스킬 sandbase

📦

sandbase

Name: sandbase
Author: sandbaseai

v0.1.17 콘텐츠 리비전 r1 중간 위험 🌐 네트워크 접근⚙️ 외부 명령어

Access AI Models and APIs Through SandBase

Using many AI providers requires separate integrations, keys, and billing workflows. SandBase offers one MCP interface for inference, media, search, scraping, and structured APIs.

지원: Claude Codex Code(CC)

⚠️ 50 나쁨

Maintain this Skill? Claim it ⚠️ 50 나쁨

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "sandbase" from https://skillstore.io/skills/sandbaseai-sandbase.md and its manifest at https://skillstore.io/api/skills/sandbaseai-sandbase/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/sandbaseai-sandbase.md 서명된 manifest GET /api/skills/sandbaseai-sandbase/manifest 서명된 lockfile GET /api/skills/sandbaseai-sandbase/lockfile

테스트해 보기

"sandbase" 사용 중입니다. Find a Twitter search tool for AI agent posts, but do not run it.

예상 결과:

Recommended endpoint: Twitter web search timeline. It supports keyword search and returns structured posts. Inspect its schema and price before execution.

"sandbase" 사용 중입니다. Generate one fast image of a mountain lake and report the cost.

예상 결과:

Selected a fast Flux image endpoint after checking its input schema and fixed per-call price.
The image request completed successfully. The response includes the generated media result and the charged amount.

"sandbase" 사용 중입니다. Check my five most recent SandBase calls.

예상 결과:

The recent-call summary lists each model or API, completion status, and recorded cost for the five latest requests.

보안 감사

중간 위험

v1 • 2026. 8. 27. 버전별 보고서 열기

Most static alerts are false positives caused by Markdown backticks, metadata links, and ordinary API documentation. The setup still downloads and executes a remote package, stores authentication state, and modifies supported client configuration.

스캔된 파일

238

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (2)

중간

SKILL.md:21

Unverified Remote Package Execution

The primary setup command tells users to execute a remote package through npx without checksum verification. A compromised release asset or hosting account could execute attacker-controlled installer code.

The command explicitly uses npx with automatic confirmation on an HTTPS package URL. A separate verified workflow exists, but the primary command does not use it.

중간

SKILL.md:32

Installer Changes Authentication and Client Configuration

The documented connection process stores a local session and installs an MCP bridge, configuration, and managed skill. These intended changes affect authentication state and supported client settings.

The skill explicitly states that the CLI stores a session record, detects supported clients, and installs the bridge, skill, and configuration.

기능 검토 항목 (2)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

중간

SKILL.md:21

Hardcoded URL

npx -y https://github.com/sandbaseai/cli/releases/download/v0.1.17/sandbaseai-cli-0.1.17.tgz connect

The URL is passed directly to npx with automatic confirmation, so following the documented setup downloads and executes an external package. The release is version-pinned, but this default path does not verify its checksum.

낮음

SKILL.md:27

Hardcoded URL

curl -fLO https://github.com/sandbaseai/cli/releases/download/v0.1.17/sandbaseai-cli-0.1.17.tgz

The command downloads an external release asset over HTTPS, creating a real network and supply-chain dependency. The following line verifies a pinned SHA-256, which substantially limits the risk.

위험 요인

🌐 네트워크 접근 (5)

skill.json:7 skill.json:8 SKILL.md:21 SKILL.md:27 SKILL.md:34

⚙️ 외부 명령어 (47)

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/sandbaseai-sandbase/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/sandbaseai-sandbase/security.svg)](https://skillstore.io/skills/sandbaseai-sandbase?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/sandbaseai-sandbase?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sandbaseai-sandbase/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/sandbaseai-sandbase.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

sandbaseai. (2026). sandbase security audit report (audit version 1) [Author version 0.1.17]. Skillstore. https://skillstore.io/skills/sandbaseai-sandbase/audits/1

BibTeX 인용

@techreport{sandbaseai-sandbaseai-sandbase-2026,
  author = {sandbaseai},
  title = {sandbase security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/sandbaseai-sandbase/audits/1},
  note = {Author version 0.1.17}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "sandbase security audit report (audit version 1)"
version: "0.1.17"
type: report
authors:
  - name: "sandbaseai"
date-released: "2026-08-27"
url: "https://skillstore.io/skills/sandbaseai-sandbase/audits/1"
identifiers:
  - type: other
    value: "skillstore:sandbaseai-sandbase:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

100

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Prototype Multimodal Features

Discover and compare available image, video, audio, and language endpoints before integrating one into a prototype.

Collect Structured Web Data

Find suitable search, scraping, or social data endpoints and run small, schema-validated requests.

Control AI Service Costs

Inspect prices, check account balance, and review recent call costs across supported providers.

이 프롬프트를 사용해 보세요

Find a Suitable Tool

Use SandBase to find tools for [task]. Show the most relevant options, their vendors, and their model types. Do not run anything yet.

Inspect Before Running

Discover a SandBase endpoint for [task], inspect its schema and pricing, then summarize required inputs and expected cost before execution.

Run a Small Request

Find and inspect a SandBase endpoint for [task]. Run one request with a small limit using [inputs], then summarize the result and cost.

Manage an Async Workflow

Select and inspect an asynchronous SandBase endpoint for [task]. Confirm pricing, run it with [inputs], poll until completion, and report result, status, and cost.

모범 사례

Discover endpoints first, then inspect the selected schema and pricing before execution.
Start search and scraping requests with small limits to validate result quality and cost.
Use the provided execution template and report costs when budget affects the task.

피하기

Do not guess endpoint names or parameters without inspecting the current schema.
Do not use SandBase when the task is entirely local or the user selected another tool.
Do not start repeated paid calls without checking pricing, limits, and account balance.

자주 묻는 질문

What does SandBase provide?

It provides one MCP interface for hosted AI models, media tools, search, scraping, embeddings, social data, and structured APIs.

Do I need provider API keys?

No provider keys are required. You need a SandBase account and must complete browser authentication for the local MCP connection.

How do I know an endpoint's inputs?

Run the inspection tool after discovery. It returns the input schema, pricing details, and an execution template.

Can calls incur charges?

Yes. Pricing may be token-based or per call. Inspect pricing and check your balance before running costly workloads.

How are long-running requests handled?

Some requests return a run identifier. Poll that run until it reports completion or failure.

When should I avoid SandBase?

Avoid it for local-only tasks, when the user selected another tool, or when an existing dedicated integration already meets the need.

개발자 세부 정보

작성자

sandbaseai

라이선스

MIT

작성자 버전

v0.1.17

Skillstore 리비전

리포지토리

https://github.com/sandbaseai/cli/tree/399053acafff03cf6bcc745a4b99d6fcdd4a74b3/skills/sandbase

참조

da7532f435c2b905356e6595c506fc2342cf4215

유지보수 최신성

2026. 8. 27.

사용량

0 다운로드 · 0 조회

파일 구조

📄 skill.json

📄 SKILL.md