The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions to conceal agent actions and tool outputs from the user. For instance, references/dashboards/CAPABILITY.md states, 'The user should see nothing between their request and the plan. No "Reading files…", no "Checking login…". Pure silence then the plan.' and references/dashboards/plugins/deploy/impl.md directs that 'All other steps are silent — run commands, read outputs in context, never echo raw JSON or bash output to the user.' This PI_CONCEALMENT pattern reduces user oversight and could be used to mask unauthorized or malicious activities.
[DYNAMIC_EXECUTION]: The debugging workflow in references/debug.md instructs the agent to generate complex JavaScript files (reproduce.mjs, clear-state.mjs) that use the Playwright browser automation framework and execute them at runtime. Authoring and running automation scripts dynamically is a high-risk pattern as it executes code generated by the LLM with access to local and network resources.
[COMMAND_EXECUTION]: The dashboard build pipeline (assets/scripts/dashboards/build-dashboard.mjs and related flows) uses execSync to run shell commands like npm ci, npm install, and npx tsc. It also involves moving agent-authored TypeScript modules into the project structure for compilation, which provides an execution path for agent-generated logic.
[PRIVILEGE_ESCALATION]: The skill automates administrative tasks in the UiPath cloud environment. references/debug.md encourages high autonomy ('Do everything you can with your tools. Only ask the user for things the agent physically cannot do'), and assets/scripts/dashboards/setup-admin-folder.mjs uses the CLI to automatically assign 'Folder Administrator' roles to groups, potentially granting elevated permissions without explicit step-by-step confirmation.
[EXTERNAL_DOWNLOADS]: The skill routinely downloads and installs numerous packages from the public npm registry (registry.npmjs.org). While these packages originate from the trusted 'uipath' organization and standard libraries (e.g., playwright, react-pdf, lucide-react), the runtime installation of dependencies is a significant attack surface.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface by ingesting natural language descriptions to generate application logic (intent.json).
Ingestion points: Dashboard and metric descriptions in CAPABILITY.md and intent.json.
Boundary markers: The skill uses some structured choices for intent classification, but the core metric logic (fnBody) is generated directly from user-influenced prompts.
Capability inventory: Includes file system writes, network requests via fetch and SDK, package installation, and administrative CLI operations (uip admin).
Sanitization: There is schema validation for the structured intent.json file, but the logic within the agent-written metric modules remains unverified.

uipath-coded-apps