The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions direct the agent to retrieve sensitive authentication information from the local file system at ~/.uipath/.auth. This file stores the user's UiPath cloud access tokens and session data.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from the external Automation Hub API, creating a vulnerability surface for indirect prompt injection.
Ingestion points: Data is retrieved via endpoints such as GET /automations/{id}, GET /automations/{process_id}/documents, and GET /idea-schema as documented in references/api-endpoints.md.
Boundary markers: The instructions do not define specific boundary markers or provide explicit instructions for the agent to treat content from the API as untrusted data.
Capability inventory: The skill utilizes the Bash tool (for curl and uip CLI commands) and the Read tool, which could be exploited if malicious content is processed by the agent.
Sanitization: There are no requirements or steps provided to sanitize or validate the data fetched from the API before it is processed or presented to the user.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute uip and curl commands, interpolating variables such as $ACCESS_TOKEN, $ORG, $TENANT, and $PROCESS_ID directly into the shell execution strings.

uipath-automationhub