uniform-mesh

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs users to install several Node.js packages from the official vendor namespace, including @uniformdev/mesh-sdk-react, @uniformdev/design-system, and @uniformdev/cli. These are essential libraries for integration development.
  • [EXTERNAL_DOWNLOADS]: Fetches the JSON schema for manifest validation from the official Uniform domain at https://uniform.app/schemas/json-schema/mesh-manifest/v1.json.
  • [COMMAND_EXECUTION]: Recommends the use of npx @uniformdev/cli@latest new-integration for project scaffolding. This command downloads and executes a generator from the vendor's official repository.
  • [COMMAND_EXECUTION]: Documents the use of the uniform CLI for integration lifecycle management, including registration and installation commands (e.g., uniform integration definition register). These are intended developer operations.
  • [INDIRECT_PROMPT_INJECTION]: The skill describes building systems that ingest untrusted data from external CMS or commerce systems.
  • Ingestion points: Untrusted data enters the agent context through the useMeshLocation and getDataResource hooks as described in references/data-connector.md.
  • Boundary markers: No explicit delimiter or 'ignore' instructions are provided in the example snippets.
  • Capability inventory: The skill demonstrates writing capabilities via setValue and editorState.updateNodeProperty, which allows modifying composition data within the Uniform platform (references/editor-state.md).
  • Sanitization: While the documentation mandates that secrets be stored in encrypted data source fields, it does not provide explicit patterns for sanitizing external content before interpolation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 07:43 AM