qe-enterprise-integration-testing
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides documentation and code examples for end-to-end enterprise flow testing. No security issues were detected in the scripts or metadata. Hostnames used in examples (e.g.,
sap-int.company.com) are generic placeholders for internal testing environments. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection attack surface because it is designed to ingest and validate data from external enterprise APIs and SAP systems.
- Ingestion points: Data from external systems is ingested via
sapClient.call(),wmsApi.get(),odataClient.get(), andpage.waitForResponse()inSKILL.md. - Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the code snippets.
- Capability inventory: The skill utilizes network operations for API interaction, browser automation for Fiori testing, and orchestrates secondary agents (
qe-sap-rfc-tester, etc.) to perform integration tasks. - Sanitization: No explicit sanitization or filtering of external data is demonstrated in the provided examples; data is typically processed for assertions or cross-system comparison.
Audit Metadata