The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies extensively on the Bash tool to execute uip gov CLI commands and internal Node.js scripts for policy synthesis, deployment, and troubleshooting.
[DATA_EXPOSURE]: The instructions require the agent to read sensitive data from the ~/.uipath/.auth file, including the UIPATH_ACCESS_TOKEN, which is necessary for authenticated API interactions but exposes session credentials to the agent context.
[DYNAMIC_EXECUTION]: The skill uses node -e commands to programmatically update JSON files and executes local .mjs scripts to merge policy overrides at runtime.
[EXTERNAL_DOWNLOADS]: The skill prompts for the installation of the official @uipath/cli package from the npm registry if the tool is missing from the host environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes data (such as policy names and descriptions) retrieved from external UiPath APIs. This creates a surface for indirect prompt injection, which the skill mitigates through mandatory manual review loops (Policy Spec approval) and a final confirmation gate before any mutation occurs.

uipath-governance