template-add
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill performs legitimate operations on 1C:Enterprise source files, such as creating XML metadata and template content. No malicious patterns, data exfiltration, or unauthorized command execution were detected.
- [INDIRECT_PROMPT_INJECTION]: The skill uses user-supplied arguments to construct file paths and modify XML structures, which is a standard surface for indirect injection.
- Ingestion points: Arguments
ObjectName,TemplateName,Synonym,Lang, andSrcDirfrom the command line. - Boundary markers: None used during argument interpolation.
- Capability inventory: Performs directory creation and file writes in the local workspace via
scripts/add-template.ps1andscripts/add-template.py. - Sanitization: The
Langargument is validated in both scripts to block illegal characters and reserved Windows device names (e.g., CON, PRN, NUL).TemplateTypeis restricted to a fixed set of allowed values. Path construction uses standard platform-specific libraries which mitigate basic traversal attempts.
Audit Metadata