sap-fiori-url-generator
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied inputs such as the base URL, client, and language codes to construct a final URL without performing input validation or escaping. * Ingestion points: User-provided values via the prompt interface defined in SKILL.md and QUICK_REFERENCE.md. * Boundary markers: Absent from the prompt templates. * Capability inventory: String manipulation logic within scripts/fiori-url-generator.js and scripts/fiori-url-generator.py. * Sanitization: Input validation is minimal, focusing only on trailing slash removal for the base URL.
- [DYNAMIC_EXECUTION]: The internal test suite uses dynamic loading to execute the skill's implementation logic. * Evidence: The script scripts/test.py employs importlib.util.spec_from_file_location to load the fiori-url-generator.py module from a relative file system path. * Context: This is a standard testing pattern for loading local project modules but involves runtime code execution logic.
Audit Metadata