← 返回 Skills 市场
92
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install examine-sandbox
功能描述
Use this skill when the user wants to check what data their shared agent can access, inspect what's being shared, review privacy, or see what guests will see...
使用说明 (SKILL.md)
Examine Sandbox
Inspect exactly what data and capabilities are included in shared links.
Prerequisites
PULSE_API_KEYmust be set- Base URL:
https://www.aicoo.io/api/v1
Core Workflow
Step 1: List network state
curl -s -H "Authorization: Bearer $PULSE_API_KEY" \
"https://www.aicoo.io/api/v1/os/network" | jq .
Review:
shareLinksvisitorscontacts
Step 2: Check context size/scope
curl -s -H "Authorization: Bearer $PULSE_API_KEY" \
"https://www.aicoo.io/api/v1/os/status" | jq .
Step 3: Search for sensitive content
# financial
curl -s -X POST "https://www.aicoo.io/api/v1/os/notes/search" \
-H "Authorization: Bearer $PULSE_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query":"revenue pricing confidential"}' | jq .
# credentials/personal info
curl -s -X POST "https://www.aicoo.io/api/v1/os/notes/search" \
-H "Authorization: Bearer $PULSE_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query":"password API key credentials"}' | jq .
Step 4: Report findings
Summarize:
- how many active links and their scopes
- notes/calendar permission levels
- visitor activity
- sensitive hits inside shared scope
- risk actions (downgrade/revoke)
Step 5: Restrict access if needed
# narrow scope
curl -s -X PATCH "https://www.aicoo.io/api/v1/os/share/{linkId}" \
-H "Authorization: Bearer $PULSE_API_KEY" \
-H "Content-Type: application/json" \
-d '{"scope":"folders","folderIds":[5,12]}' | jq .
# downgrade notes access
curl -s -X PATCH "https://www.aicoo.io/api/v1/os/share/{linkId}" \
-H "Authorization: Bearer $PULSE_API_KEY" \
-H "Content-Type: application/json" \
-d '{"notesAccess":"read"}' | jq .
# revoke
curl -s -X DELETE "https://www.aicoo.io/api/v1/os/share/{linkId}" \
-H "Authorization: Bearer $PULSE_API_KEY" | jq .
Search Categories
| Category | Terms | Risk |
|---|---|---|
| Financial | revenue, burn rate, pricing, salary | medium |
| Credentials | password, token, key, secret | critical |
| Personal | phone, address, SSN, private | high |
| Legal | contract, NDA, agreement | high |
安全使用建议
This skill appears to do what it says (audit and manage share links on aicoo.io), but note two issues: (1) the runtime docs require PULSE_API_KEY even though the registry metadata lists no required env vars — don't assume the registry metadata is complete; (2) the API key has high privilege (can list and revoke links and change access). Only provide a PULSE_API_KEY that is scoped/minimized for auditing (use a temporary or read-only token if available), verify the aicoo.io endpoint and that you trust the skill author (no homepage, unknown owner), and rotate/revoke the key after use. If you need higher assurance, request the author update the package metadata to explicitly declare PULSE_API_KEY and provide an official homepage or documentation.
功能分析
Type: OpenClaw Skill
Name: examine-sandbox
Version: 2.0.0
The examine-sandbox skill is designed to audit shared links and data exposure on the aicoo.io platform. It is classified as suspicious because it includes explicit instructions for the agent to programmatically search for and retrieve highly sensitive information, such as 'password', 'API key', and 'revenue', across user notes (SKILL.md, reference/API.md). While these capabilities are plausibly needed for the stated purpose of a security audit, the automated discovery of credentials represents a high-risk behavior that could be exploited, and the skill lacks sufficient safeguards against the agent exposing these secrets in its output.
能力标签
能力评估
Purpose & Capability
The SKILL.md clearly targets auditing and managing shared links on aicoo.io and the curl commands reflect that purpose (list links, search notes, patch/revoke links). Requiring an API key for that service is reasonable for the stated capability. However, the registry metadata claims no required env vars or primary credential while the runtime docs explicitly require PULSE_API_KEY — an inconsistency between declared requirements and actual runtime needs.
Instruction Scope
Instructions are specific and constrained to the aicoo.io API endpoints (GET /os/network, POST /os/notes/search, PATCH/DELETE /os/share/{linkId}). They do not instruct reading arbitrary local files or other environment variables. They do include write operations (PATCH, DELETE) which can modify or revoke share links; this is coherent with 'restrict access' actions but is higher privilege and should be used carefully.
Install Mechanism
This is an instruction-only skill with no install spec or code files, so it does not write code to disk or fetch remote packages. That's low installation risk.
Credentials
The SKILL.md requires a single env var PULSE_API_KEY (used for Authorization: Bearer) which is proportionate to the API operations described. The concern is that the registry metadata lists no required env vars or primary credential — a metadata omission that could mislead users. Also, the PULSE_API_KEY likely grants listing/modifying/revoking share links (sensitive capabilities); users should ensure the key is least-privilege and scoped appropriately.
Persistence & Privilege
The skill is not always-enabled, has no install-time persistence, and does not request system-wide configuration changes. It runs ephemeral curl commands at runtime. Autonomous invocation is allowed (platform default) but does not by itself increase risk here.
如何使用
- 确保已安装 OpenClaw(本地或 Docker 部署)
- 在对话框中输入安装命令:
/install examine-sandbox - 安装完成后,直接呼叫该 Skill 的名称或使用
/examine-sandbox触发 - 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v2.0.0
Initial publish from pulse-skills
元数据
常见问题
Examine Sandbox 是什么?
Use this skill when the user wants to check what data their shared agent can access, inspect what's being shared, review privacy, or see what guests will see... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 92 次。
如何安装 Examine Sandbox?
在 OpenClaw 或 Claude Code 对话框中运行命令「/install examine-sandbox」即可一键安装,无需额外配置。
Examine Sandbox 是免费的吗?
是的,Examine Sandbox 完全免费,采用 MIT-0 许可证,可自由下载、安装和使用。
Examine Sandbox 支持哪些平台?
Examine Sandbox 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。
谁开发了 Examine Sandbox?
由 Awassi(@xisen-w)开发并维护,当前版本 v2.0.0。
推荐 Skills