matchbox-native-fusion
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the use of the
matchbox --target nativecommand to compile Rust source files located in thenative/directory into a standalone binary. - [EXTERNAL_DOWNLOADS]: The skill facilitates the use of
native/Cargo.toml, which causes the Rust package manager (Cargo) to download and link external crates (e.g.,serde_json) from the official crates.io registry during the build process. - [DYNAMIC_EXECUTION]: The primary purpose of the skill is to enable the development and execution of native Rust code within the BoxLang environment, which involves compiling user-provided Rust source code at build time and executing the resulting machine code at runtime.
- [INDIRECT_PROMPT_INJECTION]: Native functions created using this skill process data originating from BoxLang. While the skill does not contain malicious code, developers should ensure that Rust BIFs (Built-In Functions) appropriately sanitize inputs to prevent potential vulnerabilities when processing untrusted strings or objects.
Audit Metadata