技能 code-validation-sandbox
📦

code-validation-sandbox

v3.0.0 內容修訂 r1 嚴重 ⚡ 包含腳本⚙️ 外部命令📁 檔案系統存取🌐 網路存取

在沙箱中驗證教學程式碼範例

課程中的程式碼範例可能會悄悄失敗或誤導讀者。此技能會偵測情境、選擇驗證深度，並回報可執行的問題。

支援: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠️ 38 差

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求
Review the Skillstore skill "code-validation-sandbox" from https://skillstore.io/skills/92bilal26-code-validation-sandbox.md and its manifest at https://skillstore.io/api/skills/92bilal26-code-validation-sandbox/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/92bilal26-code-validation-sandbox.md 已簽名 manifest GET /api/skills/92bilal26-code-validation-sandbox/manifest 已簽名 lockfile GET /api/skills/92bilal26-code-validation-sandbox/lockfile

測試它

正在使用「code-validation-sandbox」。 包含多個初學者程式碼範例的第 1 層 Python 章節。

預期結果:

報告列出區塊總數、一個嚴重執行階段錯誤，以及失敗範例的直接修正方式。

正在使用「code-validation-sandbox」。 宣稱最佳化版本更快的第 2 層章節。

預期結果:

報告確認兩個版本皆可執行、比較其行為，並標記任何未受支持的效能主張。

正在使用「code-validation-sandbox」。 描述多項服務的第 4 層章節。

預期結果:

報告識別缺少的整合證據，並建議出版前加入健康檢查。

安全審計

嚴重
v6 • 2026/7/5 開啟版本化報告

The skill has legitimate educational code validation goals, but several execution paths are unsafe for untrusted content. Confirmed risks include remote installer pipe-to-shell commands, unsafe eval of chapter-derived context, and host execution of extracted Markdown Python code. Many Markdown code-fence and documentation matches were false positives.

8
已掃描檔案
1,568
分析行數
16
複核項目
0
已忽略的誤報

已確認的安全問題 (5)

嚴重
scripts/setup-sandbox.sh:61
Pipe to shell pattern
curl -LsSf https://astral.sh/uv/install.sh | sh > /dev/null 2>&1
The script downloads installer content from the network and pipes it directly into sh or bash. A compromised response would execute code during sandbox setup.
嚴重
scripts/setup-sandbox.sh:75
Pipe to shell pattern
curl -fsSL https://deb.nodesource.com/setup_20.x | bash - > /dev/null 2>&1
The script downloads installer content from the network and pipes it directly into sh or bash. A compromised response would execute code during sandbox setup.
嚴重
scripts/validate.sh:118-126scripts/detect-context.sh:22-24scripts/detect-context.sh:240-245
Unsafe Evaluation of Chapter-Derived Context Variables
validate.sh evaluates context assignments produced from chapter files. The layer value can originate from chapter-meta.yaml, so malicious metadata can become shell syntax.
The data flow is direct: chapter metadata is emitted as shell assignments and then evaluated. This is a classic command injection risk when chapter content is untrusted.
嚴重
scripts/validate-python.sh:19-24scripts/validate-python.sh:83-97scripts/validate-python.sh:120-121scripts/validate-python.sh:132-134
Host Execution of Extracted Markdown Code
validate-python.sh extracts Python blocks from Markdown and executes them with the host python3 interpreter. This bypasses the sandbox promise for untrusted chapter content.
The script extracts Markdown code into files and invokes python3 on those files. A malicious code block would run with the permissions of the user running validation.
高
scripts/setup-sandbox.sh:35-39scripts/setup-sandbox.sh:58-67scripts/setup-sandbox.sh:73-79
Writable Workspace Exposed During Network-Based Setup
setup-sandbox.sh bind mounts the current workspace into a Docker container and then runs network-sourced installers inside that environment. A compromised installer could modify workspace files.
The bind mount and installer execution are both explicit in the setup script. The impact depends on Docker permissions and installer behavior, so confidence is high but not absolute.
能力複核項目 (16)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

