The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of prerequisite components from official repositories. Evidence in SKILL.md shows installation commands (npx skills add) referencing https://github.com/box/box-for-ai and box/box-for-ai.
[COMMAND_EXECUTION]: The workflow utilizes specialized platform tools for file and metadata management.
create_collaboration is used to grant specific users access permissions to files.
set_file_metadata is used to persist extracted contract data to the file system.
upload_file is used to create and store contract variance reports.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted contract documents, which represents an indirect injection surface.
Ingestion points: Contract files are retrieved via search tools and passed to ai_qa_multi_file and ai_extract_structured_from_metadata_template (SKILL.md).
Boundary markers: The instructions explicitly constrain the AI to factual extraction and citations, forbidding it from making subjective risk determinations.
Capability inventory: The skill has access to file writing (upload_file), metadata modification (set_file_metadata), and permission management (create_collaboration).
Sanitization: The workflow requires human confirmation ([CONFIRM]) for critical fields, ratings, and access grants, providing a verification layer over AI-extracted content.

box-legal-workflows-contract