neo-harness-project
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from the local project repository to build documentation and validation gates.
- Ingestion points: The skill reads project specifications, root directory structure, package configurations (e.g., package.json), build settings, and existing documentation (SKILL.md, Step 1).
- Boundary markers: The skill uses markdown templates with placeholders (e.g., {{PROJECT_NAME}}); however, it does not explicitly use safety delimiters or instructions to the LLM to ignore instructions embedded within the processed project files.
- Capability inventory: The skill is capable of writing multiple markdown files to the
.neo_harness/directory and executing shell commands discovered within the project's own configuration files (SKILL.md, Step 4 & 5). - Sanitization: There is no evidence of explicit sanitization or filtering of project-sourced content before it is interpolated into the generated documents or used to form execution commands.
- [COMMAND_EXECUTION]: The skill extracts and executes shell commands that are identified within the project's metadata or documentation.
- Evidence: In Step 5 ('閉環驗證'), the skill executes the project's existing 'fast checks' and 'unified verification' commands. While this is restricted to commands already present in the user's codebase, it provides a vector for the agent to execute arbitrary local code if the project contains malicious script definitions.
Audit Metadata