uniform-nextjs-page-router
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill configuration process involves using the
@uniformdev/clito download a context manifest from the Uniform platform (uniform context manifest download). This is a standard vendor-provided method for retrieving project configuration. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and render content from Uniform CMS through components like
UniformComposition,UniformText, andUniformRichText. This data processing path creates a surface for indirect prompt injection where malicious instructions stored in the CMS could attempt to influence the agent's behavior. - Ingestion points: Data is ingested in
references/setup.mdthrough theUniformCompositioncomponent and inreferences/components.mdthrough various parameter rendering components. - Boundary markers: No explicit boundary markers or "ignore embedded instructions" warnings are included in the React component implementation examples.
- Capability inventory: The integration logic is restricted to frontend rendering; the skill does not expose dangerous capabilities such as arbitrary shell execution or local file writing to the data ingestion path.
- Sanitization: The skill uses specialized vendor components like
UniformRichTextto handle structured CMS data (Lexical JSON), providing a layer of abstraction over raw data rendering.
Audit Metadata