Box

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:48 PM UTC
• Version: 1.0.0

Overview

This is a disclosed Box CLI integration, but it can access and change whatever Box content the user-provided credentials allow.

Install only in an environment where the Box app credentials are intended for agent use. Use a dedicated least-privilege Box app or managed user, avoid broad enterprise-wide scopes, keep credential files out of the workspace and git, isolate or clean ~/.box on shared CI systems, and consider pinning or otherwise controlling the Box CLI package version for production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned Global npm Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8–15
Vulnerability Type: Unpinned third-party package installed globally
Risk Level: Medium

yaml

install:
- bins:
  - box
  global: true
  id: npm
  kind: npm
  label: Install Box CLI (npm)
  package: "@box/cli"

Technical Analysis

The skill installs @box/cli globally without specifying an exact package version or integrity constraint. Consequently, the installed code depends on whichever release the npm registry resolves when installation occurs. Although the package name is consistent with the official Box CLI and the audit found no evidence that it is currently malicious, this mutable dependency introduces supply-chain risk.

npm packages can execute lifecycle scripts during installation. If the publisher account, package, or registry delivery path were compromised, a malicious release could execute code with the permissions of the process installing the skill. A global installation can also increase the affected scope by placing package files and command shims in shared system-level locations.

Attack Path

1. An attacker compromises the npm package publisher, the package distribution process, or another relevant supply-chain component.
2. The attacker publishes a malicious version under the trusted @box/cli package name.
3. A user installs this skill after that release becomes the version selected by npm.
4. Because no exact version or integrity value is specified, npm retrieves the malicious release.
5. Malicious package code or an installation lifecycle script executes with the installer process's privileges.
6. The payload can access files, environment variables, Box credentials, and other resources available to that account, and may modify globally accessible package or command locations.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the account runnin ...[truncated 515 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @box/cli to a reviewed, exact version rather than allowing npm to resolve a mutable latest release.
2. Use a lockfile and npm integrity metadata where the skill installation mechanism supports them.
3. Establish a controlled update process that reviews release notes, package provenance, dependency changes, and published artifacts before changing the pinned version.
4. Prefer a project-local installation over a global installation when operationally possible.
5. Run installation as a dedicated, unprivileged account with access only to required directories.
6. Disable npm lifecycle scripts with --ignore-scripts if the verified package does not require them.
7. Enable dependency provenance verification, registry allowlisting, vulnerability scanning, and continuous monitoring for package ownership or integrity changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 81% confidence

Finding

Supporting .env and environment-variable based secret handling is common, but the instructions show direct interpolation of sensitive values into a shell heredoc that writes a plaintext credential file. In automation environments, env vars and generated secret files can be exposed through process inspection, build logs, shell history, misconfigured workspace mounts, or accidental inclusion in artifacts if handling constraints are not made explicit.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md

------------------------------------------------------------------------

## Option B --- Use Environment Variables (.env supported)

Set:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 76% confidence

Finding

The skill instructs users to register long-lived Box environments and notes that Box CLI stores environments in '~/.box', creating persistent authenticated state on the host. In shared runners, containers with reused volumes, or multi-tenant systems, this can leave reusable credentials available to later processes or users if the storage location is not isolated and cleaned up.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md

## Option A --- Provide a CCG Config File (Recommended)

Create a Box Custom App using:

Server Authentication (Client Credentials Grant)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md

Secure it:

chmod 600 /data/.secrets/box-ccg.json

Register it:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md

Secure it:

chmod 600 /data/.secrets/box-ccg.json

Register it:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.

md

Secure it:

chmod 600 /data/.secrets/box-ccg.json

Register it:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The Box AI section encourages AI operations on Box-hosted files but does not explicitly warn that prompts and file content may be processed by Box AI services. In a headless automation context, this omission can lead users or agents to send sensitive enterprise content to external AI processing without informed consent or policy review.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest description broadly states the skill is for working with files, folders, metadata, search, and Box AI in headless environments, but it does not define specific invocation phrases, contexts, or exclusion conditions. For a markdown/manifest file, this can make activation scope ambiguous and increase the chance of unintended invocation when a user mentions generic Box-related tasks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.