registry / @uipath/skills / 1.197.1

@uipath/skills@1.197.1

UiPath agent skills for Claude Code, Codex, Cursor, Copilot, Gemini and OpenCode — RPA, UI automation, UI testing, coded agents/apps/workflows, and troubleshooting. Distributed as the UiPath Claude Code plugin.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 20 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 293 KB of source, external domains: acme.api.uipath.com

Source & flagged code

13 flagged

skills/uipath-coded-apps/assets/scripts/dashboards/lifecycle.mjsView file

Lines 1-33javascript

1// Project-lifecycle utilities for the dashboard build pipeline — versioning,

2// dependency pre-warm, SDK-version check, and dev-server teardown. Extracted from

3// build-dashboard.mjs to keep that file focused on generation + orchestration.

4//

5// These functions depend only on small primitives (emit/log/writeAtomic) and a few

6// constants from build-dashboard.mjs; they never call the widget/view generators, so

7// there is no tight coupling. (The import from build-dashboard.mjs forms a benign

8// runtime cycle — every cross-reference is used inside a function body, never at

9// module-evaluation time, so the live bindings are resolved by call time.)

11import { readFileSync, existsSync, unlinkSync } from 'fs'

12import { join } from 'path'

13import { pathToFileURL } from 'url'

14import { execSync } from 'child_process'

15import { createConnection } from 'net'

High

Child Process

Package source references child process execution.

skills/uipath-coded-apps/assets/scripts/dashboards/lifecycle.mjsView on unpkg · L13

16import { emit, log, writeAtomic, SKILL_VERSION, INTENT_SCHEMA_VERSION, MIN_SDK_VERSION, DASHBOARD_PORT } from './build-dashboard.mjs'

18/**

19 * Read the scaffold version from the EXTRACTED starter kit — `_gen/starter-kit.json`

20 * inside the project. The version ships INSIDE the archive (single fixture artifact);

21 * there is no separate `.version` file. Returns '0.0.0' if the marker is absent.

22 * @param {string} projectDir

23 */

24export function readScaffoldVersion(projectDir) {

25 try {

26 return JSON.parse(readFileSync(join(projectDir, '_gen', 'starter-kit.json'), 'utf8')).version || '0.0.0'

27 } catch { return '0.0.0' }

28}

30/**

31 * The version block stamped into state.json so a dashboard knows what it was

32 * built against (drives offer-on-detect upgrade + future migrations).

33 * @param {string|null} [sdkVersion]

skills/uipath-coded-apps/scripts/validate-action-schema.jsView file

Lines 15-55javascript

15 * node validate-action-schema.js <path/to/action-schema.json>

16 * node validate-action-schema.js - # read JSON from stdin

17 * node validate-action-schema.js

skills/uipath-coded-apps/assets/scripts/dashboards/build-dashboard.mjsView file

Lines 407-447javascript

407}

408

409export function hashContent(content) {

410 return createHash('sha256').update(content).digest('hex').slice(0, 16)

411}

hooks/suggest-permissions.shView file

•path = hooks/suggest-permissions.sh kind = build_helper sizeBytes = 1651 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/suggest-permissions.shView on unpkg

skills/uipath-coded-apps/assets/fixtures/governance-dashboard-starter-kit.tar.gzView file

•path = skills/uipath-coded-apps/assets/fixtures/governance-dashboard-starter-kit.tar.gz kind = high_entropy_blob sizeBytes = 49700 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/uipath-coded-apps/assets/fixtures/governance-dashboard-starter-kit.tar.gzView on unpkg

•path = skills/uipath-coded-apps/assets/fixtures/governance-dashboard-starter-kit.tar.gz kind = payload_in_excluded_dir sizeBytes = 49700 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/uipath-coded-apps/assets/fixtures/governance-dashboard-starter-kit.tar.gzView on unpkg

