box

• Outcome: Pass
• Latest audit: Oct 15, 2026 · 5:34 AM UTC
• Version: 1.0.0

Overview

This is a Box integration skill with meaningful Box account authority, but the access is disclosed, purpose-aligned, and generally controlled by confirmation guardrails.

Before installing, be comfortable giving the agent guided access to your Box account through MCP, CLI, or OAuth. Use least-privilege Box apps, do not paste secrets into chat, confirm any sharing, collaborator, bulk move, metadata write, Doc Gen, REST fallback, or local-download action, and avoid local processing for sensitive documents unless you explicitly approve it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (26)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/auth-and-setup.md (reported line 162)May include surrounding context.

md

- If MCP auth fails, guide the user through MCP setup and retry before shifting tools.
- If CLI is needed, guide the user through CLI login and verify with `box users:get me --json` before shifting tools.
- Use direct REST only after MCP and CLI remain unavailable (or CLI is explicitly declined) and after the user explicitly approves REST fallback.
- For REST fallback, prefer obtaining a fresh access token from configured Box app credentials/OAuth flow over relying on manually copied short-lived developer tokens.
- Reuse the repository's existing Box auth flow if one already exists.
- Use a user-auth flow when end users connect their own Box accounts and the app acts as that user.
- Use the enterprise or server-side pattern already approved for the Box app when the backend runs unattended or manages enterprise content.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/auth-and-setup.md (reported line 192)May include surrounding context.

md

Confirm:

- Where access tokens are issued, refreshed, or injected
- Whether requests are user-scoped, service-account-scoped, or app-user-scoped
- Whether the codebase already has pagination, retry, and rate-limit helpers
- Whether webhook verification already exists

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

## Guardrails

- Do not paste or echo client secrets, private keys, or raw access tokens into the conversation.
- Prefer read commands before write commands.
- For shared links and collaborations, confirm scope and audience before creating or widening access.
- After any write, follow up with a read command against the same object and actor.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md

## Guardrails

- Do not paste or echo client secrets, private keys, or raw access tokens into the conversation.
- Prefer read commands before write commands.
- For shared links and collaborations, confirm scope and audience before creating or widening access.
- After any write, follow up with a read command against the same object and actor.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/box-cli.md (reported line 86)May include surrounding context.

md

## Guardrails

- Do not paste or echo client secrets, private keys, or raw access tokens into the conversation.
- Prefer read commands before write commands.
- For shared links and collaborations, confirm scope and audience before creating or widening access.
- After any write, follow up with a read command against the same object and actor.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/rest-calls.md (reported line 112)May include surrounding context.

md

## Guardrails

- Do not paste or echo client secrets, private keys, or raw access tokens into the conversation.
- Prefer read commands before write commands.
- For shared links and collaborations, confirm scope and audience before creating or widening access.
- After any write, follow up with a read command against the same object and actor.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/troubleshooting.md (reported line 106)May include surrounding context.

Cause: Codex sandboxes block outbound network access by default. The CLI cannot reach api.box.com, upload.box.com, or any other Box endpoint.

Fix for Codex CLI: Add to ~/.codex/config.toml:

toml

[sandbox_workspace_write]

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The guidance explicitly tells the agent to obtain a download URL and perform local analysis when Box-native options are unavailable. That expands behavior from Box-native retrieval into exporting document content outside Box's managed environment, which can bypass expected data handling boundaries and increase exposure of sensitive files. In this skill context, that is more dangerous because the document is framed as default operational guidance for Box tasks, so an agent may treat off-platform extraction as routine rather than exceptional.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest emphasizes helping with Box authentication, setup, troubleshooting, and using Box references/tools, but does not mention modifying Box content or metadata. This workflow explicitly tells the agent to create templates if needed and call set_file_metadata, introducing write-back behavior beyond the described foundation/reference role.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The error-handling section instructs downloading files into local storage for processing when text representation limits are exceeded. This creates a direct path for sensitive Box content to be copied outside Box controls during a fallback path, which is risky because fallback/error paths are often followed automatically and may receive less scrutiny than primary flows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The guidance recommends moving file content into local storage without an explicit user-facing warning that the content is leaving Box's server-side environment. That omission undermines informed consent and can cause accidental exposure of confidential or regulated data, particularly in an enterprise content platform where users may expect processing to remain in-place.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/box-cli.md (reported line 55)May include surrounding context.

md

- Add an environment from an app config file:
  - `box configure:environments:add PATH`

Never ask the user to paste credentials, tokens, or secrets into the conversation. If credentials are needed, guide the user to set them as environment variables or in the appropriate config file.

