boxlang-runtime-spring-boot
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes a template engine integration that processes data from Spring controllers into BoxLang templates. This constitutes an untrusted data ingestion surface common to all view engines. The documentation mitigates this risk by explicitly instructing developers to use
encodeForHTML()to sanitize model attributes before outputting them in templates. - [DYNAMIC_EXECUTION]: The skill provides an example of direct runtime access using
BoxRuntime.executeStatement(). This is an intended feature of the BoxLang integration for executing expressions within the Java application context. The example uses a static string for date formatting, which is a benign use case for this capability. - [EXTERNAL_DOWNLOADS]: The skill references the
boxlang-spring-boot-starterdependency from theio.boxlanggroup. This matches the vendor's own namespace and is a standard way to include the necessary library for the integration described in the skill.
Audit Metadata