meta-remove
Pass
Audited by Gen Agent Trust Hub on May 16, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local PowerShell and Python scripts to manage 1C configuration files. It automates complex XML modifications and file system operations (deletion and directory removal) that match its stated administrative purpose.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it reads and parses content from configuration and source files (
.xml,.bsl) provided by the user. - Ingestion points: The scripts in
scripts/meta-remove.ps1andscripts/meta-remove.pyrecursively read all XML and BSL files within the target directory to identify object references. - Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the processing logic.
- Capability inventory: The scripts possess the capability to delete files and directories (
Remove-Item,shutil.rmtree) and modify configuration XML files. - Sanitization: The
Objectargument is split and validated against a predefined map of valid 1C metadata types, preventing arbitrary path manipulation through this parameter. - [SAFE]: No evidence of data exfiltration, hardcoded credentials, or unauthorized network communication was found. The external library dependency (
lxml) is a well-known standard for XML processing, and all external references point to the author's official GitHub repository.
Audit Metadata