mcp-harness-repo-maintainer
Fail
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill references an installation command that downloads and executes a shell script directly from the author's repository (https://raw.githubusercontent.com/Arenukvern/skill_steward/main/install.sh | bash). This is used to bootstrap the 'steward' CLI utility.- [EXTERNAL_DOWNLOADS]: Utilizes 'npx skills add' to fetch and install external skill modules and dependencies from the author's registry.- [COMMAND_EXECUTION]: The skill operates by executing various CLI commands through the 'steward' tool, which runs actions defined in local steward.yaml configuration files. This involves dynamic execution of shell commands based on repository state.- [PROMPT_INJECTION]: The skill processes untrusted input through YAML scenario files and repository-local configurations. This creates a surface for indirect prompt injection where malicious instructions could be embedded in data files.
- Ingestion points: steward.yaml and steward/scenarios/*.yaml files are read and processed.
- Boundary markers: The skill relies on schema validation and contract checks (steward schema check-outputs) to verify data integrity.
- Capability inventory: The system executes shell commands, performs repository probes, and runs benchmarks via the steward CLI.
- Sanitization: The instructions emphasize a redaction policy and the use of limits to restrict the impact of executed actions.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/Arenukvern/skill_steward/main/install.sh - DO NOT USE without thorough review
Audit Metadata