uipath-connector-builder
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The skill is centered around generating and registering JavaScript hooks (preRequest and postRequest) that are executed at runtime within the Denali engine. The documentation provides a strict allowlist of available modules, including axios, crypto, url, and lodash, and mandates specific execution patterns like the requirement for a trailing done() call to prevent process hanging.
- [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting external data such as vendor API documentation and existing JSON configuration files from periodic repository structures. While this represents a surface for instructions embedded in external docs to influence the agent, the skill mitigates this risk by requiring the use of the builder validate command to enforce schema integrity and catch logical errors before publication.
- [EXTERNAL_DOWNLOADS]: The skill describes fetching existing connector designs from the UiPath platform using the uip is connectors download command. These downloads target the vendor's official infrastructure and are governed by the user's active authentication session via uip login.
Audit Metadata