boxlang-web-development
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides examples of integrating with external services using
httpGet(),bx:http, and thesoap()BIF. These examples use standard placeholder domains such asapi.example.comandexample.comto demonstrate API communication. - [COMMAND_EXECUTION]: Instructions are included for starting development and production server environments using the framework's CLI tools,
boxlang-miniserverandbox server start. - [INDIRECT_PROMPT_INJECTION]: The skill documents the processing of user-supplied data from web request scopes, which establishes an ingestion surface for external data.
- Ingestion points: Access to
url,form, andcgiscopes is documented inSKILL.md. - Boundary markers: The skill demonstrates security best practices by providing examples of CSRF token generation and verification.
- Capability inventory: The documentation showcases capabilities for file system writes (
fileWrite), network requests (bx:http), and dynamic template inclusion (include). - Sanitization: Code examples include basic data validation (
trim()) and secure password storage (hashPassword()).
Audit Metadata