fix-xml-globals
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a developer utility for refactoring UI5 XML views to comply with standard linter rules. It does not perform network operations, access sensitive system files, or contain hardcoded credentials.
- [COMMAND_EXECUTION]: The skill utilizes a local Node.js script (
scripts/verify-this-bind.js) to perform static analysis on JavaScript and XML files. This script is used as a validator to determine if code context requires binding. The script is self-contained, uses only standard Node.js modules (fs, path), and does not exhibit dangerous execution patterns like eval or dynamic loading from untrusted paths. - [DATA_EXPOSURE]: The skill processes project source code (XML and JS). Analysis of the script and instructions confirms that data is handled locally for refactoring purposes only, with no evidence of exfiltration or unauthorized access to sensitive environment data.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted project data (source code). This is a standard operation for this tool and is assessed as safe.
- Ingestion points: Project-specific XML View/Fragment files and JavaScript formatter modules as specified in the skill instructions.
- Boundary markers: None explicit.
- Capability inventory: Local file reading/writing and local Node.js script execution.
- Sanitization: The included analysis script (
scripts/verify-this-bind.js) performs noise stripping, effectively removing comments and string literals before scanning for tokens, which mitigates simple injection attempts within the source code.
Audit Metadata