The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The PowerShell script db-load-xml.ps1 accepts a -Password parameter and logs the entire command line (including the plaintext password) to the console using Write-Host "Running: 1cv8.exe $($arguments -join ' ')". This behavior leads to the exposure of sensitive credentials in the agent's log history.
[COMMAND_EXECUTION]: The skill facilitates the execution of 1cv8.exe in designer mode with administrative privileges to replace or modify database configurations. This capability allows for significant changes to the local environment and application data.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by reading configuration data from .v8-project.json and file paths from $ListFile or $Files to build arguments for a system-level process.
Ingestion points: Reads the .v8-project.json configuration file (referenced in SKILL.md) and external file lists provided via parameters in scripts/db-load-xml.ps1.
Boundary markers: Absent. There are no instructions or logic to delimit or ignore potentially malicious content within the ingested configuration files.
Capability inventory: Execution of the 1C:Enterprise Designer executable via Start-Process and the ability to write to the local file system (creation of temporary log and list files).
Sanitization: Absent. Data retrieved from the configuration files and parameters is used directly to construct the argument list for the subprocess without escaping or validation.

db-load-xml