bx-ai-agents
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The framework handles external data from multiple sources including user input and MCP server outputs.
- Ingestion points: The
agent.run()method and MCP server responses described in SKILL.md. - Boundary markers: The framework provides the
aiFence()BIF specifically to wrap untrusted content in delimiters. - Capability inventory: Supports tool execution (SQL, order processing) and subprocess management (MCP).
- Sanitization: Includes
aiFence(),GuardrailMiddlewarefor regex-based filtering, and human-in-the-loop approval middleware. - [COMMAND_EXECUTION]: The skill documents the capability to execute local programs as child processes using the Model Context Protocol (MCP) stdio configuration, managed via
commandGuard. - [DYNAMIC_EXECUTION]: The framework allows dynamic loading of instructions and code via the
aiSkill()BIF, which can load markdown content from local directory paths.
Audit Metadata