uipath-aops
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection by processing external data from managed services.
- Ingestion points: The agent retrieves solution, project, and process metadata from the StudioAdmin and Orchestrator APIs using the uip aops CLI tool (referenced in SKILL.md and discovery-flow.md).
- Boundary markers: The skill's instructions lack explicit requirements for using delimiters or "ignore instructions" markers when handling external metadata strings like process descriptions.
- Capability inventory: The skill utilizes the Bash tool to execute system commands and the Write tool to create configuration files on disk.
- Sanitization: While JSON parsing is used for input arguments, the instructions do not specify sanitization or validation for other text-based metadata fields interpolated into the agent's reasoning.
- [EXTERNAL_DOWNLOADS]: The skill recommends the installation of the @uipath/aops-tool CLI plugin. This is a legitimate resource owned by the vendor (uipath) and serves as a standard extension for their platform.
- [COMMAND_EXECUTION]: The skill relies on the uip aops CLI to perform resource discovery, manage authentication, and trigger CICD pipeline operations. These shell commands are integral to the skill's primary functionality and target the vendor's own service endpoints.
Audit Metadata