boxlang-web-development

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides examples of integrating with external services using httpGet(), bx:http, and the soap() BIF. These examples use standard placeholder domains such as api.example.com and example.com to demonstrate API communication.
  • [COMMAND_EXECUTION]: Instructions are included for starting development and production server environments using the framework's CLI tools, boxlang-miniserver and box server start.
  • [INDIRECT_PROMPT_INJECTION]: The skill documents the processing of user-supplied data from web request scopes, which establishes an ingestion surface for external data.
  • Ingestion points: Access to url, form, and cgi scopes is documented in SKILL.md.
  • Boundary markers: The skill demonstrates security best practices by providing examples of CSRF token generation and verification.
  • Capability inventory: The documentation showcases capabilities for file system writes (fileWrite), network requests (bx:http), and dynamic template inclusion (include).
  • Sanitization: Code examples include basic data validation (trim()) and secure password storage (hashPassword()).
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 09:47 PM