db-dump-dt
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the 1C:Enterprise platform (1cv8.exe or ibcmd) to perform database operations. It uses robust execution methods—P/Invoke for CreateProcess in PowerShell and list-based Popen in Python—to effectively mitigate shell injection risks.
- [INDIRECT_PROMPT_INJECTION]: The skill reads database connection parameters from a local .v8-project.json file. While this introduces a potential ingestion point for untrusted data, the skill mitigates risks by implementing an argument blacklist (e.g., V8_OWNED_KEYS) that prevents the overriding of critical platform flags.
- Ingestion points: Connection parameters (path, server, ref, v8path) are read from .v8-project.json in the project root.
- Boundary markers: Parameters are handled as structured JSON data; however, explicit delimiters for the platform command line are absent.
- Capability inventory: The skill possesses the capability to execute local platform processes and write backup files to the local file system.
- Sanitization: The scripts include logic to validate and blacklist specific platform command-line arguments, preventing the injection of conflicting batch commands or modes.
Audit Metadata