📦

sandbase

Name: sandbase
Author: sandbaseai

v0.1.17 Inhaltsrevision r1 Mittleres Risiko 🌐 Netzwerkzugriff⚙️ Externe Befehle

Access AI Models and APIs Through SandBase

Using many AI providers requires separate integrations, keys, and billing workflows. SandBase offers one MCP interface for inference, media, search, scraping, and structured APIs.

Unterstützt: Claude Codex Code(CC)

⚠️ 50 Schlecht

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage

Review the Skillstore skill "sandbase" from https://skillstore.io/skills/sandbaseai-sandbase.md and its manifest at https://skillstore.io/api/skills/sandbaseai-sandbase/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/sandbaseai-sandbase.md Signiertes manifest GET /api/skills/sandbaseai-sandbase/manifest Signiertes lockfile GET /api/skills/sandbaseai-sandbase/lockfile

Testen

„sandbase“ wird verwendet. Find a Twitter search tool for AI agent posts, but do not run it.

Erwartetes Ergebnis:

Recommended endpoint: Twitter web search timeline. It supports keyword search and returns structured posts. Inspect its schema and price before execution.

„sandbase“ wird verwendet. Generate one fast image of a mountain lake and report the cost.

Erwartetes Ergebnis:

Selected a fast Flux image endpoint after checking its input schema and fixed per-call price.
The image request completed successfully. The response includes the generated media result and the charged amount.

„sandbase“ wird verwendet. Check my five most recent SandBase calls.

Erwartetes Ergebnis:

The recent-call summary lists each model or API, completion status, and recorded cost for the five latest requests.

Sicherheitsaudit

Mittleres Risiko

v1 • 27.8.2026 Versionsbericht öffnen

Most static alerts are false positives caused by Markdown backticks, metadata links, and ordinary API documentation. The setup still downloads and executes a remote package, stores authentication state, and modifies supported client configuration.

Gescannte Dateien

238

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (2)

Mittel

SKILL.md:21

Unverified Remote Package Execution

The primary setup command tells users to execute a remote package through npx without checksum verification. A compromised release asset or hosting account could execute attacker-controlled installer code.

The command explicitly uses npx with automatic confirmation on an HTTPS package URL. A separate verified workflow exists, but the primary command does not use it.

Mittel

SKILL.md:32

Installer Changes Authentication and Client Configuration

The documented connection process stores a local session and installs an MCP bridge, configuration, and managed skill. These intended changes affect authentication state and supported client settings.

The skill explicitly states that the CLI stores a session record, detects supported clients, and installs the bridge, skill, and configuration.

Elemente der Fähigkeitsprüfung (2)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Mittel

SKILL.md:21

Hardcoded URL

npx -y https://github.com/sandbaseai/cli/releases/download/v0.1.17/sandbaseai-cli-0.1.17.tgz connect

The URL is passed directly to npx with automatic confirmation, so following the documented setup downloads and executes an external package. The release is version-pinned, but this default path does not verify its checksum.

Niedrig

SKILL.md:27

Hardcoded URL

curl -fLO https://github.com/sandbaseai/cli/releases/download/v0.1.17/sandbaseai-cli-0.1.17.tgz

The command downloads an external release asset over HTTPS, creating a real network and supply-chain dependency. The following line verifies a pinned SHA-256, which substantially limits the risk.

Risikofaktoren

🌐 Netzwerkzugriff (5)

skill.json:7 skill.json:8 SKILL.md:21 SKILL.md:27 SKILL.md:34

⚙️ Externe Befehle (47)

Geprüft von: codex

Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen

Berichtslink kopieren

https://skillstore.io/skills/sandbaseai-sandbase/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sandbaseai-sandbase/security.svg)](https://skillstore.io/skills/sandbaseai-sandbase?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/sandbaseai-sandbase?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sandbaseai-sandbase/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/sandbaseai-sandbase.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

sandbaseai. (2026). sandbase security audit report (audit version 1) [Author version 0.1.17]. Skillstore. https://skillstore.io/skills/sandbaseai-sandbase/audits/1

BibTeX-Zitat

@techreport{sandbaseai-sandbaseai-sandbase-2026,
  author = {sandbaseai},
  title = {sandbase security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/sandbaseai-sandbase/audits/1},
  note = {Author version 0.1.17}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "sandbase security audit report (audit version 1)"
version: "0.1.17"
type: report
authors:
  - name: "sandbaseai"
date-released: "2026-08-27"
url: "https://skillstore.io/skills/sandbaseai-sandbase/audits/1"
identifiers:
  - type: other
    value: "skillstore:sandbaseai-sandbase:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel

Architektur

100

Wartbarkeit

Inhalt

Gemeinschaft

Spezifikationskonformität

Was Sie erstellen können

Prototype Multimodal Features

Discover and compare available image, video, audio, and language endpoints before integrating one into a prototype.

Collect Structured Web Data

Find suitable search, scraping, or social data endpoints and run small, schema-validated requests.

Control AI Service Costs

Inspect prices, check account balance, and review recent call costs across supported providers.

Diese Prompts ausprobieren

Find a Suitable Tool

Use SandBase to find tools for [task]. Show the most relevant options, their vendors, and their model types. Do not run anything yet.

Inspect Before Running

Discover a SandBase endpoint for [task], inspect its schema and pricing, then summarize required inputs and expected cost before execution.

Run a Small Request

Find and inspect a SandBase endpoint for [task]. Run one request with a small limit using [inputs], then summarize the result and cost.

Manage an Async Workflow

Select and inspect an asynchronous SandBase endpoint for [task]. Confirm pricing, run it with [inputs], poll until completion, and report result, status, and cost.

Bewährte Praktiken

Discover endpoints first, then inspect the selected schema and pricing before execution.
Start search and scraping requests with small limits to validate result quality and cost.
Use the provided execution template and report costs when budget affects the task.

Vermeiden

Do not guess endpoint names or parameters without inspecting the current schema.
Do not use SandBase when the task is entirely local or the user selected another tool.
Do not start repeated paid calls without checking pricing, limits, and account balance.

Häufig gestellte Fragen

What does SandBase provide?

It provides one MCP interface for hosted AI models, media tools, search, scraping, embeddings, social data, and structured APIs.

Do I need provider API keys?

No provider keys are required. You need a SandBase account and must complete browser authentication for the local MCP connection.

How do I know an endpoint's inputs?

Run the inspection tool after discovery. It returns the input schema, pricing details, and an execution template.

Can calls incur charges?

Yes. Pricing may be token-based or per call. Inspect pricing and check your balance before running costly workloads.

How are long-running requests handled?

Some requests return a run identifier. Poll that run until it reports completion or failure.

When should I avoid SandBase?

Avoid it for local-only tasks, when the user selected another tool, or when an existing dedicated integration already meets the need.

Entwicklerdetails

Autor

sandbaseai

Lizenz

MIT

Autorenversion

v0.1.17

Skillstore-Revision

Repository

https://github.com/sandbaseai/cli/tree/399053acafff03cf6bcc745a4b99d6fcdd4a74b3/skills/sandbase

Ref.

da7532f435c2b905356e6595c506fc2342cf4215

Aktualität der Wartung

27.8.2026

Nutzung

0 Downloads · 0 Aufrufe

Dateistruktur

📄 skill.json

📄 SKILL.md