sdk-replacement

Pass

Audited by Gen Agent Trust Hub on Sep 3, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses curl to query the Maven Central Search API for the latest versions of SAP Cloud SDK and Cloud Tomcat BOMs. This targets a well-known service and uses the data for configuration purposes only.
  • [COMMAND_EXECUTION]: The skill performs several local command executions, including mvn for build verification, jar for inspecting package contents, and sed/grep for file transformations. These are standard tools in a Java development environment and are used within the scope of the migration task.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local project files (pom.xml, Java source, HTML files). While this represents a surface for indirect instructions, the skill implements validation for its network-sourced data (regular expression check for version strings) and uses targeted searches for specific legacy patterns, minimizing the risk.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 3, 2026, 05:46 PM
Security Audit — agent-trust-hub — sdk-replacement