cap-java
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for utilizing SAP's official OpenRewrite recipes via the
rewrite-maven-plugin. The coordinatescom.sap.cds:cds-services-recipes:5.0.0point to legitimate development tools provided by the framework vendor for automated code migration.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides a template for event handlers that process external data from OData requests, which is a standard entry point for untrusted data in web applications.\n - Ingestion points: Data enters the handler methods via
List<Orders>orCdsReadEventContextinOrderServiceHandler(SKILL.md).\n - Boundary markers: None explicitly mentioned in the code snippets.\n
- Capability inventory: The handlers possess database read/write access via
PersistenceService, external service integration viaRemoteService, and logging capabilities (SKILL.md).\n - Sanitization: Basic validation logic is shown in the
@Beforehandler example to verify input constraints before persistence.
Audit Metadata