bx-ai-tools
Warn
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The 'calc' tool example utilizes the 'evaluate(expr)' function to process mathematical expressions. Since 'evaluate' executes strings as code in the underlying engine, it creates a risk where a malicious prompt could trick the AI into executing arbitrary logic or accessing system resources.
- [COMMAND_EXECUTION]: Documentation for the 'FileSystemTools' built-in set indicates that providing an empty 'allowedPaths' list allows the agent to access all paths on the host system. This configuration lacks the principle of least privilege and exposes sensitive system files to manipulation.
- [INDIRECT_PROMPT_INJECTION]: The skill architecture involves tools that ingest external data and perform privileged actions, creating a vulnerability surface for indirect prompt injection.
- Ingestion points: Parameters in tools like 'get_weather', 'search_database', and 'send_email' as defined in 'SKILL.md'.
- Boundary markers: Examples do not demonstrate the use of delimiters or instructions to ignore embedded commands.
- Capability inventory: Includes database querying ('queryExecute'), user data loading ('entityLoad'), email transmission ('mailService.send'), and filesystem operations ('readFile', 'writeFile', 'editFile').
- Sanitization: The provided examples do not illustrate sanitization or validation of input arguments before they are used in sensitive operations.
Audit Metadata