Tcb Sandbox

Operate remote TRW workspaces via @tcb-sandbox/cli (HTTP/MCP client). The TRW npm package is not published publicly; the CLI embeds a production TRW build (`...

This skill is largely coherent for managing remote TRW workspaces, but review a few things before installing: - Confirm the npm package source and trustworthiness of @tcb-sandbox/cli (check the package registry owner, published tarball contents, and homepage). If the package is private or from an unknown publisher, prefer to vet it first or run the CLI locally. - Avoid supplying broad credentials in TCB_SANDBOX_HEADERS_JSON unless you trust the endpoint; that env var is referenced in the docs but not declared in metadata. - Be aware the SKILL.md instructs the agent to log a high-risk notice and then proceed with destructive/PT Y/bash actions without an interactive confirmation. If you plan to allow autonomous agent invocation, this means the agent could execute potentially destructive commands once it has the session id — consider requiring explicit user confirmation in your workflow or disallowing autonomous runs for this skill. - Ask the skill author (or inspect the CLI package) to resolve the minor inconsistencies: pnpm vs npm in bootstrap instructions and to declare any optional environment variables (like TCB_SANDBOX_HEADERS_JSON) in metadata. If you cannot verify the package or do not want remote destructive operations to run without an explicit human confirmation, do not install or do not grant the session credentials to the skill.

Type: OpenClaw Skill Name: tcb-sandbox Version: 0.3.11 The skill provides a comprehensive interface for managing remote 'TRW' workspaces using the @tcb-sandbox/cli tool. It includes high-risk capabilities such as arbitrary shell execution (bash), pseudo-terminal management (pty-service), secret storage manipulation (secrets-store), and file system access (read/write/upload). While these capabilities are aligned with the stated purpose of workspace management and the instructions in SKILL.md include safety rules and redaction guidelines, the broad access to remote environments and the instruction to execute high-risk actions without interactive confirmation meet the threshold for a suspicious classification under the provided criteria.