uipath-governance
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install the official UiPath CLI from 'https://download.uipath.com/uipath-cli/install.sh' and 'https://download.uipath.com/uipath-cli/install.ps1'. These are verified vendor resources from the skill author's official domain.
- [COMMAND_EXECUTION]: The skill executes the 'uip' CLI tool to perform governance operations. It also executes local Node.js helper scripts ('merge-overrides.mjs' and 'synthesize-formdata.mjs') included in the skill package for JSON data manipulation. These scripts perform object merging and data extraction without using dangerous functions like eval().
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect injection by ingesting external catalog and coverage data from the UiPath API. It mitigates this risk by using structured JSON processing through dedicated scripts and by providing a human-readable 'Policy Spec' for user review and approval before any policy is created or updated.
Audit Metadata