The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/meta-validate.py implements batch processing by reading its own source code from the disk and executing it using compile() and exec(). This pattern is used to avoid the overhead of spawning new Python processes for each metadata object while maintaining independent execution contexts. However, use of these functions on file-based content constitutes a dynamic execution risk.
[COMMAND_EXECUTION]: The skill performs significant file system operations, including deep directory traversal, path resolution, and file reading to inspect 1C configuration structures. It also supports writing validation results to a user-defined file path via the -OutFile parameter.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted XML metadata files which could potentially contain malicious payloads or trigger parser-level vulnerabilities.
Ingestion points: Reads XML metadata files and the project's Configuration.xml from the local file system based on user-provided paths.
Boundary markers: The skill does not employ specific delimiters or instruction-ignoring warnings when processing the contents of the XML files.
Capability inventory: The skill has the capability to read any file on the system (subject to agent permissions), write output files, and execute PowerShell commands.
Sanitization: The scripts use standard XML parsing libraries (System.Xml and lxml). The Python implementation uses etree.XMLParser with default settings, which does not explicitly disable external entity resolution (XXE), a common security hardening measure for processing untrusted XML.

meta-validate