skills/dl-alexandre/skills/unifi-cli/Gen Agent Trust Hub

unifi-cli

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill directs users to install the unifi tool from the author's Homebrew tap (dl-alexandre/tap). This is a resource controlled by the skill's vendor.
  • [COMMAND_EXECUTION]: The skill facilitates the execution of CLI commands like unifi init, unifi sites list, and unifi devices list to manage local network infrastructure.
  • [INDIRECT_PROMPT_INJECTION]: The skill presents shell workflows that ingest data directly from the network controller (such as site names) and interpolate them into loops and other commands. This surface could be exploited if the data on the controller (e.g., a maliciously named site) contains characters designed to break shell syntax or influence the agent's behavior.
  • Ingestion points: Data retrieved from the UniFi Controller API via unifi commands in SKILL.md (e.g., unifi sites list).
  • Boundary markers: Absent in the provided shell script examples.
  • Capability inventory: Shell command execution, echo, and jq processing.
  • Sanitization: The skill uses jq for JSON parsing but lacks explicit sanitization for data interpolated into shell loop variables.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 03:07 AM