boxlang-runtime-desktop-electron
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the management of the BoxLang MiniServer, which is spawned as a local operating system process to serve application content.- [PRIVILEGE_ESCALATION]: Instructions include ensuring executable permissions for the runtime binaries on Unix-like platforms and the provision of scripts (e.g., mac-open.sh, win-unblock.ps1) to assist users in bypassing OS security warnings for unsigned application artifacts.- [EXTERNAL_DOWNLOADS]: The packaging process fetches the BoxLang runtime from external sources, driven by the version specified in the .bvmrc configuration file.- [INDIRECT_PROMPT_INJECTION]: The skill utilizes external configuration files as ingestion points for runtime settings, representing an indirect injection surface. * Ingestion points: miniserver.json, .bvmrc, .boxlang.json, .boxlang-dev.json. * Boundary markers: None identified in the provided instructions. * Capability inventory: Process spawning, file writing, and local network operations. * Sanitization: No explicit validation or sanitization mechanisms are described.
Audit Metadata