xdto-compile
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill performs legitimate 1C:Enterprise development tasks.\n- [EXTERNAL_DOWNLOADS]: The skill's scripts reference the author's GitHub repository (github.com/Nikolay-Shirokov/cc-1c-skills). These are neutral references to the vendor's source code and do not involve unauthorized remote code execution.\n- [COMMAND_EXECUTION]: The skill executes local PowerShell and Python scripts to transform XML schemas into 1C metadata. These operations are limited to the user-provided output directory and do not request elevated privileges.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted XSD data through the
-XsdPathor-Xsdarguments.\n - Ingestion points: XML Schema data is loaded in
scripts/xdto-compile.ps1andscripts/xdto-compile.py.\n - Boundary markers: None identified for the ingested XSD content.\n
- Capability inventory: The scripts write to the local file system (creating
XDTOPackagesdirectories and files) and modify theConfiguration.xmlfile.\n - Sanitization: The skill uses standard XML libraries for parsing and implements text escaping (
EscText) when interpolating data into metadata templates, mitigating the risk of structural injection into the generated XML files.
Audit Metadata