joule-a2a-agent
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides scripts and templates for building and deploying SAP Joule agents.
- [COMMAND_EXECUTION]: The skill includes local scaffolding scripts (
scaffold-ts.sh,scaffold.py) and a destination creation script (create-destination.sh). These scripts perform standard administrative tasks such as file creation and BTP API interaction viacfandcurl. Analysis of these scripts shows they handle credentials safely and target legitimate SAP BTP endpoints derived from user environment data. - [EXTERNAL_DOWNLOADS]: The skill references official SAP packages and tools (e.g.,
@sap/joule-studio-cli,@sap-ai-sdk/langchain) and standard AI libraries. These originate from well-known technology vendors and official registries, which are considered safe sources. - [CREDENTIALS_UNSAFE]: The skill provides templates with placeholders for credentials and follows best practices by instructing users to manage secrets via environment variables and service keys instead of hardcoded values. The destination creation script extracts temporary OAuth tokens from bound services to perform authorized administrative actions.
Audit Metadata