agentic-harness-engineering
Fail
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The installation instructions for Linux environments include the use of
sudo apt install -y tmux. Using sudo allows the skill instructions to execute commands with administrative privileges on the host system. - [EXTERNAL_DOWNLOADS]: The skill instructs the user to clone a source code repository from an external GitHub account (
https://github.com/china-qijizhifeng/agentic-harness-engineering.git). This repository is not associated with a known trusted organization and contains the core logic executed by the skill. - [REMOTE_CODE_EXECUTION]: The skill uses a piped-to-shell pattern (
curl -LsSf https://astral.sh/uv/install.sh | sh) to install the 'uv' package manager. While 'astral.sh' is the official domain for this well-known tool, executing remote scripts directly in the shell is a high-risk pattern that bypasses package integrity checks.
Recommendations
- HIGH: Downloads and executes remote code from: https://astral.sh/uv/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata