box-ascii
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill provides best-practice instructions for managing the BOX_API_KEY, explicitly warning against printing secrets, searching unrelated credential stores, or passing secrets as command-line arguments.
- [COMMAND_EXECUTION]: The skill's core purpose is the management of remote VMs via API and SSH commands. It includes safety recommendations to verify SSH host-key material and maintain restricted local permissions for private keys.
- [EXTERNAL_DOWNLOADS]: While the skill references installing the Box CLI and SDKs, it explicitly cautions the agent not to execute remote installers blindly and to follow official documentation.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the Ascii REST API and provides a framework for verifying machine state and filtering output, reducing the surface for injection from API responses.
Audit Metadata