Tencent/WeKnora · error

security validation failed

Error message

security validation failed

What it means

Sentinel ErrSecurityViolation returned by the sandbox manager when the pre-execution security validator rejects a script (manager.go:100) or when the provider reports validation errors in its result (manager.go:137). The script was blocked before/at execution because it violated security policy — this is a deliberate rejection, not a runtime crash.

Source

Thrown at internal/sandbox/sandbox.go:105

	// DefaultCubeHTTPTimeout bounds a single HTTP call to the CubeAPI
	// (excluding user script execution which has its own per-call timeout).
	DefaultCubeHTTPTimeout = 30 * time.Second

	// DefaultE2BSandboxTTL matches the E2B SDK's built-in default so an
	// unset E2BSandboxTTL still yields a valid sandbox lifetime.
	DefaultE2BSandboxTTL = 5 * time.Minute
	// DefaultE2BHTTPTimeout bounds a single HTTP call to the E2B API.
	DefaultE2BHTTPTimeout = 30 * time.Second
)

// Common errors
var (
	ErrSandboxDisabled   = errors.New("sandbox is disabled")
	ErrTimeout           = errors.New("execution timed out")
	ErrScriptNotFound    = errors.New("script not found")
	ErrInvalidScript     = errors.New("invalid script")
	ErrExecutionFailed   = errors.New("script execution failed")
	ErrSecurityViolation = errors.New("security validation failed")
	ErrDangerousCommand  = errors.New("script contains dangerous command")
	ErrArgInjection      = errors.New("argument injection detected")
	ErrStdinInjection    = errors.New("stdin injection detected")
)

// Sandbox defines the interface for isolated script execution
type Sandbox interface {
	// Execute runs a script in an isolated environment
	Execute(ctx context.Context, config *ExecuteConfig) (*ExecuteResult, error)

	// Cleanup releases sandbox resources
	Cleanup(ctx context.Context) error

	// Type returns the sandbox type
	Type() SandboxType

	// IsAvailable checks if the sandbox is available for use
	IsAvailable(ctx context.Context) bool

View on GitHub (pinned to 988cbb0330)

Solutions

1. Inspect result.Stderr ('Security validation failed: ...') for the exact rule triggered
2. Remove the offending construct (network access, file system escapes, privileged commands) from the script
3. Do not retry unchanged — the block is deterministic by design
4. Log the attempt for security auditing

When it happens

Trigger: Thrown at internal/sandbox/sandbox.go:105 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/da1bab57bcaa0e45. Report an issue: GitHub.