harness-init
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill contains keywords often associated with prompt injection (e.g., 'ignore previous instructions') within its documentation and test scripts. These instances are identified as benign test cases or defensive guidelines used to teach agents how to handle untrusted data and do not pose a security risk.- [COMMAND_EXECUTION]: The skill utilizes several local shell scripts to manage the autonomous loop and enforce safety boundaries. For example, 'tier-a-guard.sh' is used to detect and block potentially destructive system commands before they are executed. These scripts are invoked via legitimate platform hooks and form the core security infrastructure of the skill.- [EXTERNAL_DOWNLOADS]: The skill references the official '@openai/codex' package and the GitHub 'gh' CLI as optional dependencies for its core functionality. These are well-known, trusted resources from established vendors.- [PROMPT_INJECTION]: The skill identifies and mitigates the risk of indirect prompt injection by wrapping untrusted external content in specific tags.
- Ingestion points: Untrusted data enters the agent context through MCP tool responses, web content fetching, and file uploads (documented in 'references/untrusted-content.md').
- Boundary markers: The skill uses '' XML-style tags as explicit boundary markers.
- Capability inventory: The associated sub-agents (Generator and Evaluator) possess capabilities for file writing, system command execution (Bash), and broad tool usage.
- Sanitization: The skill includes the 'wrap-untrusted.sh' script, which provides XML-safe escaping for content attributes to prevent tag-breaking injections.
Audit Metadata