sap-cap-upgrade

Pass

Audited by Gen Agent Trust Hub on May 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill performs standard software maintenance tasks using standard CLI tools. It executes npm view to resolve versions, npm install to apply updates, and npx cds build and npm test to validate the environment post-upgrade.
  • [EXTERNAL_DOWNLOADS]: To ensure the safety of upgrades, the skill fetches package vulnerability data from api.osv.dev and the official NPM registry (registry.npmjs.org). These requests are targeted at well-known, trusted infrastructure relevant to the skill's primary purpose.
  • [PROMPT_INJECTION]: Static analysis flagged terms like 'unrestricted' and 'super users' within the skill's local mirror of SAP CAP release notes (e.g., in references/releases/2020/sep20.md). These are descriptive entries regarding framework features (XSUAA attribute handling and testing strategies) and do not contain instructions aimed at overriding the AI agent's behavior.
Audit Metadata
Risk Level
SAFE
Analyzed
May 13, 2026, 03:07 PM
Security Audit — agent-trust-hub — sap-cap-upgrade