uniform-editor-experience-review
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates by analyzing local project files (TSX, CSS, etc.) using shell commands, which creates an attack surface for processing untrusted data. Instructions embedded within the audited project files could potentially influence the agent's behavior during the review and fix process. \n
- Ingestion points: Local project files read via grep and perl commands defined in references/review-checks.md. \n
- Capability inventory: Shell command execution (grep, perl, npx), file modification for applying fixes, and local network requests via curl. \n
- Boundary markers: Not explicitly defined for the audited content, though checks target specific Uniform SDK patterns. \n
- Sanitization: Not applicable to the static analysis and audit phase. \n- [COMMAND_EXECUTION]: The skill utilizes several shell-based diagnostic tools to analyze the codebase. \n
- Evidence: A custom shell function g() wraps grep for searching project files in references/review-checks.md. \n
- Evidence: Employs perl one-liners for multi-line regex matching of JSX components. \n
- Evidence: Uses the npx uniform CLI command to fetch project configuration data from the vendor's platform. \n
- Evidence: Suggests a curl command to verify the local development server's output before and after applying fixes. \n- [EXTERNAL_DOWNLOADS]: The skill documentation refers to and recommends the management of vendor-specific dependencies. \n
- Evidence: Instructions in references/empty-states.md recommend ensuring the @uniformdev/richtext package is installed for editor compatibility.
Audit Metadata