harmony-empty-project
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to execute shell commands such as 'ohpm install' and 'hvigorw assembleHap'. These are standard tools for dependency management and building within the HarmonyOS development ecosystem.
- [EXTERNAL_DOWNLOADS]: Project initialization involves downloading official packages (e.g., @ohos/hypium, @ohos/hamock) from the standard ohpm registry.
- [INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface by ingesting user-provided data, such as project names and application bundle IDs, to populate project files. 1. Ingestion points: User-provided parameters for project setup (Step One). 2. Boundary markers: None explicitly mentioned for variable interpolation. 3. Capability inventory: The agent has file system write access and can execute shell commands (ohpm, hvigorw). 4. Sanitization: The instructions lack explicit guidance on sanitizing or validating user inputs before they are used in file content or as directory names in shell commands.
Audit Metadata