harness-contributing

Pass

Audited by Gen Agent Trust Hub on Sep 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses git for worktree management, npm for dependency installation, and the gh CLI for pull request creation. It also executes local JavaScript utilities within the cloned repository, such as tools/run-node-tests.mjs and tools/run-manifest-gates.mjs, to automate testing and validation steps.
  • [EXTERNAL_DOWNLOADS]: Clones the source repository from github.com/FairladyZ625/harness-anything.git and retrieves project dependencies using npm ci. These operations target resources within the vendor's own environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from repository manifest files like tools/gate-manifest.json and package.json, as well as GitHub issue and PR discussions. Ingestion points: Local manifest files and external GitHub discussions. Boundary markers: The 'Boundary' section provides instructions to exclude private data, credentials, and local agent instructions from public diffs. Capability inventory: The agent can perform file writes, local script execution, and network operations through git and gh tools. Sanitization: The workflow requires the agent to inspect staged diffs and complete a verification checklist before committing or pushing changes.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 3, 2026, 08:17 AM
Security Audit — agent-trust-hub — harness-contributing