sap-extension-creator
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill functions as a legitimate developer utility for scaffolding SAP platform extensions. No malicious patterns, hidden code, or unauthorized data access mechanisms were detected in the instructions or templates.
- [COMMAND_EXECUTION]: The provided Node.js template includes a
child_process.spawncall inindex.jsused to open the localindex.htmlfile in the system's default browser for standalone execution. This is a standard convenience feature for local development tools. - [EXTERNAL_DOWNLOADS]: Extension templates utilize the Font Awesome icon library hosted on Cloudflare's CDNJS platform, which is recognized as a trusted and well-known source for public web assets.
- [PROMPT_INJECTION]: The skill ingests user-provided metadata (such as extension names, descriptions, and system prompts) to generate configuration files and templates. While this creates a surface for indirect prompt injection if malicious data is provided by the user, it is an intended feature for a code generation tool and remains safe within the platform's extension environment.
Audit Metadata