•path = skills/uipath-coded-apps/assets/fixtures/governance-dashboard-starter-kit.tar.gz kind = compressed_blob sizeBytes = 49700 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

skills/uipath-coded-apps/assets/fixtures/governance-dashboard-starter-kit.tar.gz

skills/uipath-rpa/references/activity-docs/UiPath.NetIQeDirectory.Activities/1.6/coded/examples.mdView file

Lines 19-59markdown

19 public class CreateUserWorkflow : CodedWorkflow

20 {

21 [Workflow]

22 public async Task Execute(INetIQeDirectoryClientProvider clientProvider)

23 {

24 INetIQeDirectoryUserService userService =

25 netiq.NetIQeDirectoryUserService(clientProvider);

27 // Create a new user

28 var properties = new Dictionary<string, object>

skills/uipath-rpa/references/activity-docs/UiPath.System.Activities/25.10/coded/examples.mdView file

Lines 108-164markdown

108 public class ArchiveWorkflow : CodedWorkflow

109 {

110 [Workflow]

111 public void Execute()

112 {

113 // Get file references

114 IResource file1 = system.GetResourceForLocalPath(@"C:\Reports\report1.pdf", PathType.File);

115 IResource file2 = system.GetResourceForLocalPath(@"C:\Reports\report2.pdf", PathType.File);

116

117 // Compress files into a zip

118

skills/uipath-rpa/references/activity-docs/UiPath.AmazonWebServices.Activities/2.9/coded/examples.mdView file

Lines 231-271markdown

231using Amazon.IdentityManagement.Model;

232using UiPath.AmazonWebServices.Activities.API;

233using UiPath.AmazonWebServices.Models;

234

235namespace MyProject

236{

237 public class IAMUserGroupWorkflow : CodedWorkflow

238 {

239 [Workflow]

240 public async Task Execute(IAWSClientProvider clientProvider)

skills/uipath-rpa/references/activity-docs/UiPath.AzureActiveDirectory.Activities/1.6/coded/examples.mdView file

Lines 202-242markdown

202

203namespace MyProject

204{

205 public class ResetPassword : CodedWorkflow

206 {

207 [Workflow]

208 public void Execute()

209 {

210 var password = new SecureString();

211 foreach (char c in "admin-password") password.AppendChar(c);

skills/uipath-rpa/references/activity-docs/UiPath.ActiveDirectory.Activities/1.7/coded/examples.mdView file

39patternName = generic_password severity = medium line = 39 matchedText = password...3!",

Medium

Secret Pattern

Hardcoded password in skills/uipath-rpa/references/activity-docs/UiPath.ActiveDirectory.Activities/1.7/coded/examples.md

skills/uipath-rpa/references/activity-docs/UiPath.ActiveDirectory.Activities/1.7/coded/examples.mdView on unpkg · L39

Source & flagged code

13 flagged · loading source

skills/uipath-coded-apps/assets/scripts/dashboards/lifecycle.mjsView file

13import { pathToFileURL } from 'url' L14: import { execSync } from 'child_process' L15: import { createConnection } from 'net'

High

Child Process

Package source references child process execution.

skills/uipath-coded-apps/assets/scripts/dashboards/lifecycle.mjsView on unpkg · L13

skills/uipath-coded-apps/scripts/validate-action-schema.jsView file

35L36: const fs = require('fs'); L37:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

skills/uipath-coded-apps/scripts/validate-action-schema.jsView on unpkg · L35

skills/uipath-coded-apps/assets/scripts/dashboards/build-dashboard.mjsView file

427try { L428: execSync('npx tsc -p tsconfig.metrics.json', { cwd: projectPath, stdio: 'pipe' }) L429: return { ok: true }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

skills/uipath-coded-apps/assets/scripts/dashboards/build-dashboard.mjsView on unpkg · L427

hooks/suggest-permissions.shView file

•path = hooks/suggest-permissions.sh kind = build_helper sizeBytes = 1651 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/suggest-permissions.shView on unpkg

skills/uipath-coded-apps/assets/fixtures/governance-dashboard-starter-kit.tar.gzView file

