across commands (default session / `enableDefaultSession`, `createSession`). See Sessions docs when state must carry across calls.
Show 1 other places
SKILL.md:55In the instructionsOpen original file
const sandbox = getSandbox(env.Sandbox, "user-123");const result = await sandbox.exec('python3 -c "print(2 + 2)"');// result.stdout, result.exitCode, result.success```
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

4 instruction sections

This Skill is a development guide and documentation map for the stable Cloudflare Sandbox package. It requires checking that both the Worker dependency and container image are on the stable line, and stopping for a different Skill when preview packages or migration work are detected.

View source
SKILL.md:22In the instructionsOpen original file
| ----- | ---------- || npm dependency | Default `@cloudflare/sandbox` (**not** `@next` / preview tags) || Container image | Matching **stable** image (not `cloudflare/sandbox:next`) || If you find… | Action || ------------ | ------ || `@cloudflare/sandbox@next` or a `next` image | **Stop.** Load **`sandbox-next`**. || User wants to port to 1.0 / `@next` | **Stop.** Load **`sandbox-migrate-to-next`**. Do not half-apply preview APIs on a stable package. || Only cleaning deprecated stable APIs | Stay here; use the [2026 deprecation guide](https://developers.cloudflare.com/sandbox/guides/2026-deprecation/). That is **not** a move to `@next`. |
SKILL.md:31In the instructionsOpen original file
Never mix a stable Worker package with an `@next` container image (or the reverse).

The Skill guides applications that drive isolated Linux environments from Cloudflare Workers and links to capabilities including command execution, processes, files, mounts, ports, tunnels, backups, and an interpreter.

View source
SKILL.md:8In the instructionsOpen original file
Isolated Linux environments on [Cloudflare Containers](https://developers.cloudflare.com/containers/), driven from Workers.
SKILL.md:37In the instructionsOpen original file
- `await sandbox.exec(command)` takes a **command string** and resolves when the command **finishes**, with buffered `stdout` / `stderr` / `exitCode` (and related fields).- Long-running and streaming work use the **stable** command APIs (`startProcess`, `execStream`, and related helpers)—not the `@next` single-handle model. Open the Commands docs; do not invent `@next` `output()` handles on stable.- **Sessions** can preserve working directory and environment across commands (default session / `enableDefaultSession`, `createSession`). See Sessions docs when state must carry across calls.- Interactive browser terminals often use **`sandbox.terminal(request)`** and session/xterm helpers on stable—not preview `createTerminal` unless the package is `@next`.- Prefer **RPC** transport when using tunnels or large/binary streaming. HTTP/WebSocket transports are deprecated (cleanup guide below).- Files, mounts, ports, tunnels, backups, lifecycle, and interpreter: use main docs for signatures; trust installed **stable** types.- Non-secret config in sandbox env; live credentials in the Worker. Use outbound handlers when processes call external APIs.

The Skill explicitly separates non-secret configuration from live credentials: non-secret configuration may be placed in the sandbox environment, while live credentials should remain in the Worker and external API calls should use outbound handlers.

View source
SKILL.md:43In the instructionsOpen original file
- Files, mounts, ports, tunnels, backups, lifecycle, and interpreter: use main docs for signatures; trust installed **stable** types.- Non-secret config in sandbox env; live credentials in the Worker. Use outbound handlers when processes call external APIs.- Production preview hostnames need wildcard DNS on a custom domain when using those URL patterns.
SKILL.md:108In the instructionsOpen original file
- Typecheck against installed stable types  - No live secrets in sandbox env  - If using deprecated transports/helpers, finish or track [2026 deprecation](https://developers.cloudflare.com/sandbox/guides/2026-deprecation/) cleanup  
Start here · InstructionsSKILL.md
sandbox-stable
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:8In the instructionsOpen original file
Isolated Linux environments on [Cloudflare Containers](https://developers.cloudflare.com/containers/), driven from Workers.
SKILL.md:12In the instructionsOpen original file
This line is the **current stable** default npm package. The main [Sandbox documentation](https://developers.cloudflare.com/sandbox/) describes it. Existing apps can stay here and keep shipping.
SKILL.md:29In the instructionsOpen original file
| User wants to port to 1.0 / `@next` | **Stop.** Load **`sandbox-migrate-to-next`**. Do not half-apply preview APIs on a stable package. || Only cleaning deprecated stable APIs | Stay here; use the [2026 deprecation guide](https://developers.cloudflare.com/sandbox/guides/2026-deprecation/). That is **not** a move to `@next`. |
Read keys or account settings
SKILL.md:43In the instructionsOpen original file
- Files, mounts, ports, tunnels, backups, lifecycle, and interpreter: use main docs for signatures; trust installed **stable** types.- Non-secret config in sandbox env; live credentials in the Worker. Use outbound handlers when processes call external APIs.- Production preview hostnames need wildcard DNS on a custom domain when using those URL patterns.
Read files
SKILL.md:99In the instructionsOpen original file
```shrg 'SANDBOX_TRANSPORT|transport:|exposePort\(|enableDefaultSession|execStream\(|readFileStream|writeFileStream'```
Change files
SKILL.md:99In the instructionsOpen original file
```shrg 'SANDBOX_TRANSPORT|transport:|exposePort\(|enableDefaultSession|execStream\(|readFileStream|writeFileStream'```
Lines read
111
File checksum (to compare versions)
a3e8383ba58b74145428219829aedb37d16906ae2d727c8d71a860c09adbd53f