access-analyzer
Warn
Audited by Gen Agent Trust Hub on Apr 4, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: Multiple PowerShell scripts, such as
access-export-git.ps1,access-import.ps1, andaccess-backup.ps1, utilize Windows COM automation (New-Object -ComObject Access.Application) to programmatically control Microsoft Access instances and execute internal methods. - [COMMAND_EXECUTION]: The scripts
setup-trusted-location.ps1andaccess-export-git-FIXED.ps1perform unauthorized modifications to the Windows Registry underHKCU:\Software\Microsoft\Office\...\Security\Trusted Locations. This behavior is designed to add the skill's working directory to the Access 'Trusted Locations' list, effectively disabling built-in security prompts that warn users about macro execution. - [REMOTE_CODE_EXECUTION]: The script
fix-access-analyzer.ps1performs dynamic code injection by using the Access VBA Object Model to programmatically import an external source file (ModExportComplete.bas) into an existing database file usingvbProject.VBComponents.Import. - [REMOTE_CODE_EXECUTION]: Within
access-export-git-FIXED.ps1, the skill usesaccess.Eval()andaccess.Run()within a background PowerShell job to execute dynamically generated strings as VBA code inside the Access environment. - [DATA_EXFILTRATION]: The skill's primary automated workflow involves the systematic export of all database objects—including table definitions, SQL queries, forms, reports, macros, and the entirety of the VBA source code—into plain text files. While stated as a refactoring utility, this functionality enables the wholesale extraction of application logic and schema to the local file system.
Audit Metadata