The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes sibling scripts (xdto-decompile, xdto-compile, xdto-validate) to perform its tasks. These invocations are performed safely using subprocess.run with argument lists in Python and command splatting in PowerShell, which mitigates command injection risks.
[DATA_EXPOSURE]: The skill allows reading input values from local files using a @file_path prefix. While this grants access to the file system, the content is strictly parsed as XML fragments. If a non-XML file (like a private key) were targeted, the script would fail during XML parsing, preventing successful ingestion or display of the sensitive data.
[SAFE]: The implementation includes a 'support-guard' feature in both PowerShell and Python scripts. This logic inspects 1C project metadata (ParentConfigurations.bin, .v8-project.json) to detect if an object is vendor-locked. It proactively blocks edits to these objects unless the user has explicitly configured the project to allow them, preventing the AI from performing actions that would break the software's update path.

xdto-edit