bx-boxes
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on executing various shell commands locally and remotely to manage the sandbox lifecycle and environment.\n
- Evidence: Use of commands such as bx new, boat push, herdr machine add, ssh, and pkill -x herdr to manage remote machines and processes.\n- [EXTERNAL_DOWNLOADS]: The skill uses external tools to retrieve source code and install project dependencies.\n
- Evidence: Use of gh repo clone to download repositories and pnpm install to fetch Node.js packages from registries.\n- [INDIRECT_PROMPT_INJECTION]: The skill's workflow for monitoring remote agents and command output creates a surface for indirect prompt injection.\n
- Ingestion points: Remote output is read into the agent's context through herdr pane read, herdr agent read, and ssh cat ~/run.exit.\n
- Boundary markers: Absent. The instructions do not specify the use of delimiters or 'ignore embedded instructions' markers when reading the remote content.\n
- Capability inventory: The skill possesses significant capabilities, including arbitrary command execution (via herdr and ssh), file system operations (cp, tar), and network interaction (gh, boat scp).\n
- Sanitization: Absent. There is no mention of sanitizing or validating the output retrieved from the sandboxes before it is processed by the agent.
Audit Metadata