Menu
Isolated Kali Linux sandbox for running pentest tools and risky commands safely.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | prts-sandbox |
| description | Isolated Kali Linux sandbox for running pentest tools and risky commands safely. |
| metadata | {"openclaw":{"emoji":"🛡️","requires":{"bins":["bash","curl","jq"]}}} |
An isolated Kali Linux 2025.4 container. All pentest tools and risky commands run here — never on the host.
~/.openclaw/skills/prts-sandbox/scripts/sandbox-cmd.sh
| Task | Where |
|---|---|
| Running pentest tools (nmap, hydra, sqlmap, etc.) | ✅ Sandbox |
| Executing downloaded/unknown scripts | ✅ Sandbox |
| Anything that could break the host | ✅ Sandbox |
| Editing memory/SOUL.md/agent files | ❌ Host |
| Reading internal agent files | ❌ Host |
Step 1 — Check if sandbox is running:
~/.openclaw/skills/prts-sandbox/scripts/sandbox-cmd.sh status
# Returns: true (running) or false (stopped)
Step 2 — Start it if stopped (or Reset if error occurs):
~/.openclaw/skills/prts-sandbox/scripts/sandbox-cmd.sh start
# CRITICAL RULE: If the start command fails with an error stating "the container name 'protocol-space-active' is already in use", you MUST run `reset`:
~/.openclaw/skills/prts-sandbox/scripts/sandbox-cmd.sh reset
Step 3 — Execute your command:
~/.openclaw/skills/prts-sandbox/scripts/sandbox-cmd.sh exec nmap -sV 192.168.1.1
~/.openclaw/skills/prts-sandbox/scripts/sandbox-cmd.sh exec sqlmap -u "http://target/page?id=1"
~/.openclaw/skills/prts-sandbox/scripts/sandbox-cmd.sh exec sh -c "hydra -l admin -P /wordlist.txt ssh://192.168.1.10"
| Category | Tools |
|---|---|
| Recon | nmap, masscan, dnsrecon, dirb |
| Web | nikto, gobuster, ffuf, sqlmap, curl, wget |
| Auth attacks | hydra, crackmapexec |
| SMB/AD | smbclient, enum4linux, crackmapexec |
| Password cracking | john, hashcat |
| Scripting | python3, nc |
~/.openclaw/skills/prts-sandbox/scripts/sandbox-cmd.sh start
# CRITICAL RULE: If the start command fails with an error stating "the container name 'protocol-space-active' is already in use", you MUST run `reset`:
~/.openclaw/skills/prts-sandbox/scripts/sandbox-cmd.sh reset
| Problem | Fix |
|---------|-----|
| Commands fail / sandbox behaves oddly | Run `sandbox-cmd.sh reset` |
| API unreachable | Tell user: "Protocol Spaces API is offline" |
| Need a new tool installed | Ask user to install it — do NOT run `apt-get install` yourself |
| `start` returns error: "container name is already in use" | Run `sandbox-cmd.sh reset`, then verify `status` is true. |
| Commands fail / sandbox behaves oddly | Run `sandbox-cmd.sh reset` |
| API unreachable | Tell user: "Protocol Spaces API is offline" |
| Need a new tool installed | Ask user to install it — do NOT run `apt-get install` yourself |
---
## Quick reference
```bash
SANDBOX="~/.openclaw/skills/prts-sandbox/scripts/sandbox-cmd.sh"
$SANDBOX status # Check if running
$SANDBOX start # Start sandbox
$SANDBOX stop # Stop sandbox
$SANDBOX reset # Reset / fix broken sandbox
$SANDBOX exec <cmd> # Run a command inside sandbox
Browse curated penetration testing resources and exploit databases. Use when planning security audits, researching vulns, or building toolkits.
Perform a thorough client-side / browser-facing security assessment of a target web application. Use this skill whenever the user asks to pentest, audit, or review the security of a website or web app from the browser/frontend perspective, mentions client-side vulnerabilities (XSS, CORS, open redirect, clickjacking, prototype pollution, JWT leakage, source maps, etc.), wants to find sensitive data exposed in JavaScript bundles or client code, or asks for a security report on front-end attack surface. Trigger even if the user just says "test the security of this site", "find vulnerabilities in this web app", or "run a pentest on the frontend".
Cybersecurity assistant for CTF challenges, penetration testing, network recon, vulnerability assessment, and security research. Use when: (1) solving CTF challenges (web, crypto, pwn, forensics, rev, OSINT, misc), (2) performing network reconnaissance or port scanning, (3) web application security testing, (4) vulnerability scanning and assessment, (5) binary analysis or reverse engineering, (6) password cracking or hash identification, (7) forensics analysis (file, memory, network, steganography), (8) cloud security assessment (AWS, GCP, K8s, containers), (9) OSINT gathering, (10) any offensive security or red team task. Triggers on: CTF, capture the flag, pentest, recon, nmap, exploit, vulnerability, reverse engineering, forensics, steganography, hash crack, brute force, SQL injection, XSS, buffer overflow, ROP, binary exploitation, OSINT, bug bounty, security audit, cloud security.
网络安全漏洞检测工具。用于检测本地网络和主机的常见安全漏洞，包括： (1) 开放端口检测与风险评估 (2) 弱密码和默认凭证检测 (3) SSL/TLS 证书问题 (4) 常见服务漏洞检测 (5) 网络配置安全检查 (6) 敏感端口暴露检测。 适用于：安全审计、渗透测试前自查、系统加固、服务器上线检查。 注意：仅用于授权的安全检测，禁止未授权扫描他人系统。
Plan and orchestrate authorized Nmap host discovery, port and service enumeration, NSE profiling, and reporting artifacts for in-scope targets.
Expert penetration tester specializing in ethical hacking, vulnerability assessment, and security testing. Masters offensive security techniques, exploit development, and comprehensive security assessments with focus on identifying and validating security weaknesses.