uipath-human-in-the-loop
Pass
Audited by Gen Agent Trust Hub on May 5, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill reads the file
~/.uipath/.authto retrieve authentication credentials. This is used to authenticate requests to official UiPath cloud services (e.g.,alpha.uipath.com) for resource discovery and configuration. As the skill is authored by the vendor (UiPath) and operates within its own platform architecture, this is considered legitimate operational behavior. - [COMMAND_EXECUTION]: Utilizes the
uipCLI tool and standard system commands (find,sed,rsync) via the Bash tool to perform project scaffolding, file discovery, and flow validation. It also usesnode -efor local UUID generation. - [PROMPT_INJECTION]: Acts as a surface for indirect prompt injection by processing external data such as
.flowfiles and user-defined business schemas. The skill incorporates multiple manual confirmation steps, requiring the user to explicitly approve schemas and changes before they are committed to project files.
Audit Metadata