Skills code-validation-sandbox

📦

code-validation-sandbox

Name: code-validation-sandbox
Author: 92Bilal26

v3.0.0 Content revision r1 Critical ⚡ Contains scripts⚙️ External commands📁 Filesystem access🌐 Network access

Validate Teaching Code Examples in Sandboxes

Code examples in lessons can fail silently or mislead readers. This skill detects context, selects validation depth, and reports actionable issues.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "code-validation-sandbox" from https://skillstore.io/skills/92bilal26-code-validation-sandbox.md and its manifest at https://skillstore.io/api/skills/92bilal26-code-validation-sandbox/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/92bilal26-code-validation-sandbox.md Signed manifest GET /api/skills/92bilal26-code-validation-sandbox/manifest Signed lockfile GET /api/skills/92bilal26-code-validation-sandbox/lockfile

Test it

Using "code-validation-sandbox". A Layer 1 Python chapter with multiple beginner code examples.

Expected outcome:

The report lists total blocks, one critical runtime error, and a direct fix for the failing example.

Using "code-validation-sandbox". A Layer 2 chapter that claims an optimized version is faster.

Expected outcome:

The report confirms both versions run, compares their behavior, and flags any unsupported performance claim.

Using "code-validation-sandbox". A Layer 4 chapter that describes several services.

Expected outcome:

The report identifies missing integration evidence and recommends health checks before publication.

Security Audit

Critical

v6 • 7/5/2026 Open versioned report

The skill has legitimate educational code validation goals, but several execution paths are unsafe for untrusted content. Confirmed risks include remote installer pipe-to-shell commands, unsafe eval of chapter-derived context, and host execution of extracted Markdown Python code. Many Markdown code-fence and documentation matches were false positives.

Files scanned

1,568

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (5)

Critical

scripts/setup-sandbox.sh:61

Pipe to shell pattern

curl -LsSf https://astral.sh/uv/install.sh | sh > /dev/null 2>&1

The script downloads installer content from the network and pipes it directly into sh or bash. A compromised response would execute code during sandbox setup.

Critical

scripts/setup-sandbox.sh:75

Pipe to shell pattern

curl -fsSL https://deb.nodesource.com/setup_20.x | bash - > /dev/null 2>&1

The script downloads installer content from the network and pipes it directly into sh or bash. A compromised response would execute code during sandbox setup.

Critical

scripts/validate.sh:118-126 scripts/detect-context.sh:22-24 scripts/detect-context.sh:240-245

Unsafe Evaluation of Chapter-Derived Context Variables

validate.sh evaluates context assignments produced from chapter files. The layer value can originate from chapter-meta.yaml, so malicious metadata can become shell syntax.

The data flow is direct: chapter metadata is emitted as shell assignments and then evaluated. This is a classic command injection risk when chapter content is untrusted.

Critical

scripts/validate-python.sh:19-24 scripts/validate-python.sh:83-97 scripts/validate-python.sh:120-121 scripts/validate-python.sh:132-134

Host Execution of Extracted Markdown Code

validate-python.sh extracts Python blocks from Markdown and executes them with the host python3 interpreter. This bypasses the sandbox promise for untrusted chapter content.

The script extracts Markdown code into files and invokes python3 on those files. A malicious code block would run with the permissions of the user running validation.

High

scripts/setup-sandbox.sh:35-39 scripts/setup-sandbox.sh:58-67 scripts/setup-sandbox.sh:73-79

Writable Workspace Exposed During Network-Based Setup

setup-sandbox.sh bind mounts the current workspace into a Docker container and then runs network-sourced installers inside that environment. A compromised installer could modify workspace files.

The bind mount and installer execution are both explicit in the setup script. The impact depends on Docker permissions and installer behavior, so confidence is high but not absolute.

Capability review items (16)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Critical

scripts/setup-sandbox.sh:61

Standard device file access

curl -LsSf https://astral.sh/uv/install.sh | sh > /dev/null 2>&1

Although flagged as device access, the same line pipes a downloaded installer into a shell. Redirecting output does not reduce the code execution risk.

