uniform-search

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes multiple shell commands to manage the project environment, including npm install for package management, npx for vendor CLI tools, and mkdir/rm for file system operations.
  • [EXTERNAL_DOWNLOADS]: Downloads the latest vendor CLI (create-uniform-search@latest), the @uniformdev/search runtime package, and project metadata (Context manifest) from Uniform's official APIs.
  • [DYNAMIC_EXECUTION]: Uses node -e scripts to programmatically reconcile the scaffolded code, such as updating import specifiers and cleaning up component parameter definitions in search-components.json.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes project-level configuration data and search results.
  • Ingestion points: uniform-data/locale/*.yaml, search-components.json, and hit data from the Uniform Search service API.
  • Boundary markers: None explicitly defined for LLM context; instructions focus on structured file processing.
  • Capability inventory: Includes file-system writes, package installation via npm, and shell command execution (npx, node, curl).
  • Sanitization: The node -e scripts perform specific regex-based filtering and string replacements on configuration files.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 04:51 AM