autonomous-agent-harness
Pass
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill implements persistent execution mechanisms by configuring recurring scheduled tasks (crons) via the
mcp__scheduled-tasks__create_scheduled_tasktool. This allows the agent to run prompts autonomously at specified intervals. - [DATA_EXFILTRATION]: The instructions direct the agent to read from and write to sensitive file paths located in
~/.claude/projects/*/memory/. These directories contain project context, user preferences, and session history which may include sensitive information. - [EXTERNAL_DOWNLOADS]: The configuration guide utilizes
npx -yto download and execute official MCP servers including@anthropic/memory-mcp-server,@anthropic/scheduled-tasks-mcp-server, and@anthropic/computer-use-mcp-serverfrom the npm registry. These are from a well-known service provider. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by ingesting untrusted data from external sources.
- Ingestion points: Reads GitHub PR notifications, Exa web search results, and calendar/email/slack content.
- Boundary markers: Not explicitly defined in the provided prompt examples, increasing the risk of the agent obeying instructions embedded within external data.
- Capability inventory: The agent possesses capabilities to write to the local file system (memory), perform browser automation via computer-use, and interact with the GitHub API.
- Sanitization: No specific sanitization or validation steps are outlined for the external content before it is processed by the agent.
Audit Metadata