@uipath/cli@1.202.0
Cross platform CLI for UiPath
AI Security Review
scanned 28d ago · by lpm-firewall-aiAgent skill and Claude plugin changes are a real first-party capability, but they run only from explicit CLI commands and not from npm lifecycle hooks. That matches a user-invoked agent configuration warning rather than an unconsented install hijack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs uip skills install, uip skills update, or uip update.
Impact
The chosen coding agent receives UiPath skill content, and Claude receives the vendor plugin. No silent install-time control-surface write was found.
Mechanism
The command selects an agent, copies skill files into that agent's skills directory, and for Claude invokes the claude CLI to add a directory marketplace and install uipath@uipath-marketplace.
AI rationale
Agent skill and Claude plugin changes are a real first-party capability, but they run only from explicit CLI commands and not from npm lifecycle hooks. That matches a user-invoked agent configuration warning rather than an unconsented install hijack.
Evidence
.claudeagent skills directories
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The skills install command copies UiPath skills into selected coding-agent directories and, for Claude, runs the Claude CLI to register a local marketplace and install the uipath plugin.
- package.json publishes the uip bin and defines no preinstall, install, or postinstall scripts.
- Skill and plugin refresh runs only when the user invokes uip skills update or uip update.
Evidence against
- Agent directory writes and the Claude plugin install are reached only from explicit skills or update subcommands.
- The Claude plugin id is the vendor plugin uipath on marketplace uipath-marketplace.
- No install hook, eval payload, or unrelated credential send was found on this command path.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStrings
Source & flagged code
14 flagged · loading sourcedist/applicationinsights-s28k1t0d.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @uipath/cli@1.201.0
matchedIdentity = npm:QHVpcGF0aC9jbGk:1.201.0
similarity = 0.667
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/applicationinsights-s28k1t0d.jsView on unpkg11246exports.execAsync = undefined;
L11247: var child_process = __require("child_process");
L11248: var util = __require("util");
High
Child Process
Package source references child process execution.
dist/applicationinsights-s28k1t0d.jsView on unpkg · L11246410this._logToConsole = true;
L411: var logDestination = process.env.APPLICATIONINSIGHTS_LOG_DESTINATION;
L412: if (logDestination == "file+console") {
...
L428: } else {
L429: this._tempDir = path.join(process.cwd(), logFilePath);
L430: }
...
L748: try {
L749: var jsonConfig = JSON.parse(jsonString);
L750: if (jsonConfig.disableStatsbeat != null) {
...
L2650: try {
L2651: moduleVersion = originalRequire.call(this, path.join(moduleId, "package.json")).version;
L2652: } catch (e) {
Findings
1 Critical9 High5 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/applicationinsights-s28k1t0d.js
HighChild Processdist/applicationinsights-s28k1t0d.js
HighShelldist/index-h8cph72k.js
HighCredential Redirect Persistencedist/index-8akza9a2.js
HighCommand Output Exfiltrationdist/applicationinsights-s28k1t0d.js
HighSandbox Evasion Gated Capabilitydist/index-qm4fye46.js
HighCloud Metadata Accessdist/applicationinsights-s28k1t0d.js
HighCross File Remote Execution Contextdist/index-ezemqten.js
HighBase64 Obscured Urldist/index-8akza9a2.js
HighSemantic Analysis Limiteddist/index-h8cph72k.js
MediumDynamic Require
Affected versions and remediation
This report applies to @uipath/cli@1.202.0.
See all versions of @uipath/cli for other recorded verdicts.
- Review the evidence and your use of @uipath/cli@1.202.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.