sap-fiori-eslint-plugin
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes common shell utilities including
find,grep,ls, andcdto navigate project directories, detect configuration files, and inspectpackage.jsoncontent. These operations are standard for development environment setup and code linting tasks. - [REMOTE_CODE_EXECUTION]: The instructions direct the agent to execute
npx --yes @sap-ux/create@latest, which downloads and runs the latest SAP UX configuration tool from the npm registry. This is a common pattern for automated project setup and migration. - [EXTERNAL_DOWNLOADS]: The skill relies on standard Node.js package managers (
npm,pnpm,yarn) to install theeslintframework and the vendor-specific@sap-ux/eslint-plugin-fiori-toolsplugin. These downloads originate from the official npm registry. - [PROMPT_INJECTION]: The skill processes project-specific data, such as directory names and file paths, and interpolates them into shell commands. This constitutes an indirect prompt injection surface; however, the operations are restricted to the local development environment and aligned with the skill's stated purpose.
Audit Metadata