The Agent Skills Directory

[SAFE]: The skill manages installation of the official @box/cli Node.js package, which is the standard command-line tool provided by Box for these operations.
[SAFE]: Instructions include explicit warnings against embedding sensitive credentials such as API tokens, client secrets, or private keys in commands, prompts, or logs, which follows security best practices for secret management.
[SAFE]: The workflow mandates identity verification using box users:get me and requires explicit user confirmation before performing high-risk actions like content deletion, impersonation, or changing governance settings.
[INDIRECT_PROMPT_INJECTION]: The skill interacts with external data (Box folder and file names) which could potentially contain malicious instructions. The skill mitigates this by requiring identity confirmation and manual choice when multiple items match a search query, rather than automatically executing actions based on search results.

box-cli