•path = skills/uipath-coded-apps/assets/fixtures/governance-dashboard-starter-kit.tar.gz kind = high_entropy_blob sizeBytes = 49700 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/uipath-coded-apps/assets/fixtures/governance-dashboard-starter-kit.tar.gzView on unpkg

•path = skills/uipath-coded-apps/assets/fixtures/governance-dashboard-starter-kit.tar.gz kind = payload_in_excluded_dir sizeBytes = 49700 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/uipath-coded-apps/assets/fixtures/governance-dashboard-starter-kit.tar.gzView on unpkg

•path = skills/uipath-coded-apps/assets/fixtures/governance-dashboard-starter-kit.tar.gz kind = compressed_blob sizeBytes = 49700 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

skills/uipath-coded-apps/assets/fixtures/governance-dashboard-starter-kit.tar.gzView on unpkg

skills/uipath-rpa/references/activity-docs/UiPath.NetIQeDirectory.Activities/1.6/coded/examples.mdView file

39patternName = generic_password severity = medium line = 39 matchedText = password...3!",

Medium

Secret Pattern

Hardcoded password in skills/uipath-rpa/references/activity-docs/UiPath.NetIQeDirectory.Activities/1.6/coded/examples.md

skills/uipath-rpa/references/activity-docs/UiPath.NetIQeDirectory.Activities/1.6/coded/examples.mdView on unpkg · L39

skills/uipath-rpa/references/activity-docs/UiPath.System.Activities/25.10/coded/examples.mdView file

128patternName = generic_password severity = medium line = 128 matchedText = password...23",

Medium

Secret Pattern

Hardcoded password in skills/uipath-rpa/references/activity-docs/UiPath.System.Activities/25.10/coded/examples.md

skills/uipath-rpa/references/activity-docs/UiPath.System.Activities/25.10/coded/examples.mdView on unpkg · L128

144patternName = generic_password severity = medium line = 144 matchedText = password...23",

Medium

Secret Pattern

Hardcoded password in skills/uipath-rpa/references/activity-docs/UiPath.System.Activities/25.10/coded/examples.md

skills/uipath-rpa/references/activity-docs/UiPath.System.Activities/25.10/coded/examples.mdView on unpkg · L144

skills/uipath-rpa/references/activity-docs/UiPath.AmazonWebServices.Activities/2.9/coded/examples.mdView file

251patternName = generic_password severity = medium line = 251 matchedText = password...3!",

Medium

Secret Pattern

Hardcoded password in skills/uipath-rpa/references/activity-docs/UiPath.AmazonWebServices.Activities/2.9/coded/examples.md

skills/uipath-rpa/references/activity-docs/UiPath.AmazonWebServices.Activities/2.9/coded/examples.mdView on unpkg · L251

skills/uipath-rpa/references/activity-docs/UiPath.AzureActiveDirectory.Activities/1.6/coded/examples.mdView file

222patternName = generic_password severity = medium line = 222 matchedText = password...6!",

Medium

Secret Pattern

Hardcoded password in skills/uipath-rpa/references/activity-docs/UiPath.AzureActiveDirectory.Activities/1.6/coded/examples.md

skills/uipath-rpa/references/activity-docs/UiPath.AzureActiveDirectory.Activities/1.6/coded/examples.mdView on unpkg · L222

skills/uipath-rpa/references/activity-docs/UiPath.ActiveDirectory.Activities/1.7/coded/examples.mdView file

39patternName = generic_password severity = medium line = 39 matchedText = password...3!",

Medium

Secret Pattern

Hardcoded password in skills/uipath-rpa/references/activity-docs/UiPath.ActiveDirectory.Activities/1.7/coded/examples.md

skills/uipath-rpa/references/activity-docs/UiPath.ActiveDirectory.Activities/1.7/coded/examples.mdView on unpkg · L39

