bx-compat-cfml

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the user or agent to install the compatibility layer using the box CLI and a specialized installation script.
  • Evidence: Commands install-bx-module bx-compat-cfml and box install bx-compat-cfml are provided in the Installation and Migration Workflow sections of SKILL.md for fetching vendor-supported modules.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to facilitate the migration of existing Adobe ColdFusion or Lucee CFML applications, creating an attack surface where the agent processes external, potentially untrusted data.
  • Ingestion points: The migration workflow (Step 2 and Step 4) directs the agent to run and convert legacy .cfc and .cfm source code files.
  • Capability inventory: The skill setup involves command execution for module installation and file system interaction for source code identification and conversion.
  • Boundary markers: No delimiters or specific instructions are present in SKILL.md to guide the agent to ignore or isolate instructions that may be embedded within the legacy application code being migrated.
  • Sanitization: The instructions do not include steps for sanitizing, escaping, or validating the content of the legacy source files before the agent processes them.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 09:47 PM