Skills
skills/ortus-boxlang/skills/commandbox-package-management/Gen Agent Trust Hub

commandbox-package-management

Pass

Audited by Gen Agent Trust Hub on Apr 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill documents how to install packages from a wide range of remote endpoints including ForgeBox (the official registry), Git repositories (GitHub, GitLab, Bitbucket), arbitrary HTTP/HTTPS URLs (zip and jar files), Amazon S3 buckets, and GitHub Gists.
  • [REMOTE_CODE_EXECUTION]: CommandBox supports lifecycle scripts such as preInstall, postInstall, and postUpdate defined within the box.json descriptor. These hooks can execute arbitrary shell commands automatically when packages are installed or updated, which is a standard behavior for package managers to handle project setup.
  • [COMMAND_EXECUTION]: The skill includes instructions for manually executing defined project scripts using the run-script command. These scripts are user-defined in the box.json file and are used for build tasks, testing, or other project-specific automation.
  • [CREDENTIALS_UNSAFE]: The documentation provides instructions on how to set a ForgeBox API token using the config set command. It utilizes a placeholder (your-forgebox-api-key) and describes a standard configuration step for authenticating with the package registry.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 15, 2026, 02:44 PM