harness-migration

Pass

Audited by Gen Agent Trust Hub on Oct 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches the latest Harness Anything source code from the author's repository (github.com/FairladyZ625/harness-anything) to access the current CLI and migration contracts. This ensures the migration uses the correct logic for the target format.
  • [COMMAND_EXECUTION]: Performs extensive file system and environment management using standard shell utilities, including tar for backups, mktemp for isolation, and git for repository management. It also utilizes background processing via nohup to handle long-running ledger imports without interruption.
  • [DYNAMIC_EXECUTION]: Dynamically generates and executes utility scripts, such as a Node.js diagnostic tool for checking ledger generations and a shell wrapper (apply.sh) to manage the background migration process.
  • [REMOTE_CODE_EXECUTION]: Clones and executes code from the project's repository. This is a standard part of the migration process to ensure the toolset matches the ledger generation being targeted.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided ledger data which could contain embedded instructions.
  • Ingestion points: Files within the harness/events directory of the legacy repository.
  • Boundary markers: Uses an explicit TypeScript contract (doc-sync.contract.ts) to define the allowed schema for events.
  • Capability inventory: Includes file system access, network access for updates, and the ability to execute code via the Harness CLI.
  • Sanitization: Employs a diagnostic scanner that validates event schemas and parses data as structured JSON before it is accepted into the new ledger.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 26, 2026, 12:55 PM