嚴重
scripts/setup-sandbox.sh:61
Standard device file access
curl -LsSf https://astral.sh/uv/install.sh | sh > /dev/null 2>&1
Although flagged as device access, the same line pipes a downloaded installer into a shell. Redirecting output does not reduce the code execution risk.
嚴重
scripts/setup-sandbox.sh:75
Standard device file access
curl -fsSL https://deb.nodesource.com/setup_20.x | bash - > /dev/null 2>&1
Although flagged as device access, the same line pipes a downloaded installer into a shell. Redirecting output does not reduce the code execution risk.
嚴重
scripts/validate-python.sh:120
Shell command substitution
baseline_out=$(timeout 10s python3 "$baseline" 2>&1 || echo "FAILED")
This runs Python files extracted from chapter Markdown and captures their output. Untrusted chapter code can execute on the host interpreter in this path.
嚴重
scripts/validate-python.sh:121
Shell command substitution
optimized_out=$(timeout 10s python3 "$optimized" 2>&1 || echo "FAILED")
This runs Python files extracted from chapter Markdown and captures their output. Untrusted chapter code can execute on the host interpreter in this path.
嚴重
scripts/validate-python.sh:94
Standard device file access
if ! timeout 10s python3 "$pyfile" >/dev/null 2>&1; then
This line executes extracted Python code with the host python3 command. A malicious code block would run with the invoking user permissions.
嚴重
scripts/validate-python.sh:134
Standard device file access
timeout 10s python3 "$pyfile" >/dev/null 2>&1 || ((runtime_errors++))
This line executes extracted Python code with the host python3 command. A malicious code block would run with the invoking user permissions.
嚴重
scripts/validate.sh:118
Shell command substitution
context_output=$("$SCRIPT_DIR/detect-context.sh" "$CHAPTER_PATH" 2>&1)
This captures context data produced from chapter files and the script later evals that data. Malicious metadata can become shell syntax in the orchestrator.
嚴重
scripts/validate.sh:122
Shell command substitution
context_vars=$("$SCRIPT_DIR/detect-context.sh" "$CHAPTER_PATH" 2>/dev/null)
This captures context data produced from chapter files and the script later evals that data. Malicious metadata can become shell syntax in the orchestrator.
嚴重
scripts/validate.sh:122
Standard device file access
context_vars=$("$SCRIPT_DIR/detect-context.sh" "$CHAPTER_PATH" 2>/dev/null)
The same line captures chapter-derived context variables that are later evaluated as shell assignments. The /dev/null redirect does not prevent command injection.
高
scripts/detect-context.sh:23
Shell command substitution
layer=$(grep "^layer:" "$chapter_path/chapter-meta.yaml" | cut -d: -f2 | tr -d ' ')
This substitution reads layer data from chapter-meta.yaml, which is user-controlled chapter content. The value is later emitted as a shell assignment and evaluated by the orchestrator.
高
scripts/detect-context.sh:189
Shell command substitution
layer=$(detect_layer "$chapter_path")
This captures detect_layer output, including layer data read from chapter metadata. In the full workflow that value is later evaluated as shell syntax.
高
scripts/setup-sandbox.sh:35-37
Shell command substitution
container_id=$(docker run -d \
This command starts a Docker container from a user-selectable image while binding the current workspace. That is legitimate setup behavior but exposes the workspace to the container.
高
scripts/setup-sandbox.sh:61
Hardcoded URL
curl -LsSf https://astral.sh/uv/install.sh | sh > /dev/null 2>&1
The hardcoded URL is used to fetch installer scripts during setup. These external dependencies are part of executable setup flow and require supply-chain trust.
高
scripts/setup-sandbox.sh:75
Hardcoded URL
curl -fsSL https://deb.nodesource.com/setup_20.x | bash - > /dev/null 2>&1
The hardcoded URL is used to fetch installer scripts during setup. These external dependencies are part of executable setup flow and require supply-chain trust.
高
scripts/validate.sh:120
Shell command substitution
context_vars=$(echo "$context_output" | tail -4)
This extracts context assignments from mixed command output before they are evaluated. The risk depends on the later eval, so confidence is lower than the direct eval chain.
中
SKILL.md:156
Shell command substitution
--mount type=bind,src=$(pwd),dst=/workspace \
The documentation shows a Docker bind mount using the current workspace as the source. If followed with an untrusted container, workspace files are exposed to that container.

