harness-ceo
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to orchestrate complex tasks by ingesting data from potentially untrusted sources, such as task outputs, model-generated observations, and external user feedback. This creates a surface for indirect prompt injection where malicious instructions could be embedded in the data processed by the agent.
- Ingestion points: Processes external inputs through various templates like the delegation packet (assets/delegation-packet.md) and observation logs (assets/observation.md).
- Boundary markers: The skill uses organized templates to structure data but lacks explicit security delimiters or clear instructions for the agent to ignore embedded commands within the processed content.
- Capability inventory: The agent uses the ha CLI to perform task management, interact with Git (push, PR), and write to files in the workspace.
- Sanitization: There are no explicit instructions for sanitizing or escaping external content before it is processed or used in prompts.
Audit Metadata