harness-migration
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the latest Harness Anything source code from the author's repository (
github.com/FairladyZ625/harness-anything) to access the current CLI and migration contracts. This ensures the migration uses the correct logic for the target format. - [COMMAND_EXECUTION]: Performs extensive file system and environment management using standard shell utilities, including
tarfor backups,mktempfor isolation, andgitfor repository management. It also utilizes background processing vianohupto handle long-running ledger imports without interruption. - [DYNAMIC_EXECUTION]: Dynamically generates and executes utility scripts, such as a Node.js diagnostic tool for checking ledger generations and a shell wrapper (
apply.sh) to manage the background migration process. - [REMOTE_CODE_EXECUTION]: Clones and executes code from the project's repository. This is a standard part of the migration process to ensure the toolset matches the ledger generation being targeted.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided ledger data which could contain embedded instructions.
- Ingestion points: Files within the
harness/eventsdirectory of the legacy repository. - Boundary markers: Uses an explicit TypeScript contract (
doc-sync.contract.ts) to define the allowed schema for events. - Capability inventory: Includes file system access, network access for updates, and the ability to execute code via the Harness CLI.
- Sanitization: Employs a diagnostic scanner that validates event schemas and parses data as structured JSON before it is accepted into the new ledger.
Audit Metadata