風險因素

⚡ 包含腳本 (1)
scripts/detect-context.sh:82
⚙️ 外部命令 (62)
scripts/detect-context.sh:23 scripts/detect-context.sh:31 scripts/detect-context.sh:189 scripts/detect-context.sh:201 scripts/detect-context.sh:217 scripts/detect-context.sh:228 scripts/detect-context.sh:1 scripts/setup-sandbox.sh:20 scripts/setup-sandbox.sh:35-37 scripts/setup-sandbox.sh:1 scripts/validate-python.sh:24 scripts/validate-python.sh:28-34 scripts/validate-python.sh:20 scripts/validate-python.sh:64 scripts/validate-python.sh:115 scripts/validate-python.sh:118 scripts/validate-python.sh:120 scripts/validate-python.sh:121 scripts/validate-python.sh:1 scripts/validate.sh:8 scripts/validate.sh:9 scripts/validate.sh:118 scripts/validate.sh:120 scripts/validate.sh:122 scripts/validate.sh:1 scripts/verify.py:11 scripts/verify.py:29 SKILL.md:15-22 SKILL.md:22-49 SKILL.md:49 SKILL.md:50 SKILL.md:51 SKILL.md:67-72 SKILL.md:72-75 SKILL.md:75-80 SKILL.md:80-83 SKILL.md:83-88 SKILL.md:88-91 SKILL.md:91-97 SKILL.md:97-101 SKILL.md:101-116 SKILL.md:116-121 SKILL.md:121-123 SKILL.md:123-126 SKILL.md:126-142 SKILL.md:142-152 SKILL.md:152-159 SKILL.md:159-183 SKILL.md:183-193 SKILL.md:193-197 SKILL.md:197-217 SKILL.md:217-221 SKILL.md:221-222 SKILL.md:222-223 SKILL.md:17 SKILL.md:18 SKILL.md:156 SKILL.md:185 SKILL.md:186 SKILL.md:15-22 SKILL.md:152-159 SKILL.md:183-193
📁 檔案系統存取 (21)
scripts/detect-context.sh:73 scripts/detect-context.sh:82 scripts/detect-context.sh:91 scripts/setup-sandbox.sh:62 scripts/setup-sandbox.sh:39 scripts/setup-sandbox.sh:50 scripts/setup-sandbox.sh:61 scripts/setup-sandbox.sh:65 scripts/setup-sandbox.sh:75 scripts/setup-sandbox.sh:76 scripts/setup-sandbox.sh:77 scripts/validate-python.sh:85 scripts/validate-python.sh:94 scripts/validate-python.sh:133 scripts/validate-python.sh:134 scripts/validate-python.sh:153 scripts/validate-python.sh:172 scripts/validate.sh:122 SKILL.md:50 SKILL.md:18 SKILL.md:157
🌐 網路存取 (2)
scripts/setup-sandbox.sh:61 scripts/setup-sandbox.sh:75

偵測到的模式

Pipe to shell pattern×2
審計單位: codex 檢視審計紀錄 →
分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告
安全評估

複製報告連結

https://skillstore.io/skills/92bilal26-code-validation-sandbox/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/92bilal26-code-validation-sandbox/security.svg)](https://skillstore.io/skills/92bilal26-code-validation-sandbox?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/92bilal26-code-validation-sandbox?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/92bilal26-code-validation-sandbox/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/92bilal26-code-validation-sandbox.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
學術引用 (APA · BibTeX · CFF)

