unifi
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation in the README provides installation commands for the 'uv' package manager via a script at astral.sh. Astral is a widely recognized and trusted service in the developer community, and this pattern is standard for the tool's distribution.
- [DYNAMIC_EXECUTION]: The application employs dynamic module loading via importlib.import_module() in its agent-to-agent protocol implementation and unit tests. This mechanism supports flexible feature discovery and isolated module testing, representing legitimate developer intent.
- [INDIRECT_PROMPT_INJECTION]: The skill interacts with external UniFi controller data, creating an attack surface for indirect prompt injection if a controller returns malicious metadata. This risk is effectively managed by the project's 'safety-first' design, which enforces a mandatory confirmation flag (confirm=True) for all state-changing operations and utilizes input sanitization utilities.
Audit Metadata