bx-compat-cfml
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the user or agent to install the compatibility layer using the
boxCLI and a specialized installation script. - Evidence: Commands
install-bx-module bx-compat-cfmlandbox install bx-compat-cfmlare provided in the Installation and Migration Workflow sections ofSKILL.mdfor fetching vendor-supported modules. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to facilitate the migration of existing Adobe ColdFusion or Lucee CFML applications, creating an attack surface where the agent processes external, potentially untrusted data.
- Ingestion points: The migration workflow (Step 2 and Step 4) directs the agent to run and convert legacy
.cfcand.cfmsource code files. - Capability inventory: The skill setup involves command execution for module installation and file system interaction for source code identification and conversion.
- Boundary markers: No delimiters or specific instructions are present in
SKILL.mdto guide the agent to ignore or isolate instructions that may be embedded within the legacy application code being migrated. - Sanitization: The instructions do not include steps for sanitizing, escaping, or validating the content of the legacy source files before the agent processes them.
Audit Metadata