Skill Sandbox

Sandboxed installation pipeline for ClawHub skills. Install → Stage → Scan → Promote or Quarantine.

Quick Start

CODEBLOCK0

How It Works

1. 1. Stage — Skill is installed to skills/_staging/<name> (never directly to live)
2. Scan — 5-layer automated security scan runs:

1. 3. Verdict:

Scan Details

Critical Findings (auto-quarantine)

• - eval(), new Function() — dynamic code execution
• Symlinks — path traversal risk
• INLINECODE4 / preinstall scripts in package.json — npm supply chain vector
• Dangerous SKILL.md instructions (disable security, exfiltrate, reverse shells, chmod 777)

Warning Findings (review recommended)

• - Network calls (fetch, curl, axios, http)
• Shell execution (child_process, exec, spawn, subprocess)
• Environment/secret access (process.env, API_KEY, TOKEN)
• Base64 encoding patterns (potential obfuscation)
• File system writes
• Hidden files (excluding .clawhub/)
• Non-text binary files

Integration with Agent Workflows

For teams using security auditor agents (like Sentinel), the recommended flow:

1. 1. Run skill-sandbox.sh for the fast automated scan
2. If WARN or FAIL → spawn your security agent for a deep LLM-powered audit of the staged files
3. After agent clears it → INLINECODE19

Directory Structure

CODEBLOCK1

Notes

• - The _staging/ directory should be added to INLINECODE21
• Clean skills auto-promote — no manual step needed for safe installs
• The script returns exit codes: 0 (pass/warn), 2 (fail) for CI integration
• All scan patterns are static regex — no network calls, no external dependencies