uniform-search
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell commands to manage the project environment, including
npm installfor package management,npxfor vendor CLI tools, andmkdir/rmfor file system operations. - [EXTERNAL_DOWNLOADS]: Downloads the latest vendor CLI (
create-uniform-search@latest), the@uniformdev/searchruntime package, and project metadata (Context manifest) from Uniform's official APIs. - [DYNAMIC_EXECUTION]: Uses
node -escripts to programmatically reconcile the scaffolded code, such as updating import specifiers and cleaning up component parameter definitions insearch-components.json. - [INDIRECT_PROMPT_INJECTION]: The skill processes project-level configuration data and search results.
- Ingestion points:
uniform-data/locale/*.yaml,search-components.json, and hit data from the Uniform Search service API. - Boundary markers: None explicitly defined for LLM context; instructions focus on structured file processing.
- Capability inventory: Includes file-system writes, package installation via npm, and shell command execution (npx, node, curl).
- Sanitization: The
node -escripts perform specific regex-based filtering and string replacements on configuration files.
Audit Metadata