The Agent Skills Directory

[DATA_EXFILTRATION]: The skill implements a feature in the Resolve-TextFromFile function (found in both scripts/role-compile.ps1 and scripts/role-compile.py) that reads the content of a local file if its path is prefixed with the '@' character in the JSON input. This allows for arbitrary file read access on the system. While the content is primarily used to populate 1C role XML files, an attacker could use this to harvest sensitive data like SSH keys, environment variables, or configuration files by embedding them into the generated output.
[INDIRECT_PROMPT_INJECTION]: The skill processes JSON data from a file path provided by the user, which serves as an ingestion point for untrusted data. This surface can be used to trigger the aforementioned unauthorized file reads or to manipulate the generated metadata of the 1C configuration.
Ingestion points: The JSON file specified by the JsonPath argument and any secondary files referenced via the '@' syntax.
Boundary markers: No specific boundary markers or 'ignore' instructions are used when processing the JSON content.
Capability inventory: The skill can read arbitrary files, create directories, and write/modify multiple XML files, including the core Configuration.xml file.
Sanitization: The skill uses Esc-XmlText to escape characters before writing them to XML, which prevents XML injection but does not restrict the path of the files being read.
[COMMAND_EXECUTION]: The skill's primary function is to execute complex PowerShell or Python scripts that perform extensive file system operations. It reads project metadata from .v8-project.json, modifies the Configuration.xml manifest, and creates new files within the project structure.

role-compile