Findings

5 High11 Medium4 Low

HighChild Processskills/uipath-coded-apps/assets/scripts/dashboards/lifecycle.mjs

HighShell

HighRuntime Package Installskills/uipath-coded-apps/assets/scripts/dashboards/build-dashboard.mjs

HighShips High Entropy Blobskills/uipath-coded-apps/assets/fixtures/governance-dashboard-starter-kit.tar.gz

HighPayload In Excluded Dirskills/uipath-coded-apps/assets/fixtures/governance-dashboard-starter-kit.tar.gz

MediumDynamic Requireskills/uipath-coded-apps/scripts/validate-action-schema.js

MediumEnvironment Vars

MediumShips Build Helperhooks/suggest-permissions.sh

MediumShips Compressed Blobskills/uipath-coded-apps/assets/fixtures/governance-dashboard-starter-kit.tar.gz

MediumStructural Risk Force Deep Review

MediumSecret Patternskills/uipath-rpa/references/activity-docs/UiPath.NetIQeDirectory.Activities/1.6/coded/examples.md

MediumSecret Patternskills/uipath-rpa/references/activity-docs/UiPath.System.Activities/25.10/coded/examples.md

MediumSecret Patternskills/uipath-rpa/references/activity-docs/UiPath.AmazonWebServices.Activities/2.9/coded/examples.md

MediumSecret Patternskills/uipath-rpa/references/activity-docs/UiPath.AzureActiveDirectory.Activities/1.6/coded/examples.md

MediumSecret Patternskills/uipath-rpa/references/activity-docs/UiPath.ActiveDirectory.Activities/1.7/coded/examples.md

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

13 flagged

skills/uipath-coded-apps/assets/scripts/dashboards/lifecycle.mjsView file

Lines 1-33javascript

1// Project-lifecycle utilities for the dashboard build pipeline — versioning,

2// dependency pre-warm, SDK-version check, and dev-server teardown. Extracted from

3// build-dashboard.mjs to keep that file focused on generation + orchestration.

4//

5// These functions depend only on small primitives (emit/log/writeAtomic) and a few

6// constants from build-dashboard.mjs; they never call the widget/view generators, so

7// there is no tight coupling. (The import from build-dashboard.mjs forms a benign

8// runtime cycle — every cross-reference is used inside a function body, never at

9// module-evaluation time, so the live bindings are resolved by call time.)

11import { readFileSync, existsSync, unlinkSync } from 'fs'

12import { join } from 'path'

13import { pathToFileURL } from 'url'

14import { execSync } from 'child_process'

15import { createConnection } from 'net'

High

Child Process

Package source references child process execution.

skills/uipath-coded-apps/assets/scripts/dashboards/lifecycle.mjsView on unpkg · L13

16import { emit, log, writeAtomic, SKILL_VERSION, INTENT_SCHEMA_VERSION, MIN_SDK_VERSION, DASHBOARD_PORT } from './build-dashboard.mjs'

18/**

19 * Read the scaffold version from the EXTRACTED starter kit — `_gen/starter-kit.json`

20 * inside the project. The version ships INSIDE the archive (single fixture artifact);

21 * there is no separate `.version` file. Returns '0.0.0' if the marker is absent.

22 * @param {string} projectDir

23 */

24export function readScaffoldVersion(projectDir) {

25 try {

26 return JSON.parse(readFileSync(join(projectDir, '_gen', 'starter-kit.json'), 'utf8')).version || '0.0.0'

27 } catch { return '0.0.0' }

28}

30/**

31 * The version block stamped into state.json so a dashboard knows what it was

32 * built against (drives offer-on-detect upgrade + future migrations).

