sap-fiori-tools
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches sample projects from the official SAP-samples GitHub repository (github.com/SAP-samples/fiori-tools-samples).
- [EXTERNAL_DOWNLOADS]: Instructs the installation of official SAP development tools and dependencies via NPM, including
@sap-ux/fiori-mcp-server,@sap/eslint-plugin-ui5-jsdocs, and the Multi-Target Application (mta) build tool. - [COMMAND_EXECUTION]: Provides instructions for executing standard development, build, and deployment commands using
npm,npx fiori,mbt, andgit. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data sources such as OData metadata files (
metadata.xml), project descriptors (manifest.json), and CAP definition files (.cds). While these are standard for Fiori development, they represent an entry point for untrusted data that could influence agent behavior if not properly delimited. - [SAFE]: The documentation includes a security warning regarding the use of
NODE_TLS_REJECT_UNAUTHORIZED=0, explicitly identifying it as a risk and recommending the proper resolution of certificate issues instead.
Audit Metadata