bx-unsafe-evaluate

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill documents the evaluate() function, which is a primitive for executing arbitrary strings as code at runtime. The documentation identifies this as a security risk and includes a 'danger' hint warning that it can create injection vulnerabilities if user-controlled input reaches it. It provides safer alternatives like struct key access and the invoke() function, which reduces the risk of an agent defaulting to unsafe execution patterns.
  • [COMMAND_EXECUTION]: The documentation includes installation instructions for the bx-unsafe-evaluate module using the install-bx-module and box install commands. These are standard package management operations for the BoxLang ecosystem and are appropriate for the skill's role in documenting a platform-specific feature.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 09:54 PM