harness-session
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The script invokes the git command using a list-based argument structure in subprocess.run. This approach avoids shell interpretation and prevents command injection, restricting interaction to repository metadata retrieval.
- [DATA_EXFILTRATION]: Data persistence is handled through atomic writes of JSON records to a controlled local directory (~/.harness). The script validates all project and session identifiers as UUIDs, ensuring that file operations remain within the intended directory and preventing path traversal or accidental data exposure.
Audit Metadata