uniform-nextjs-page-router

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill configuration process involves using the @uniformdev/cli to download a context manifest from the Uniform platform (uniform context manifest download). This is a standard vendor-provided method for retrieving project configuration.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and render content from Uniform CMS through components like UniformComposition, UniformText, and UniformRichText. This data processing path creates a surface for indirect prompt injection where malicious instructions stored in the CMS could attempt to influence the agent's behavior.
  • Ingestion points: Data is ingested in references/setup.md through the UniformComposition component and in references/components.md through various parameter rendering components.
  • Boundary markers: No explicit boundary markers or "ignore embedded instructions" warnings are included in the React component implementation examples.
  • Capability inventory: The integration logic is restricted to frontend rendering; the skill does not expose dangerous capabilities such as arbitrary shell execution or local file writing to the data ingestion path.
  • Sanitization: The skill uses specialized vendor components like UniformRichText to handle structured CMS data (Lexical JSON), providing a layer of abstraction over raw data rendering.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 12:30 AM