The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill's build and dump modes support passing a password via command-line arguments to the underlying PowerShell scripts. This practice can expose sensitive credentials in system process lists or shell history.
Evidence: SKILL.md usage examples for build and dump modes, and the -Password parameter in scripts/epf-build.ps1 and scripts/epf-dump.ps1.
[COMMAND_EXECUTION]: The skill relies on executing external PowerShell scripts which further invoke the 1C:Enterprise platform (1cv8.exe). While intended, the interpolation of user-provided arguments into shell commands presents a surface for command injection if not handled strictly by the agent.
Evidence: Command templates in SKILL.md using placeholders like <Name>, <путь>, and <пароль>.
[INDIRECT_PROMPT_INJECTION]: The skill's modes for modifying existing code and metadata (bsp-init, bsp-add-command, add-form) interact with local project files, creating a surface for indirect instructions to influence the agent.
Ingestion points: scripts/add-form.ps1 (loads XML via XmlDocument), SKILL.md (instructions to find and read ObjectModule.bsl).
Boundary markers: None specified in the instructions for parsing files.
Capability inventory: Subprocess calls to powershell.exe and 1cv8.exe via scripts, and file-write operations for XML and BSL files.
Sanitization: Not explicitly implemented in the provided scripts for content read from external project files.

epf-expert