harness-contributing
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
gitfor worktree management,npmfor dependency installation, and theghCLI for pull request creation. It also executes local JavaScript utilities within the cloned repository, such astools/run-node-tests.mjsandtools/run-manifest-gates.mjs, to automate testing and validation steps. - [EXTERNAL_DOWNLOADS]: Clones the source repository from
github.com/FairladyZ625/harness-anything.gitand retrieves project dependencies usingnpm ci. These operations target resources within the vendor's own environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from repository manifest files like
tools/gate-manifest.jsonandpackage.json, as well as GitHub issue and PR discussions. Ingestion points: Local manifest files and external GitHub discussions. Boundary markers: The 'Boundary' section provides instructions to exclude private data, credentials, and local agent instructions from public diffs. Capability inventory: The agent can perform file writes, local script execution, and network operations through git and gh tools. Sanitization: The workflow requires the agent to inspect staged diffs and complete a verification checklist before committing or pushing changes.
Audit Metadata