[SECURITY] netcat (nc) available in sandbox image

[cluster2600]

Summary

The base sandbox image includes nc (netcat), a standard tool for reverse shells, port scanning, and data exfiltration. While the OpenShell proxy blocks outbound connections to unauthorised hosts, netcat shouldn't be in the image at all.

Reproduction

$ which nc
/usr/bin/nc

Impact

If a proxy bypass is ever found, netcat is the first tool an attacker (or prompt-injected agent) would reach for. It enables:

• Reverse shell connections
• Port scanning of internal networks
• Raw TCP data exfiltration

The proxy currently blocks these, but defence-in-depth means removing the tool regardless.

Recommendation

Remove netcat-openbsd and netcat-traditional from the sandbox image. Also audit for other unnecessary network tools (nmap, socat, telnet, etc.).

Environment

• openshell 0.0.14
• Base sandbox image: ghcr.io/nvidia/openshell-community/sandboxes/base:latest

[cluster2600]

Related: #796 proposes a command pattern denylist that would provide application-level coverage for this class of issue. Worth addressing together — the image hardening here is the defence-in-depth layer (remove the tool entirely), whilst #796 catches the patterns even if the tool is present via a different path.

[BenediktSchackenberg]

Addressed in #830 — netcat variants are now explicitly purged from the runtime image.

[BenediktSchackenberg]

Fixed via #830 (merged). The sandbox image no longer includes gcc, g++, make, or netcat — removed from the runtime stage.