📦

sandbase

Name: sandbase
Author: sandbaseai

v0.1.17 コンテンツリビジョン r1 中リスク 🌐 ネットワークアクセス⚙️ 外部コマンド

Access AI Models and APIs Through SandBase

Using many AI providers requires separate integrations, keys, and billing workflows. SandBase offers one MCP interface for inference, media, search, scraping, and structured APIs.

対応: Claude Codex Code(CC)

⚠️ 50 不十分

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト

Review the Skillstore skill "sandbase" from https://skillstore.io/skills/sandbaseai-sandbase.md and its manifest at https://skillstore.io/api/skills/sandbaseai-sandbase/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

Markdown詳細 GET /skills/sandbaseai-sandbase.md 署名済み manifest GET /api/skills/sandbaseai-sandbase/manifest 署名済み lockfile GET /api/skills/sandbaseai-sandbase/lockfile

テストする

「sandbase」を使用しています。 Find a Twitter search tool for AI agent posts, but do not run it.

期待される結果:

Recommended endpoint: Twitter web search timeline. It supports keyword search and returns structured posts. Inspect its schema and price before execution.

「sandbase」を使用しています。 Generate one fast image of a mountain lake and report the cost.

期待される結果:

Selected a fast Flux image endpoint after checking its input schema and fixed per-call price.
The image request completed successfully. The response includes the generated media result and the charged amount.

「sandbase」を使用しています。 Check my five most recent SandBase calls.

期待される結果:

The recent-call summary lists each model or API, completion status, and recorded cost for the five latest requests.

セキュリティ監査

中リスク

v1 • 2026/8/27 バージョン別レポートを開く

Most static alerts are false positives caused by Markdown backticks, metadata links, and ordinary API documentation. The setup still downloads and executes a remote package, stores authentication state, and modifies supported client configuration.

スキャンされたファイル

238

解析済み行数

レビュー項目

誤検知を無視

確認済みのセキュリティ上の懸念 (2)

中

SKILL.md:21

Unverified Remote Package Execution

The primary setup command tells users to execute a remote package through npx without checksum verification. A compromised release asset or hosting account could execute attacker-controlled installer code.

The command explicitly uses npx with automatic confirmation on an HTTPS package URL. A separate verified workflow exists, but the primary command does not use it.

中

SKILL.md:32

Installer Changes Authentication and Client Configuration

The documented connection process stores a local session and installs an MCP bridge, configuration, and managed skill. These intended changes affect authentication state and supported client settings.

The skill explicitly states that the CLI stores a session record, detects supported clients, and installs the bridge, skill, and configuration.

機能レビュー項目 (2)

これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。

中

SKILL.md:21

Hardcoded URL

npx -y https://github.com/sandbaseai/cli/releases/download/v0.1.17/sandbaseai-cli-0.1.17.tgz connect

The URL is passed directly to npx with automatic confirmation, so following the documented setup downloads and executes an external package. The release is version-pinned, but this default path does not verify its checksum.

低

SKILL.md:27

Hardcoded URL

curl -fLO https://github.com/sandbaseai/cli/releases/download/v0.1.17/sandbaseai-cli-0.1.17.tgz

The command downloads an external release asset over HTTPS, creating a real network and supply-chain dependency. The following line verifies a pinned SHA-256, which substantially limits the risk.

リスク要因

🌐 ネットワークアクセス (5)

skill.json:7 skill.json:8 SKILL.md:21 SKILL.md:27 SKILL.md:34

⚙️ 外部コマンド (47)

監査者: codex

このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く

レポートリンクをコピー

https://skillstore.io/skills/sandbaseai-sandbase/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/sandbaseai-sandbase/security.svg)](https://skillstore.io/skills/sandbaseai-sandbase?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/sandbaseai-sandbase?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sandbaseai-sandbase/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/sandbaseai-sandbase.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学術引用 (APA · BibTeX · CFF)

APA形式の引用

sandbaseai. (2026). sandbase security audit report (audit version 1) [Author version 0.1.17]. Skillstore. https://skillstore.io/skills/sandbaseai-sandbase/audits/1

BibTeX形式の引用

@techreport{sandbaseai-sandbaseai-sandbase-2026,
  author = {sandbaseai},
  title = {sandbase security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/sandbaseai-sandbase/audits/1},
  note = {Author version 0.1.17}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "sandbase security audit report (audit version 1)"
version: "0.1.17"
type: report
authors:
  - name: "sandbaseai"
date-released: "2026-08-27"
url: "https://skillstore.io/skills/sandbaseai-sandbase/audits/1"
identifiers:
  - type: other
    value: "skillstore:sandbaseai-sandbase:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore スコア

このスコアの理由証拠の信頼度: 中

アーキテクチャ

100

保守性

コンテンツ

コミュニティ

仕様準拠

作成できるもの

Prototype Multimodal Features

Discover and compare available image, video, audio, and language endpoints before integrating one into a prototype.

Collect Structured Web Data

Find suitable search, scraping, or social data endpoints and run small, schema-validated requests.

Control AI Service Costs

Inspect prices, check account balance, and review recent call costs across supported providers.

これらのプロンプトを試す

Find a Suitable Tool

Use SandBase to find tools for [task]. Show the most relevant options, their vendors, and their model types. Do not run anything yet.

Inspect Before Running

Discover a SandBase endpoint for [task], inspect its schema and pricing, then summarize required inputs and expected cost before execution.

Run a Small Request

Find and inspect a SandBase endpoint for [task]. Run one request with a small limit using [inputs], then summarize the result and cost.

Manage an Async Workflow

Select and inspect an asynchronous SandBase endpoint for [task]. Confirm pricing, run it with [inputs], poll until completion, and report result, status, and cost.

ベストプラクティス

Discover endpoints first, then inspect the selected schema and pricing before execution.
Start search and scraping requests with small limits to validate result quality and cost.
Use the provided execution template and report costs when budget affects the task.

回避

Do not guess endpoint names or parameters without inspecting the current schema.
Do not use SandBase when the task is entirely local or the user selected another tool.
Do not start repeated paid calls without checking pricing, limits, and account balance.

よくある質問

What does SandBase provide?

It provides one MCP interface for hosted AI models, media tools, search, scraping, embeddings, social data, and structured APIs.

Do I need provider API keys?

No provider keys are required. You need a SandBase account and must complete browser authentication for the local MCP connection.

How do I know an endpoint's inputs?

Run the inspection tool after discovery. It returns the input schema, pricing details, and an execution template.

Can calls incur charges?

Yes. Pricing may be token-based or per call. Inspect pricing and check your balance before running costly workloads.

How are long-running requests handled?

Some requests return a run identifier. Poll that run until it reports completion or failure.

When should I avoid SandBase?

Avoid it for local-only tasks, when the user selected another tool, or when an existing dedicated integration already meets the need.

開発者情報

作成者

sandbaseai

ライセンス

MIT

作者バージョン

v0.1.17

Skillstore リビジョン

リポジトリ

https://github.com/sandbaseai/cli/tree/399053acafff03cf6bcc745a4b99d6fcdd4a74b3/skills/sandbase

参照

da7532f435c2b905356e6595c506fc2342cf4215

メンテナンスの新しさ

2026/8/27

利用状況

0 ダウンロード · 0 閲覧

ファイル構成

📄 skill.json

📄 SKILL.md