form-validate
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_&_EXFILTRATION]: No evidence of hardcoded credentials or access to sensitive file paths (e.g., .ssh, .aws). The scripts only read 1C project files (XML and BSL) relative to the provided FormPath for validation purposes. No network operations are performed.
- [REMOTE_CODE_EXECUTION]: No patterns of remote code execution or piped downloads (e.g., curl | bash) were detected. All script logic is contained within the local files provided in the skill.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external XML data and BSL source code. However, it lacks the capability to write files or perform network requests based on that data, and it does not interpolate data into executable commands. The risk of indirect injection is negligible as the output is purely informational validation results.
- [COMMAND_EXECUTION]: The skill uses PowerShell to execute the validation logic. This is an intended function for a developer tool and does not involve passing unsanitized user input to a shell in a way that allows for command injection.
- [OBFUSCATION]: No obfuscated strings, hidden Unicode characters, or multi-layer encoding were found in the scripts or metadata.
Audit Metadata