📦

sandbase

Name: sandbase
Author: sandbaseai

v0.1.17 Ревизия содержимого r1 Средний риск 🌐 Доступ к сети⚙️ Внешние команды

Access AI Models and APIs Through SandBase

Using many AI providers requires separate integrations, keys, and billing workflows. SandBase offers one MCP interface for inference, media, search, scraping, and structured APIs.

Поддерживает: Claude Codex Code(CC)

⚠️ 50 Плохо

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "sandbase" from https://skillstore.io/skills/sandbaseai-sandbase.md and its manifest at https://skillstore.io/api/skills/sandbaseai-sandbase/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/sandbaseai-sandbase.md Подписанный manifest GET /api/skills/sandbaseai-sandbase/manifest Подписанный lockfile GET /api/skills/sandbaseai-sandbase/lockfile

Протестировать

Использование «sandbase». Find a Twitter search tool for AI agent posts, but do not run it.

Ожидаемый результат:

Recommended endpoint: Twitter web search timeline. It supports keyword search and returns structured posts. Inspect its schema and price before execution.

Использование «sandbase». Generate one fast image of a mountain lake and report the cost.

Ожидаемый результат:

Selected a fast Flux image endpoint after checking its input schema and fixed per-call price.
The image request completed successfully. The response includes the generated media result and the charged amount.

Использование «sandbase». Check my five most recent SandBase calls.

Ожидаемый результат:

The recent-call summary lists each model or API, completion status, and recorded cost for the five latest requests.

Аудит безопасности

Средний риск

v1 • 27.08.2026 Открыть версионный отчет

Most static alerts are false positives caused by Markdown backticks, metadata links, and ordinary API documentation. The setup still downloads and executes a remote package, stores authentication state, and modifies supported client configuration.

Просканировано файлов

238

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (2)

Средний

SKILL.md:21

Unverified Remote Package Execution

The primary setup command tells users to execute a remote package through npx without checksum verification. A compromised release asset or hosting account could execute attacker-controlled installer code.

The command explicitly uses npx with automatic confirmation on an HTTPS package URL. A separate verified workflow exists, but the primary command does not use it.

Средний

SKILL.md:32

Installer Changes Authentication and Client Configuration

The documented connection process stores a local session and installs an MCP bridge, configuration, and managed skill. These intended changes affect authentication state and supported client settings.

The skill explicitly states that the CLI stores a session record, detects supported clients, and installs the bridge, skill, and configuration.

Пункты проверки возможностей (2)

Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.

Средний

SKILL.md:21

Hardcoded URL

npx -y https://github.com/sandbaseai/cli/releases/download/v0.1.17/sandbaseai-cli-0.1.17.tgz connect

The URL is passed directly to npx with automatic confirmation, so following the documented setup downloads and executes an external package. The release is version-pinned, but this default path does not verify its checksum.

Низкий

SKILL.md:27

Hardcoded URL

curl -fLO https://github.com/sandbaseai/cli/releases/download/v0.1.17/sandbaseai-cli-0.1.17.tgz

The command downloads an external release asset over HTTPS, creating a real network and supply-chain dependency. The following line verifies a pinned SHA-256, which substantially limits the risk.

Факторы риска

🌐 Доступ к сети (5)

skill.json:7 skill.json:8 SKILL.md:21 SKILL.md:27 SKILL.md:34

⚙️ Внешние команды (47)

Аудитор:: codex

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/sandbaseai-sandbase/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/sandbaseai-sandbase/security.svg)](https://skillstore.io/skills/sandbaseai-sandbase?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/sandbaseai-sandbase?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sandbaseai-sandbase/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/sandbaseai-sandbase.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

sandbaseai. (2026). sandbase security audit report (audit version 1) [Author version 0.1.17]. Skillstore. https://skillstore.io/skills/sandbaseai-sandbase/audits/1

Цитата BibTeX

@techreport{sandbaseai-sandbaseai-sandbase-2026,
  author = {sandbaseai},
  title = {sandbase security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/sandbaseai-sandbase/audits/1},
  note = {Author version 0.1.17}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "sandbase security audit report (audit version 1)"
version: "0.1.17"
type: report
authors:
  - name: "sandbaseai"
date-released: "2026-08-27"
url: "https://skillstore.io/skills/sandbaseai-sandbase/audits/1"
identifiers:
  - type: other
    value: "skillstore:sandbaseai-sandbase:audit:1"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

Архитектура

100

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Prototype Multimodal Features

Discover and compare available image, video, audio, and language endpoints before integrating one into a prototype.

Collect Structured Web Data

Find suitable search, scraping, or social data endpoints and run small, schema-validated requests.

Control AI Service Costs

Inspect prices, check account balance, and review recent call costs across supported providers.

Попробуйте эти промпты

Find a Suitable Tool

Use SandBase to find tools for [task]. Show the most relevant options, their vendors, and their model types. Do not run anything yet.

Inspect Before Running

Discover a SandBase endpoint for [task], inspect its schema and pricing, then summarize required inputs and expected cost before execution.

Run a Small Request

Find and inspect a SandBase endpoint for [task]. Run one request with a small limit using [inputs], then summarize the result and cost.

Manage an Async Workflow

Select and inspect an asynchronous SandBase endpoint for [task]. Confirm pricing, run it with [inputs], poll until completion, and report result, status, and cost.

Лучшие практики

Discover endpoints first, then inspect the selected schema and pricing before execution.
Start search and scraping requests with small limits to validate result quality and cost.
Use the provided execution template and report costs when budget affects the task.

Избегать

Do not guess endpoint names or parameters without inspecting the current schema.
Do not use SandBase when the task is entirely local or the user selected another tool.
Do not start repeated paid calls without checking pricing, limits, and account balance.

Часто задаваемые вопросы

What does SandBase provide?

It provides one MCP interface for hosted AI models, media tools, search, scraping, embeddings, social data, and structured APIs.

Do I need provider API keys?

No provider keys are required. You need a SandBase account and must complete browser authentication for the local MCP connection.

How do I know an endpoint's inputs?

Run the inspection tool after discovery. It returns the input schema, pricing details, and an execution template.

Can calls incur charges?

Yes. Pricing may be token-based or per call. Inspect pricing and check your balance before running costly workloads.

How are long-running requests handled?

Some requests return a run identifier. Poll that run until it reports completion or failure.

When should I avoid SandBase?

Avoid it for local-only tasks, when the user selected another tool, or when an existing dedicated integration already meets the need.

Сведения для разработчиков

Автор

sandbaseai

Лицензия

MIT

Версия автора

v0.1.17

Ревизия Skillstore

Репозиторий

https://github.com/sandbaseai/cli/tree/399053acafff03cf6bcc745a4b99d6fcdd4a74b3/skills/sandbase

Ссылка

da7532f435c2b905356e6595c506fc2342cf4215

Актуальность поддержки

27.08.2026

Использование

0 загрузок · 0 просмотров

Структура файлов

📄 skill.json

📄 SKILL.md