univer-integrate
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes instructions and templates that fetch official @univerjs library components from the NPM registry and load UMD bundles from unpkg.com, a well-known and trusted content delivery network.
- [COMMAND_EXECUTION]: Integration templates and setup guides use standard package management and execution commands such as npm install, vite, and tsx to manage project dependencies and run application logic.
- [PROMPT_INJECTION]: The skill provides mechanisms for processing external workbook and document data. 1. Ingestion points: univerAPI.createWorkbook() and CSV import processes. 2. Boundary markers: The documentation recommends validating untrusted JSON snapshots against a project-specific schema. 3. Capability inventory: Includes workbook manipulation, formula calculation, and network operations via optional plugins. 4. Sanitization: The skill explicitly advises users to validate untrusted JSON and escape potentially dangerous formula characters in CSV data before processing or exporting.
Audit Metadata