boxlang-runtime-esp32 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited boxlang-runtime-esp32 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
BoxLang is the AI-native software productivity platform for building, modernizing and running applications, with developers and AI agents working together.
MatchBox can compile and deploy BoxLang scripts directly to ESP32 microcontrollers using --target esp32. BoxLang runs on FreeRTOS with a custom task stack, and bytecode is stored in a dedicated flash partition. Full firmware flashing is only needed on first setup; subsequent deploys update only the bytecode (~1 second).
# Rust ESP32 toolchain
cargo install espup
espup install
# Flashing and linking
cargo install espflash # 3.3.0 or newer
cargo install ldproxy
# Activate a real ESP-IDF checkout (needs C build tools, Python, CMake, Ninja)
source /path/to/esp-idf/export.sh
export RUSTUP_TOOLCHAIN=espRun MatchBox from that same shell. Run matchbox esp32-doctor to check the prerequisites and print fixes. On WSL, attach the USB device with usbipd-win first.
The first deploy installs the BoxLang firmware onto the device:
matchbox app.bxs --target esp32 --chip esp32s3 --full-flash--full-flash installs the full firmware (bootloader, partition table, and ByteCode VM)After the firmware is installed, subsequent deploys update only the bytecode partition:
matchbox app.bxs --target esp32 --chip esp32s3 --flashstorage partition at 0x110000Use --watch for rapid iteration during development:
matchbox app.bxs --target esp32 --chip esp32s3 --flash --watch.bxs files for changesespflash monitor to show serial output| Chip | Flag |
|---|---|
| ESP32-S3 | --chip esp32s3 |
| ESP32-C3 | --chip esp32c3 |
| ESP32 (original) | --chip esp32 |
BoxLang runs as a FreeRTOS task with the following constraints:
| Property | Value |
|---|---|
| Task stack size | 48 KB |
| Bytecode partition | storage at 0x110000 |
| Partition size | 1 MB |
| CPU | Xtensa LX7 (S3) / RISC-V (C3) |
Keep your BoxLang scripts lean — avoid deep call stacks and large in-memory data structures.
Detect ESP32 environment in BoxLang code:
var arch = server.os.arch
if ( arch == "xtensa" ) {
// ESP32-S3 (Xtensa LX7)
println( "Running on Xtensa ESP32" )
} else if ( arch == "riscv" ) {
// ESP32-C3 (RISC-V)
println( "Running on RISC-V ESP32" )
} else {
// Running on desktop (JVM BoxLang or MatchBox native)
println( "Running on: " & arch )
}// hello_esp32.bxs
println( "[BoxLang] Hello from ESP32!" )
println( "[BoxLang] Current Chip Architecture: " & server.os.arch )
for ( i = 1; i <= 10; i++ ) {
println( "[BoxLang] Loop iteration: #i#" )
sleep( 1000 )
}matchbox hello_esp32.bxs --target esp32 --chip esp32s3 --flashprintln goes to the serial console. There are no built-in GPIO, I2C or WiFi BIFs. For hardware access use Native Fusion or a module that provides hardware wrappers.
Web apps: web.server() works as a lean subset when you add --esp32-web (routes, middleware, event.renderJson() and event.renderHtml()). app.listen(), views and templates, static file middleware, webhooks, cookies and sessions fail at compile time.
View serial output from the device:
# via espflash
espflash monitor
# Or let --watch mode handle it automatically
matchbox app.bxs --target esp32 --chip esp32s3 --flash --watch0x000000 Bootloader
0x008000 Partition Table
0x010000 BoxLang Firmware (VM + Rust runtime)
0x110000 Storage Partition (BoxLang Bytecode, 1MB)The --flash flag targets only 0x110000 — no firmware reinstall.
1. Write BoxLang script (box.bxs)
2. First-time: matchbox box.bxs --target esp32 --chip esp32s3 --full-flash
3. Iterate: matchbox box.bxs --target esp32 --chip esp32s3 --flash --watch
4. Monitor serial output in the watch console
5. Test on desktop before deploying: matchbox box.bxs (interpreted)espup, espflash (3.3.0+) and ldproxy, activate ESP-IDF, set RUSTUP_TOOLCHAIN=esp, and run matchbox esp32-doctor--full-flash once per device to install firmware--flash (not --full-flash) for all subsequent code updates (~1 second)--watch during development for immediate recompile + redeploy cyclesserver.os.arch to detect "xtensa" or "riscv" at runtimematchbox app.bxs before deploying to hardware~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.