boxlang-syntax-check
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the local
boxlangCLI binary to perform syntax checks and version verification. The commandboxlang checkis used to process file paths provided by the user or agent. - [INDIRECT_PROMPT_INJECTION]: The skill serves as a surface for indirect prompt injection by reading and processing external source files whose content is then returned to the agent's context as error messages.
- Ingestion points: The tool reads source code from files with extensions such as
.bx,.cfc, and.cfmto perform parsing. - Boundary markers: The instructions do not define specific delimiters or warning prompts to prevent the agent from interpreting instructions embedded within the source code or error messages.
- Capability inventory: The skill has the capability to execute the
boxlangCLI tool and read the resulting output. - Sanitization: There is no evidence of sanitization or filtering applied to the CLI output (messages, lines, columns) before it is processed by the agent.
Audit Metadata