After login or environment setup, re-run `box users:get me --json` to confirm the CLI can make authenticated calls.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/bulk-operations.md (reported line 127)May include surrounding context.

box folders:create <SEC_FILINGS_ID> "10-K" --json

REST

curl -sS -X POST -H "Authorization: Bearer $BOX_ACCESS_TOKEN" -H "Content-Type: application/json" -H "Accept: application/json" "https://api.box.com/2.0/folders" -d '{"name":"SEC Filings","parent":{"id":"<PARENT_ID>"}}'

text

Handle `409 Conflict` by listing the parent folder to find the existing folder's ID rather than failing the entire operation.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The guidance explicitly permits uploading to the root folder when the user has not specified a destination, which can lead to misfiling sensitive content into a broad default location without informed user approval. In a Box workflow skill, defaulting write actions to a high-level container increases the chance of unintended visibility, retention, or operational mistakes, especially because Box roots are often heavily used and may have broader organizational access patterns than a purpose-specific folder.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The text states that template tags only support English, which is a language constraint. Under the policy, language or locale restrictions should be offered as a user choice or clearly justified as region-specific; here it is presented as a hard limitation without opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/bulk-operations.md (reported line 63)May include surrounding context.

md

## Auth and base URLs

- API base URL: `https://api.box.com/2.0`
- Upload base URL: `https://upload.box.com/api/2.0`
- Required auth header: `Authorization: Bearer $BOX_ACCESS_TOKEN`
- Recommended default header: `Accept: application/json`

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/bulk-operations.md (reported line 127)May include surrounding context.

md

## Auth and base URLs

- API base URL: `https://api.box.com/2.0`
- Upload base URL: `https://upload.box.com/api/2.0`
- Required auth header: `Authorization: Bearer $BOX_ACCESS_TOKEN`
- Recommended default header: `Accept: application/json`

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/bulk-operations.md (reported line 140)May include surrounding context.

md

## Auth and base URLs

- API base URL: `https://api.box.com/2.0`
- Upload base URL: `https://upload.box.com/api/2.0`
- Required auth header: `Authorization: Bearer $BOX_ACCESS_TOKEN`
- Recommended default header: `Accept: application/json`

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/rest-calls.md (reported line 22)May include surrounding context.

md

## Auth and base URLs

- API base URL: `https://api.box.com/2.0`
- Upload base URL: `https://upload.box.com/api/2.0`
- Required auth header: `Authorization: Bearer $BOX_ACCESS_TOKEN`
- Recommended default header: `Accept: application/json`

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/rest-calls.md (reported line 43)May include surrounding context.

md

## Auth and base URLs

- API base URL: `https://api.box.com/2.0`
- Upload base URL: `https://upload.box.com/api/2.0`
- Required auth header: `Authorization: Bearer $BOX_ACCESS_TOKEN`
- Recommended default header: `Accept: application/json`

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/rest-calls.md (reported line 52)May include surrounding context.

md

## Auth and base URLs

- API base URL: `https://api.box.com/2.0`
- Upload base URL: `https://upload.box.com/api/2.0`
- Required auth header: `Authorization: Bearer $BOX_ACCESS_TOKEN`
- Recommended default header: `Accept: application/json`

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/rest-calls.md (reported line 62)May include surrounding context.

md

## Auth and base URLs

- API base URL: `https://api.box.com/2.0`
- Upload base URL: `https://upload.box.com/api/2.0`
- Required auth header: `Authorization: Bearer $BOX_ACCESS_TOKEN`
- Recommended default header: `Accept: application/json`

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/rest-calls.md (reported line 73)May include surrounding context.

md

## Auth and base URLs

- API base URL: `https://api.box.com/2.0`
- Upload base URL: `https://upload.box.com/api/2.0`
- Required auth header: `Authorization: Bearer $BOX_ACCESS_TOKEN`
- Recommended default header: `Accept: application/json`

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/rest-calls.md (reported line 40)May include surrounding context.

Read folder:

bash

curl -sS \
  -H "Authorization: Bearer $BOX_ACCESS_TOKEN" \
  -H "Accept: application/json" \
  "https://api.box.com/2.0/folders/0?fields=id,name,item_collection"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/troubleshooting.md (reported line 46)May include surrounding context.

md

## 409

- File or folder name conflict on create or upload
- Collaboration already exists
- Metadata write conflicts with the expected template or instance state

Static analysis

No suspicious patterns detected.