Critical

scripts/setup-sandbox.sh:75

Standard device file access

curl -fsSL https://deb.nodesource.com/setup_20.x | bash - > /dev/null 2>&1

Although flagged as device access, the same line pipes a downloaded installer into a shell. Redirecting output does not reduce the code execution risk.

Critical

scripts/validate-python.sh:120

Shell command substitution

baseline_out=$(timeout 10s python3 "$baseline" 2>&1 || echo "FAILED")

This runs Python files extracted from chapter Markdown and captures their output. Untrusted chapter code can execute on the host interpreter in this path.

Critical

scripts/validate-python.sh:121

Shell command substitution

optimized_out=$(timeout 10s python3 "$optimized" 2>&1 || echo "FAILED")

This runs Python files extracted from chapter Markdown and captures their output. Untrusted chapter code can execute on the host interpreter in this path.

Critical

scripts/validate-python.sh:94

Standard device file access

if ! timeout 10s python3 "$pyfile" >/dev/null 2>&1; then

This line executes extracted Python code with the host python3 command. A malicious code block would run with the invoking user permissions.

Critical

scripts/validate-python.sh:134

Standard device file access

timeout 10s python3 "$pyfile" >/dev/null 2>&1 || ((runtime_errors++))

This line executes extracted Python code with the host python3 command. A malicious code block would run with the invoking user permissions.

Critical

scripts/validate.sh:118

Shell command substitution

context_output=$("$SCRIPT_DIR/detect-context.sh" "$CHAPTER_PATH" 2>&1)

This captures context data produced from chapter files and the script later evals that data. Malicious metadata can become shell syntax in the orchestrator.

Critical

scripts/validate.sh:122

Shell command substitution

context_vars=$("$SCRIPT_DIR/detect-context.sh" "$CHAPTER_PATH" 2>/dev/null)

This captures context data produced from chapter files and the script later evals that data. Malicious metadata can become shell syntax in the orchestrator.

Critical

scripts/validate.sh:122

Standard device file access

context_vars=$("$SCRIPT_DIR/detect-context.sh" "$CHAPTER_PATH" 2>/dev/null)

The same line captures chapter-derived context variables that are later evaluated as shell assignments. The /dev/null redirect does not prevent command injection.

High

scripts/detect-context.sh:23

Shell command substitution

layer=$(grep "^layer:" "$chapter_path/chapter-meta.yaml" | cut -d: -f2 | tr -d ' ')

This substitution reads layer data from chapter-meta.yaml, which is user-controlled chapter content. The value is later emitted as a shell assignment and evaluated by the orchestrator.

High

scripts/detect-context.sh:189

Shell command substitution

layer=$(detect_layer "$chapter_path")

This captures detect_layer output, including layer data read from chapter metadata. In the full workflow that value is later evaluated as shell syntax.

High

scripts/setup-sandbox.sh:35-37

Shell command substitution

container_id=$(docker run -d \

This command starts a Docker container from a user-selectable image while binding the current workspace. That is legitimate setup behavior but exposes the workspace to the container.

High

scripts/setup-sandbox.sh:61

Hardcoded URL

curl -LsSf https://astral.sh/uv/install.sh | sh > /dev/null 2>&1

The hardcoded URL is used to fetch installer scripts during setup. These external dependencies are part of executable setup flow and require supply-chain trust.

High

scripts/setup-sandbox.sh:75

Hardcoded URL

curl -fsSL https://deb.nodesource.com/setup_20.x | bash - > /dev/null 2>&1

The hardcoded URL is used to fetch installer scripts during setup. These external dependencies are part of executable setup flow and require supply-chain trust.

High

scripts/validate.sh:120

Shell command substitution

context_vars=$(echo "$context_output" | tail -4)

This extracts context assignments from mixed command output before they are evaluated. The risk depends on the later eval, so confidence is lower than the direct eval chain.

Medium

SKILL.md:156

Shell command substitution

--mount type=bind,src=$(pwd),dst=/workspace \

The documentation shows a Docker bind mount using the current workspace as the source. If followed with an untrusted container, workspace files are exposed to that container.

