meta

Pass

Audited by Gen Agent Trust Hub on Jul 16, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The core logic of the skill set focuses on orchestrating legitimate SAP consulting workflows, including project discovery, preparation, and technical diagnostics. It enforces best practices through behavior-shaping constraints like Iron Laws and Hard Gates.
  • [DATA_EXPOSURE]: The diagnostic component, sap-doctor, verifies the presence and structure of local configuration files such as .sap-superpowers/sap.env and .sap-superpowers/config.json. These operations are limited to environment verification and do not involve unauthorized exfiltration of sensitive information.
  • [INDIRECT_PROMPT_INJECTION]: The delivery-factory and solution-accelerator skills ingest industry and country-specific context from local files to tailor SAP deliverable templates. While this identifies a data ingestion surface, it is a primary functional requirement of the skill and does not process untrusted external data in an unsafe manner.
  • [COMMAND_EXECUTION]: The health check functionality in sap-doctor performs read-only version checks for established tools like node and the abap-mcp-adt-powerup package to confirm the technical environment is ready for SAP system connectivity.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 16, 2026, 01:29 PM
Security Audit — agent-trust-hub — meta