33 * @param {string|null} [sdkVersion]

skills/uipath-coded-apps/scripts/validate-action-schema.jsView file

Lines 15-55javascript

15 * node validate-action-schema.js <path/to/action-schema.json>

16 * node validate-action-schema.js - # read JSON from stdin

17 * node validate-action-schema.js

skills/uipath-coded-apps/assets/scripts/dashboards/build-dashboard.mjsView file

Lines 407-447javascript

407}

408

409export function hashContent(content) {

410 return createHash('sha256').update(content).digest('hex').slice(0, 16)

411}

hooks/suggest-permissions.shView file

•path = hooks/suggest-permissions.sh kind = build_helper sizeBytes = 1651 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/suggest-permissions.shView on unpkg

skills/uipath-coded-apps/assets/fixtures/governance-dashboard-starter-kit.tar.gzView file

•path = skills/uipath-coded-apps/assets/fixtures/governance-dashboard-starter-kit.tar.gz kind = high_entropy_blob sizeBytes = 49700 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/uipath-coded-apps/assets/fixtures/governance-dashboard-starter-kit.tar.gzView on unpkg

•path = skills/uipath-coded-apps/assets/fixtures/governance-dashboard-starter-kit.tar.gz kind = payload_in_excluded_dir sizeBytes = 49700 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/uipath-coded-apps/assets/fixtures/governance-dashboard-starter-kit.tar.gzView on unpkg

•path = skills/uipath-coded-apps/assets/fixtures/governance-dashboard-starter-kit.tar.gz kind = compressed_blob sizeBytes = 49700 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

skills/uipath-coded-apps/assets/fixtures/governance-dashboard-starter-kit.tar.gz

skills/uipath-rpa/references/activity-docs/UiPath.NetIQeDirectory.Activities/1.6/coded/examples.mdView file

Lines 19-59markdown

19 public class CreateUserWorkflow : CodedWorkflow

20 {

21 [Workflow]

22 public async Task Execute(INetIQeDirectoryClientProvider clientProvider)

23 {

24 INetIQeDirectoryUserService userService =

25 netiq.NetIQeDirectoryUserService(clientProvider);

27 // Create a new user

28 var properties = new Dictionary<string, object>

skills/uipath-rpa/references/activity-docs/UiPath.System.Activities/25.10/coded/examples.mdView file

Lines 108-164markdown

108 public class ArchiveWorkflow : CodedWorkflow

109 {

110 [Workflow]

111 public void Execute()

112 {

113 // Get file references

114 IResource file1 = system.GetResourceForLocalPath(@"C:\Reports\report1.pdf", PathType.File);

115 IResource file2 = system.GetResourceForLocalPath(@"C:\Reports\report2.pdf", PathType.File);

116

117 // Compress files into a zip

118

skills/uipath-rpa/references/activity-docs/UiPath.AmazonWebServices.Activities/2.9/coded/examples.mdView file

Lines 231-271markdown

231using Amazon.IdentityManagement.Model;

232using UiPath.AmazonWebServices.Activities.API;

233using UiPath.AmazonWebServices.Models;

234

235namespace MyProject

236{

237 public class IAMUserGroupWorkflow : CodedWorkflow

238 {

239 [Workflow]

240 public async Task Execute(IAWSClientProvider clientProvider)

skills/uipath-rpa/references/activity-docs/UiPath.AzureActiveDirectory.Activities/1.6/coded/examples.mdView file

Lines 202-242markdown

202

203namespace MyProject

204{

205 public class ResetPassword : CodedWorkflow

206 {

207 [Workflow]

208 public void Execute()

209 {

210 var password = new SecureString();

211 foreach (char c in "admin-password") password.AppendChar(c);

skills/uipath-rpa/references/activity-docs/UiPath.ActiveDirectory.Activities/1.7/coded/examples.mdView file

39patternName = generic_password severity = medium line = 39 matchedText = password...3!",

Medium

Secret Pattern

Hardcoded password in skills/uipath-rpa/references/activity-docs/UiPath.ActiveDirectory.Activities/1.7/coded/examples.md

skills/uipath-rpa/references/activity-docs/UiPath.ActiveDirectory.Activities/1.7/coded/examples.mdView on unpkg · L39