harness-setup

Warn

Audited by Gen Agent Trust Hub on May 12, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: Performs global package installation using npm install -g @openai/codex and system-level package management via brew install coreutils on macOS.
  • [COMMAND_EXECUTION]: Includes destructive file system operations in the maintenance section, specifically using find .claude/logs -mtime +30 -delete to automatically remove files older than 30 days.
  • [COMMAND_EXECUTION]: Configures shell hooks (pre-tool.sh and post-tool.sh) that are designed to execute logic during the agent's tool-invocation lifecycle.
  • [REMOTE_CODE_EXECUTION]: Executes an external local shell script located at ./scripts/sync-v3-skill-mirrors.sh. Because the content of this script is not defined within the analyzed skill file, its behavior cannot be verified.
  • [EXTERNAL_DOWNLOADS]: Facilitates the installation and updating of external plugins using the platform's native claude plugin install and claude plugin update commands.
Audit Metadata
Risk Level
MEDIUM
Analyzed
May 12, 2026, 04:16 AM
Security Audit — agent-trust-hub — harness-setup