Harvest Automation
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides documentation for Harvest automation tools. It utilizes the Rube MCP server (rube.app), which belongs to the skill's author (composiohq). All operations are scoped to the Harvest API.
- [INDIRECT_PROMPT_INJECTION]: Data ingestion occurs in SKILL.md through tools like HARVEST_LIST_TIME_ENTRIES which fetch external content from Harvest. No explicit boundary markers or sanitization steps are defined for external API content in the instructions. However, capabilities are limited to Harvest-specific operations like time entry and project management, minimizing potential impact.
Audit Metadata