box-api
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXFILTRATION]: The skill provides instructions for sending API requests, including sensitive bearer tokens (
$BOX_API_KEY), to a non-standard domain (https://ascii.dev/api/box/v1). It also documents endpoints (GET /secrets,GET /boxes/{boxId}/files) that allow reading sensitive environment variables, secret files, and workspace content from the remote environment. - [COMMAND_EXECUTION]: The skill defines an interface for executing arbitrary shell commands within a remote container or sandbox via the
POST /boxes/{boxId}/commandsendpoint. - [INDIRECT_PROMPT_INJECTION]: The skill documents an API endpoint (
POST /boxes/{boxId}/prompt) designed to ingest and process natural language instructions for AI agents, creating a vulnerability surface for indirect prompt injection. - Ingestion points: The
promptfield in the JSON payload sent to/boxes/{boxId}/prompt. - Boundary markers: None identified in the provided documentation.
- Capability inventory: The API allows full shell command execution, file system read/write access, secret management, and desktop streaming within the remote box environment.
- Sanitization: No sanitization or validation protocols are described for the prompt input.
- [EXTERNAL_DOWNLOADS]: The skill contains links to external documentation and OpenAPI specifications hosted at
docs.ascii.dev.
Audit Metadata