epf-build
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes external 1C platform binaries such as 1cv8.exe or ibcmd. These operations are conducted through PowerShell commands in the skill definition and via Python's subprocess.Popen in the helper scripts.
- [DYNAMIC_EXECUTION]: The PowerShell scripts (epf-build.ps1, stub-db-create.ps1) use the Add-Type cmdlet to compile C# code at runtime. This code defines a custom process runner to manage handle inheritance and prevent deadlocks on standard output/error pipes.
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes local XML source files to extract metadata types and form attributes for generating build stubs. This creates an attack surface where maliciously crafted source files could influence the execution of the 1C platform build process.
- [COMMAND_EXECUTION]: The skill implemented a security validation layer (Assert-ExtraArgs) that inspects additional user-supplied arguments to block the injection of unauthorized connection parameters or batch commands.
Audit Metadata