The Agent Skills Directory

[COMMAND_EXECUTION]: The SDK provides multiple methods for executing code and shell commands within the sandboxed environment, including box.exec.command(), box.exec.code(), and interactive box.exec.session() sessions with PTY support.
[EXTERNAL_DOWNLOADS]: The skill instructs users to install the @upstash/box package and its peer dependency zod from the official registry. It also provides examples for adding additional skills from the Upstash registry and using MCP servers like @modelcontextprotocol/server-filesystem.
[PERSISTENCE]: The SDK supports persistence mechanisms within the cloud container via schedule.exec() and schedule.agent() for cron-based tasks, and initCommand for boxes configured with keepAlive.
[INDIRECT_PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection as it facilitates agents processing untrusted data from git repositories (box.git.clone) or uploaded files. The documentation explicitly advises pairing untrusted inputs with restrictive network policies.
Ingestion points: Files are ingested via box.git.clone(), box.files.upload(), and box.files.write(), which are then accessible to box.agent.run() prompts.
Boundary markers: Not explicitly defined in the basic prompt examples, though responseSchema allows for structured output validation.
Capability inventory: The container environment supports subprocess execution (box.exec.*), file system modifications (box.files.*), and network exposure (box.getPublicURL).
Sanitization: The SDK provides networkPolicy controls to mitigate risks when the agent handles untrusted data.
[CREDENTIALS_UNSAFE]: The documentation describes how to manage sensitive credentials like UPSTASH_BOX_API_KEY and GITHUB_TOKEN via environment variables and constructor configuration. It also supports attachHeaders to securely inject secrets into outbound HTTPS requests.

upstash-box-js