Examine sandbox

Skill Aicoo-Team/AICOO-Skills/skills/examine-sandbox

Use this skill when the user wants to check what data their shared agent can access, inspect what's being shared, review privacy, or see what guests will see. Triggers on: 'what can they see', 'check my link', 'audit my agent', 'review what I'm sharing', or 'what data is shared'.From its SKILL.md

Install

npx -y skills add Aicoo-Team/AICOO-Skills --skill examine-sandbox

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

3 things to look at

reads credentialsReads from 2 credential sources: `AICOO_API_KEY` and 1 more.
runs commandsInstructs the agent to run 8 commands, including `curl -s -H "Authorization: Bearer $AICOO_API_KEY" "https://www.aicoo.io/api/v1/os/network" | jq .` and 7 more.
fetches URLsInstructs the agent to fetch 4 URLs, including https://www.aicoo.io/api/v1/os/network and 3 more.

SKILL.md

2.8 KB, 746 tokens by cl100k_base, as published. Nobody here has run it

Examine Sandbox

Inspect exactly what data and capabilities are included in shared links.

Prerequisites

AICOO_API_KEY must be set
Base URL: https://www.aicoo.io/api/v1

Core Workflow

Step 1: List network state

curl -s -H "Authorization: Bearer $AICOO_API_KEY" \
  "https://www.aicoo.io/api/v1/os/network" | jq .

Review:

shareLinks
visitors (signed-in visitors may include name, username, email, and user id)
contacts

Step 2: Check context size/scope

curl -s -H "Authorization: Bearer $AICOO_API_KEY" \
  "https://www.aicoo.io/api/v1/os/status" | jq .

Step 3: Search for sensitive content

# financial
curl -s -X POST "https://www.aicoo.io/api/v1/os/notes/search" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query":"revenue pricing confidential"}' | jq .

# credentials/personal info
curl -s -X POST "https://www.aicoo.io/api/v1/os/notes/search" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query":"password API key credentials"}' | jq .

Step 4: Report findings

Summarize:

how many active links and their scopes
notes/calendar permission levels
sign-in requirement and visitor activity
sensitive hits inside shared scope
risk actions (downgrade/revoke)

Step 5: Restrict access if needed

# narrow scope
curl -s -X PATCH "https://www.aicoo.io/api/v1/os/share/{linkId}" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"scope":"folders","folderIds":[5,12]}' | jq .

# downgrade notes access
curl -s -X PATCH "https://www.aicoo.io/api/v1/os/share/{linkId}" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"notesAccess":"read"}' | jq .

# require sign-in
curl -s -X PATCH "https://www.aicoo.io/api/v1/os/share/{linkId}" \
  -H "Authorization: Bearer ${AICOO_API_KEY:-$PULSE_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"requireSignIn":true}' | jq .

# revoke
curl -s -X DELETE "https://www.aicoo.io/api/v1/os/share/{linkId}" \
  -H "Authorization: Bearer $AICOO_API_KEY" | jq .

Search Categories

Category	Terms	Risk
Financial	revenue, burn rate, pricing, salary	medium
Credentials	password, token, key, secret	critical
Personal	phone, address, SSN, private	high
Legal	contract, NDA, agreement	high

What ships with it: 2 files

3.0 KB alongside SKILL.md

examples/

audit-link.md1.4 KB

reference/

API.md1.6 KB