harness-persist
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Python script (
scripts/resolve_harness.py) to determine the file system path for the Project Harness. This script is part of the accompanyingharness-inittoolset and is used to locate the shared directory across Git worktrees. - [PROMPT_INJECTION]: The skill facilitates the persistence of user-influenced or project-derived data into files that are intended to be read by future agent sessions. This creates a surface for indirect prompt injection, where malicious instructions could be stored in the harness and later executed by an agent processing those files.
- Ingestion points: Future agent sessions are expected to read files from the
<harness>/directory (such asproject.md,index.md, and session notes) to establish context. - Boundary markers: There are no explicit instructions for the agent to use delimiters or ignore embedded instructions when reading from or writing to the harness files.
- Capability inventory: The skill allows for command execution (via the resolve script) and filesystem write operations; the wider agent environment likely possesses further capabilities.
- Sanitization: The skill does not specify any validation, filtering, or sanitization protocols for the data being persisted.
Audit Metadata