sap-commerce-cloud
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides utility scripts in the
scripts/directory for scaffolding extensions, validating ImpEx data, and querying the SAP Commerce database via the Administrative Console (HAC). These scripts are standard development tools and include security best practices, such as using.netrcfiles to protect credentials and implementing checks to restrict database queries to read-onlySELECTstatements. - [DYNAMIC_EXECUTION]: The
scripts/query-items.shutility script dynamically generates a Groovy script at runtime to facilitate interactions with the SAP Commerce scripting console. This is a standard administrative function for the platform and is handled within a controlled template. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process SAP-specific configuration files such as
items.xmland*.impexdata. While these represent external data sources, they are used appropriately for code generation and documentation tasks within the commerce ecosystem, with no identified paths for adversarial exploitation.
Audit Metadata