The string-based command interface can enable command injection when given untrusted input
Source references: 2The Skill defines `sandbox.exec(command)` as executing a complete command string and demonstrates a shell-style command, without also requiring user-controlled arguments to be separated, rejected, or safely encoded.
If generated application code concatenates request parameters, chat content, filenames, or other untrusted text into that command string, an attacker could execute additional commands inside the isolated container, read or alter its files, and use whatever outbound network access the container has. The supplied evidence does not show escape to the host.
The source confirms that `exec` accepts a command string and shows a fixed-string example, but it never instructs the agent to concatenate user input or shows an untrusted data flow. The interface alone therefore does not establish command injection. The risk would arise only if an application later interpolates unvalidated user input into that string, potentially allowing extra commands inside the sandbox. Users can ask the author to document every command argument’s source and restrict execution to fixed commands or strictly validated parameters.
This assessment concerns the code and conditions shown, not proof that harm has occurred.- `await sandbox.exec(command)` takes a **command string** and resolves when the command **finishes**, with buffered `stdout` / `stderr` / `exitCode` (and related fields).- Long-running and streaming work use the **stable** command APIs (`startProcess`, `execStream`, and related helpers)—not the `@next` single-handle model. Open the Commands docs; do not invent `@next` `output()` handles on stable.- **Sessions** can preserve working directory and environment across commands (default session / `enableDefaultSession`, `createSession`). See Sessions docs when state must carry across calls.Show 1 other places
const sandbox = getSandbox(env.Sandbox, "user-123");const result = await sandbox.exec('python3 -c "print(2 + 2)"');// result.stdout, result.exitCode, result.success```