boxlang-scheduled-tasks
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security risks were identified. The skill is purely instructional, providing a reference for the BoxLang scheduling engine, including the Scheduler DSL and the
bx:schedulecomponent.- [INDIRECT_PROMPT_INJECTION]: The skill documentation exposes an attack surface where an agent could be instructed to create scheduled tasks with arbitrary URLs or class names. However, this is an inherent functional capability of the scheduling platform being documented and not a malicious injection in the skill itself. - Ingestion points: Parameters for task registration such as
urlandclassName. - Boundary markers: Absent.
- Capability inventory: Background code execution via class instantiation and network triggers via HTTP GET requests.
- Sanitization: Absent.- [DYNAMIC_EXECUTION]: The skill documents the use of
schedulerStartwhich dynamically loads and executes BoxLang classes by name. This is a standard feature of the BoxLang platform for managing workloads.- [DATA_EXFILTRATION]: The skill documents thebx:schedulecomponent which triggers HTTP GET requests to external URLs. While this can be used as a vector for SSRF or exfiltration if misconfigured, it is documented here as an intended operational feature for webhooks and operational pings.
Audit Metadata