role-compile

This is a local 1C role compiler with no observed network activity, credential theft, or other clear malware behavior. A JSON-controlled role name can traverse output paths, and unescaped role/object/right names can inject or corrupt generated XML; the edit-protection check also fails open on unexpected exceptions. Severity is moderate when processing untrusted JSON or writing into sensitive directories; no domains, URLs, IP addresses, or environment variables are involved.