design-harness
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill acts as an orchestrator for multi-agent workflows, creating a surface for indirect prompt injection through data ingested from specialist tools.
- Ingestion points: Ingests JSON evidence and artifacts via the scripts/design_harness.py runtime.
- Boundary markers: Uses structured JSON for state management but lacks explicit delimiters for prose fields (e.g., observed results) when presented to the agent.
- Capability inventory: Manages local file state and has the ability to dispatch work to other tools; file-write operations are performed in scripts/design_harness.py.
- Sanitization: The runtime performs strict schema validation of status fields but does not sanitize the semantic natural language content of the evidence.
- [COMMAND_EXECUTION]: The skill executes its bundled Python script to perform state management and journaling.
- Evidence: Instructions in SKILL.md and references/cli.md explicitly direct the agent to use python scripts/design_harness.py for all operations.
Audit Metadata