uniform-mesh
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install several Node.js packages from the official vendor namespace, including @uniformdev/mesh-sdk-react, @uniformdev/design-system, and @uniformdev/cli. These are essential libraries for integration development.
- [EXTERNAL_DOWNLOADS]: Fetches the JSON schema for manifest validation from the official Uniform domain at https://uniform.app/schemas/json-schema/mesh-manifest/v1.json.
- [COMMAND_EXECUTION]: Recommends the use of npx @uniformdev/cli@latest new-integration for project scaffolding. This command downloads and executes a generator from the vendor's official repository.
- [COMMAND_EXECUTION]: Documents the use of the uniform CLI for integration lifecycle management, including registration and installation commands (e.g., uniform integration definition register). These are intended developer operations.
- [INDIRECT_PROMPT_INJECTION]: The skill describes building systems that ingest untrusted data from external CMS or commerce systems.
- Ingestion points: Untrusted data enters the agent context through the useMeshLocation and getDataResource hooks as described in references/data-connector.md.
- Boundary markers: No explicit delimiter or 'ignore' instructions are provided in the example snippets.
- Capability inventory: The skill demonstrates writing capabilities via setValue and editorState.updateNodeProperty, which allows modifying composition data within the Uniform platform (references/editor-state.md).
- Sanitization: While the documentation mandates that secrets be stored in encrypted data source fields, it does not provide explicit patterns for sanitizing external content before interpolation.
Audit Metadata