APA 引用

92Bilal26. (2026). code-validation-sandbox security audit report (audit version 6) [Author version 3.0.0]. Skillstore. https://skillstore.io/skills/92bilal26-code-validation-sandbox/audits/6

BibTeX 引用

@techreport{92bilal26-92bilal26-code-validation-sandbox-2026, author = {92Bilal26}, title = {code-validation-sandbox security audit report (audit version 6)}, institution = {Skillstore}, year = {2026}, number = {6}, url = {https://skillstore.io/skills/92bilal26-code-validation-sandbox/audits/6}, note = {Author version 3.0.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "code-validation-sandbox security audit report (audit version 6)" version: "3.0.0" type: report authors: - name: "92Bilal26" date-released: "2026-07-05" url: "https://skillstore.io/skills/92bilal26-code-validation-sandbox/audits/6" identifiers: - type: other value: "skillstore:92bilal26-code-validation-sandbox:audit:6" description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據 證據置信度: 中
59
架構
100
可維護性
87
內容
73
社群
100
規範符合度

你可以打造什麼

出版前驗證課程程式碼

檢查教育章節中程式碼範例的語法與執行階段行為。

審查 AI 輔助產生的範例

確認基準範例與最佳化範例仍產生等效行為。

評估產生的程式碼區塊

在將產生的範例加入訓練教材前，執行情境感知檢查。

試試這些提示

驗證單一章節 
使用預設層級偵測驗證此章節目錄。優先回報嚴重的語法或執行階段問題。路徑：{{chapter_path}}
強制指定驗證層級 
將此章節視為第 {{layer}} 層內容進行驗證。說明所選檢查，並摘要最高優先順序的修正項目。路徑：{{chapter_path}}
檢查 AI 協作主張 
驗證此章節中的基準範例與最佳化範例。確認行為等效，並標記未受支持的效能主張。路徑：{{chapter_path}}
稽核整合內容 
評估這個第 4 層章節的整合就緒程度。檢查服務假設、缺少的健康檢查，以及復原涵蓋範圍。路徑：{{chapter_path}}

最佳實務

  • 當章節內容不可信時，請在隔離容器中執行驗證。
  • 接受驗證結果前，請審查所選層級與語言。
  • 對面向初學者的範例而言，應將執行階段失敗視為出版阻斷問題。

避免

  • 請勿在主機上執行來自未知來源的擷取程式碼。
  • 未加入腳本前，請勿假設 Node、Rust 或 Go 驗證已完整。
  • 沒有量測證據時，請勿相信效能主張。

常見問題

此技能會驗證什麼？
它會驗證教育用途的程式碼範例，並根據課程情境選擇檢查項目。
它是否支援 Claude、Codex 和 Claude Code？
是。報告聲明支援 Claude、Codex 和 Claude Code。
它目前可以驗證 JavaScript 或 Rust 嗎？
它可以偵測這些語言，但未包含對應的驗證腳本。
沙箱是否完全隔離？
否。部分 Python 驗證會使用主機 Python 直譯器執行擷取出的程式碼。
我應該將它用於生產部署測試嗎？
否。此技能聲明它不適用於生產部署測試。
作者應該先修正什麼？
作者應先移除 pipe-to-shell 設定命令，並避免對來自章節的資料使用 eval。

開發者詳細資訊

作者

92Bilal26

授權

MIT

作者版本

v3.0.0

Skillstore 修訂

r1

儲存庫

https://github.com/92Bilal26/TaskPilotAI/tree/main/.claude/skills/code-validation-sandbox

引用

c4037264bbd363c572662d6154a3ab28f5ca4f53

維護新鮮度

2026/7/21

使用量

6 次下載 · 368 次瀏覽

檔案結構

📄 metadata.yaml

📄 README.md

📁 scripts/

📄 detect-context.sh

📄 setup-sandbox.sh

📄 validate-python.sh

📄 validate.sh

📄 verify.py

📄 SKILL.md

92Bilal26 的更多技能

查看全部

相關技能

查看全部