The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documents the configuration and execution of the boxlang-miniserver binary via CLI flags and environment variables. These are standard operational commands for the intended purpose of managing a web server runtime.
[INDIRECT_PROMPT_INJECTION]: The skill describes a web server environment that ingests untrusted external data via HTTP requests, which is an inherent attack surface for indirect prompt injection.
Ingestion points: The BoxLang MiniServer processes incoming HTTP requests as detailed in SKILL.md.
Boundary markers: The runtime provides native protection by automatically returning a 404 for any files or directories starting with a dot (e.g., .env, .git), preventing unauthorized access to sensitive configuration files.
Capability inventory: The skill facilitates running a web server binary, binding to network ports, and managing file system access within a designated webroot.
Sanitization: Security is enhanced through the --health-check-secure flag, which restricts detailed system metadata to localhost-only callers while providing minimal status to remote probes.
[SAFE]: The skill uses safe practices for secret management by instructing users to utilize .env files and the getSystemSetting() function, ensuring credentials are not hardcoded and are protected from HTTP exposure.

boxlang-runtime-miniserver