The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill extracts and displays descriptive text fields (such as 'Synonym', 'Comment', and 'Explanation') from 1C metadata XML files. If these files are sourced from an untrusted configuration export, they could contain malicious instructions intended to influence the agent's downstream behavior.
Ingestion points: XML parsing in scripts/subsystem-info.ps1 (lines 104-125, 344-348) and scripts/subsystem-info.py (lines 66-96, 442-446).
Boundary markers: None. The extracted text is output directly into the agent's context without delimiters or warnings.
Capability inventory: The skill possesses the ability to read arbitrary filesystem paths (via user/agent input) and write analysis results to files.
Sanitization: No sanitization or filtering is performed on the text content extracted from the XML elements.
[COMMAND_EXECUTION]: The skill relies on the execution of external PowerShell and Python scripts (subsystem-info.ps1, subsystem-info.py) to process configuration data. While these are part of the skill's core functionality, they provide a vector for local execution based on provided paths.
[DATA_EXPOSURE]: The Get-SupportStatusForPath function in both scripts (PS line 45, Python line 160) performs a recursive search up to 12 levels into parent directories looking for ParentConfigurations.bin and Configuration.xml. This behavior allows the skill to probe the filesystem structure beyond the specific directory provided by the user.
[DYNAMIC_EXECUTION]: The Python implementation uses the lxml library for XML parsing. By default, standard XML parsers may be vulnerable to XML External Entity (XXE) attacks if they are not explicitly configured to disable entity resolution when processing untrusted input files.

subsystem-info