bx-unsafe-evaluate
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill documents the
evaluate()function, which is a primitive for executing arbitrary strings as code at runtime. The documentation identifies this as a security risk and includes a 'danger' hint warning that it can create injection vulnerabilities if user-controlled input reaches it. It provides safer alternatives like struct key access and theinvoke()function, which reduces the risk of an agent defaulting to unsafe execution patterns. - [COMMAND_EXECUTION]: The documentation includes installation instructions for the
bx-unsafe-evaluatemodule using theinstall-bx-moduleandbox installcommands. These are standard package management operations for the BoxLang ecosystem and are appropriate for the skill's role in documenting a platform-specific feature.
Audit Metadata