Skills
skills/broomva/harness-engineering-skill/harness-engineering-playbook/Gen Agent Trust Hub

harness-engineering-playbook

Pass

Audited by Gen Agent Trust Hub on Jun 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The harness_wizard.py script executes local shell scripts (bootstrap_harness.sh and audit_harness.sh) using the subprocess.run function. These executions are performed securely using list-based arguments for the intended purpose of repository setup and auditing.\n- [COMMAND_EXECUTION]: Shell script templates provided by the skill, such as lint.sh and smoke.sh, include eval statements to execute commands defined in environment variables (e.g., HARNESS_LINT_CMD). This is an intentional design pattern allowing repository owners to customize the harness commands.\n- [EXTERNAL_DOWNLOADS]: The skill's documentation and installation instructions point to the author's monorepo on GitHub (broomva/skills). This is a legitimate reference to the vendor's infrastructure for skill distribution and updates.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 28, 2026, 11:35 AM
Security Audit — agent-trust-hub — harness-engineering-playbook