sdk-replacement
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
curlto query the Maven Central Search API for the latest versions of SAP Cloud SDK and Cloud Tomcat BOMs. This targets a well-known service and uses the data for configuration purposes only. - [COMMAND_EXECUTION]: The skill performs several local command executions, including
mvnfor build verification,jarfor inspecting package contents, andsed/grepfor file transformations. These are standard tools in a Java development environment and are used within the scope of the migration task. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local project files (
pom.xml, Java source, HTML files). While this represents a surface for indirect instructions, the skill implements validation for its network-sourced data (regular expression check for version strings) and uses targeted searches for specific legacy patterns, minimizing the risk.
Audit Metadata