boxlang-deployment
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill includes instructions to download and execute shell scripts for installing the BoxLang Version Manager and the runtime. These scripts are hosted on the official vendor domain, downloads.ortussolutions.com.
- [COMMAND_EXECUTION]: Orchestrates application deployment and management through CLI tools including CommandBox, Docker, and AWS SAM. It also manages server lifecycles and container builds.
- [EXTERNAL_DOWNLOADS]: Fetches cryptographic GPG keys and repository definitions from official vendor servers to facilitate secure package management and tool installation.
- [PRIVILEGE_ESCALATION]: Includes instructions for system-level configuration, such as adding repository sources to apt and installing packages via system package managers like apt-get and Homebrew.
- [INDIRECT_PROMPT_INJECTION]: As a deployment automation tool, the skill is designed to process project configuration files including boxlang.json, server.json, and docker-compose.yml. Ingestion points: these project-specific configuration files. Capability inventory: file system access, network service management, and external CLI tool execution. Boundary markers: none specified. Sanitization: none defined. This behavior is standard for the skill's intended deployment functionality.
Audit Metadata