Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- bin/cli.js:41
- Evidence
const result = spawnSync(process.execPath, args, { stdio: "inherit" });
Security audit
@psyb0t/claudebox
Security checks for vulnerabilities and agentic risk
Overview
This plugin is a disclosed bridge to a user-run claudebox MCP server, with powerful workspace access that matches its stated purpose.
Install only when you trust the claudebox server you point it at and understand that the connected agent can modify or delete files and run shell/tool actions in the exposed workspace. Prefer a local or authenticated server and avoid exposing sensitive workspaces unless that access is intentional.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.dangerous_exec