sap-fiori-create-cli
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates project management tasks by executing shell commands via npx to run the official @sap-ux/create CLI.
- [EXTERNAL_DOWNLOADS]: The skill uses npx to fetch and run the latest version of SAP-authored packages from the NPM registry.
- [REMOTE_CODE_EXECUTION]: The use of npx to download and execute the @sap-ux/create package at runtime is a remote code execution pattern, which is safe here as it targets a trusted vendor.
- [INDIRECT_PROMPT_INJECTION]: The application conversion workflow involves reading user-controlled HTML sandbox files to extract and migrate JavaScript code.
- Ingestion points: Local project files such as webapp/test/flpSandbox_old.html.
- Boundary markers: No delimiters or isolation markers are used to wrap the extracted code segments.
- Capability inventory: The skill has capabilities for shell command execution (npx), file reading, and project file writing.
- Sanitization: Extracted code logic is migrated to new project files without automated validation or security sanitization.
Audit Metadata