Risk Factors

⚡ Contains scripts (1)

scripts/detect-context.sh:82

⚙️ External commands (62)

scripts/detect-context.sh:23 scripts/detect-context.sh:31 scripts/detect-context.sh:189 scripts/detect-context.sh:201 scripts/detect-context.sh:217 scripts/detect-context.sh:228 scripts/detect-context.sh:1 scripts/setup-sandbox.sh:20 scripts/setup-sandbox.sh:35-37 scripts/setup-sandbox.sh:1 scripts/validate-python.sh:24 scripts/validate-python.sh:28-34 scripts/validate-python.sh:20 scripts/validate-python.sh:64 scripts/validate-python.sh:115 scripts/validate-python.sh:118 scripts/validate-python.sh:120 scripts/validate-python.sh:121 scripts/validate-python.sh:1 scripts/validate.sh:8 scripts/validate.sh:9 scripts/validate.sh:118 scripts/validate.sh:120 scripts/validate.sh:122 scripts/validate.sh:1 scripts/verify.py:11 scripts/verify.py:29 SKILL.md:15-22 SKILL.md:22-49 SKILL.md:49 SKILL.md:50 SKILL.md:51 SKILL.md:67-72 SKILL.md:72-75 SKILL.md:75-80 SKILL.md:80-83 SKILL.md:83-88 SKILL.md:88-91 SKILL.md:91-97 SKILL.md:97-101 SKILL.md:101-116 SKILL.md:116-121 SKILL.md:121-123 SKILL.md:123-126 SKILL.md:126-142 SKILL.md:142-152 SKILL.md:152-159 SKILL.md:159-183 SKILL.md:183-193 SKILL.md:193-197 SKILL.md:197-217 SKILL.md:217-221 SKILL.md:221-222 SKILL.md:222-223 SKILL.md:17 SKILL.md:18 SKILL.md:156 SKILL.md:185 SKILL.md:186 SKILL.md:15-22 SKILL.md:152-159 SKILL.md:183-193

📁 Filesystem access (21)

🌐 Network access (2)

scripts/setup-sandbox.sh:61 scripts/setup-sandbox.sh:75

Detected Patterns

Pipe to shell pattern×2

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/92bilal26-code-validation-sandbox/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/92bilal26-code-validation-sandbox/security.svg)](https://skillstore.io/skills/92bilal26-code-validation-sandbox?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/92bilal26-code-validation-sandbox?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/92bilal26-code-validation-sandbox/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/92bilal26-code-validation-sandbox.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

92Bilal26. (2026). code-validation-sandbox security audit report (audit version 6) [Author version 3.0.0]. Skillstore. https://skillstore.io/skills/92bilal26-code-validation-sandbox/audits/6

BibTeX citation

@techreport{92bilal26-92bilal26-code-validation-sandbox-2026,
  author = {92Bilal26},
  title = {code-validation-sandbox security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/92bilal26-code-validation-sandbox/audits/6},
  note = {Author version 3.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "code-validation-sandbox security audit report (audit version 6)"
version: "3.0.0"
type: report
authors:
  - name: "92Bilal26"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/92bilal26-code-validation-sandbox/audits/6"
identifiers:
  - type: other
    value: "skillstore:92bilal26-code-validation-sandbox:audit:6"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

100

Spec Compliance

What You Can Build

Validate lesson code before publication

Check syntax and runtime behavior for code examples in educational chapters.

Review AI-assisted examples

Verify that baseline and optimized examples still produce equivalent behavior.

Assess generated code blocks

Run context-aware checks before adding generated examples to training material.

Try These Prompts

Validate one chapter

Validate this chapter directory with default layer detection. Report critical syntax or runtime issues first. Path: {{chapter_path}}

Force a validation layer

Validate this chapter as Layer {{layer}} content. Explain the selected checks and summarize the highest priority fixes. Path: {{chapter_path}}

Check AI collaboration claims

Validate the baseline and optimized examples in this chapter. Confirm equivalent behavior and flag unsupported performance claims. Path: {{chapter_path}}

Audit integration content

Assess this Layer 4 chapter for integration readiness. Check service assumptions, missing health checks, and recovery coverage. Path: {{chapter_path}}