box-automation
Warn
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the user to configure a third-party MCP server endpoint (https://rube.app/mcp). This establishes a dependency on an external service that is not part of the standard set of trusted providers.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from an external source (Box), which can contain untrusted content capable of influencing the agent's behavior.
- Ingestion points: Content is retrieved from the Box environment via tools such as BOX_DOWNLOAD_FILE, BOX_SEARCH_FOR_CONTENT, and BOX_LIST_ITEMS_IN_FOLDER as described in SKILL.md.
- Boundary markers: The instructions do not specify any delimiters or safety markers to differentiate between user instructions and external data retrieved from Box.
- Capability inventory: The skill possesses significant write capabilities across the Box environment, including BOX_UPLOAD_FILE, BOX_CREATE_FOLDER, BOX_DELETE_FILE, and BOX_UPDATE_COLLABORATION as listed in the Tool Reference.
- Sanitization: There is no mention of sanitization, validation, or filtering of the content retrieved from Box before it is passed to the agent's context.
Audit Metadata