The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads and merges existing project-specific instructions (e.g., AGENTS.md, CLAUDE.md) and repository templates into the agent's context. This ingestion of untrusted data from the target project represents a potential injection surface.
Ingestion points: Reads existing AGENTS.md, CLAUDE.md, and project Git history (SKILL.md sections 0 and 4).
Boundary markers: The skill explicitly instructs the agent to prepare a diff and obtain specific user approval before merging or overwriting instructions.
Capability inventory: The skill possesses extensive capabilities including file system writes, network operations via fleet sync, and shell command execution.
Sanitization: No explicit sanitization of ingested text is mentioned; reliance is placed on human review of proposed changes.
[COMMAND_EXECUTION]: The skill configures the 'worktree.setup' setting, which allows for the execution of arbitrary shell commands (e.g., 'uv sync', 'make bootstrap') during the initialization of task worktrees. While intended for legitimate environment setup, this capability executes commands within the project environment.
[DATA_EXFILTRATION]: The 'Fleet' synchronization feature (ha daemon fleet edge sync) involves connecting to a remote host and port to synchronize data. While documented as a core feature for edge node connectivity, it involves transmitting data to an external control plane.
[SAFE_PRACTICES]: The skill demonstrates security awareness by instructing the agent not to write credentials (machine tokens or person IDs) to reports or shell history, and it warns against including credential-containing configuration files in the project's Git repository.

harness-install