cfe-patch-method
Pass
Audited by Gen Agent Trust Hub on Mar 4, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill runs a PowerShell script to process local files and generate code. All command-line interactions are standard for development automation and do not involve shell injection or unsafe evaluation of user input.
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by reading a local configuration file (
Configuration.xml). - Ingestion points: The script reads the
Configuration.xmlfile within theExtensionPathto extract theNamePrefixproperty. - Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the script's reading logic.
- Capability inventory: The script has the capability to read from and write to the local file system using
[System.IO.File]methods as seen inscripts/cfe-patch-method.ps1. - Sanitization: The extracted prefix is used directly to construct procedure names. While this could theoretically be used to inject malicious 1C code into the output file if the configuration file is compromised, it is a low-risk behavior typical of code generation tools.
Audit Metadata