boxlang-runtime-github-actions
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documents the use of the
ortus-boxlang/setup-boxlangGitHub Action to install the BoxLang runtime. This represents standard vendor-provided functionality for CI/CD environments. - [INDIRECT_PROMPT_INJECTION]: The skill provides templates that ingest and execute project-specific code within a CI/CD context. This represents an attack surface where malicious project code could influence the pipeline, though it is standard for CI/CD operations.
- Ingestion points: The workflow templates process local repository files through the
actions/checkoutstep. - Boundary markers: Commands are delimited within standard YAML
runblocks. - Capability inventory: The templates perform file system access, network operations for module installation via ForgeBox, and subprocess execution using the
boxlangandboxCLI tools. - Sanitization: The skill relies on standard CI/CD security models where project code is executed within the isolated runner environment.
Audit Metadata