sap-fiori-eslint-plugin

Pass

Audited by Gen Agent Trust Hub on Jul 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes common shell utilities including find, grep, ls, and cd to navigate project directories, detect configuration files, and inspect package.json content. These operations are standard for development environment setup and code linting tasks.
  • [REMOTE_CODE_EXECUTION]: The instructions direct the agent to execute npx --yes @sap-ux/create@latest, which downloads and runs the latest SAP UX configuration tool from the npm registry. This is a common pattern for automated project setup and migration.
  • [EXTERNAL_DOWNLOADS]: The skill relies on standard Node.js package managers (npm, pnpm, yarn) to install the eslint framework and the vendor-specific @sap-ux/eslint-plugin-fiori-tools plugin. These downloads originate from the official npm registry.
  • [PROMPT_INJECTION]: The skill processes project-specific data, such as directory names and file paths, and interpolates them into shell commands. This constitutes an indirect prompt injection surface; however, the operations are restricted to the local development environment and aligned with the skill's stated purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 27, 2026, 10:05 AM
Security Audit — agent-trust-hub — sap-fiori-eslint-plugin