The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection as it downloads and reads untrusted document files (PDFs and images) to perform reviews and confirm predictions.
Ingestion points: Document files are fetched via uip ixp documents download and processed using an internal reading tool as described in references/label-documents-guide.md.
Boundary markers: The instructions do not specify the use of clear delimiters or instructions to the agent to disregard potential commands embedded within the document text during analysis.
Capability inventory: The agent has access to potentially destructive CLI commands such as uip ixp projects delete and uip ixp documents delete, which could be targeted by a malicious document.
Sanitization: There is no documented process for sanitizing or filtering the content extracted from documents before it is presented to the agent for decision-making.
[DYNAMIC_EXECUTION]: The skill uses dynamic script and payload generation at runtime to interact with the UiPath CLI.
In SKILL.md (Rule 5), the agent is instructed to use heredocs (cat > ... << 'EOF') to assemble JSON update payloads in a temporary directory, which are then passed into command arguments using command substitution ($(cat ...)).
references/cli-reference.md provides a shell loop template for bulk uploading documents, which involves generating and executing sequential command strings.

uipath-ixp