skd-decompile
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill reads 1C Template.xml files and writes corresponding JSON, SQL, and Markdown warning files based on user-provided paths. There are no hardcoded credentials or network operations that could facilitate data exfiltration. All file access is scoped to the parameters provided to the scripts.
- [REMOTE_CODE_EXECUTION]: No remote code is fetched or executed. The PowerShell and Python scripts utilize standard system libraries (System.Xml, xml.etree.ElementTree) for data parsing and do not include patterns for downloading or piping remote content into a shell.
- [COMMAND_EXECUTION]: The skill executes local PowerShell or Python scripts for data transformation. These scripts parse XML and generate JSON output without using dangerous functions like eval() or Invoke-Expression on untrusted input.
- [PROMPT_INJECTION]: The skill processes external XML data, which is a potential surface for indirect prompt injection. However, the logic produces structured JSON output and provides a warnings file for unsupported constructs, which facilitates human/agent review of the transformed content before further use.
Audit Metadata