harness-starter
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [NO_CODE]: The skill consists entirely of Markdown instructions and YAML configuration for project organization and workflow management. It does not contain any executable scripts (Python, JavaScript, Bash) that could be used for malicious purposes.
- [EXTERNAL_DOWNLOADS]: The skill references standard, well-known GitHub Actions provided by official sources (actions/checkout, actions/setup-java, gradle/actions/setup-gradle). These are industry-standard tools for CI/CD and are considered safe.
- [COMMAND_EXECUTION]: The skill defines a standard Gradle command (
./gradlew testDebugUnitTest lintDebug) to be used within a GitHub Actions workflow. This is a routine development operation for verifying project health and does not involve arbitrary or dangerous command injection. - [PRIVILEGE_ESCALATION]: The GitHub Actions template includes
chmod +x gradlew, which is a standard and necessary step to allow the CI environment to execute the Gradle wrapper script. It does not grant unauthorized or elevated permissions. - [METADATA_POISONING]: The metadata fields (name, description, author) are consistent with the skill's stated purpose of initializing a project harness. No deceptive or hidden instructions were found in the metadata.
Audit Metadata