agent-harness
Warn
Audited by Gen Agent Trust Hub on Jul 19, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The loop controller script executes arbitrary shell strings retrieved from a JSON state file using
subprocess.run(shell=True). - Evidence:
proc = subprocess.run(chk["cmd"], shell=True, cwd=args.cwd, capture_output=True, text=True, timeout=CHECK_TIMEOUT_S)inscripts/loop_controller.py. - Context: This mechanism is the core of the 'verify' command, which adjudicates task completion by running machine-readable checks defined in a domain manifest.
- [REMOTE_CODE_EXECUTION]: The system's architecture relies on executing arbitrary commands stored in data files (
plan.jsonandstate.json). An attacker who can influence the content of these files (e.g., via indirect injection into the goal compiler or supply chain tampering) can achieve local code execution. - Context: The skill documentation in
references/verification_discipline.mdacknowledges this risk, explicitly labeling plan and state files as a 'trust boundary' and warning against running the harness on files from untrusted input.
Audit Metadata