configure-secret-scan
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed to improve security posture by facilitating the detection of leaked credentials. It uses official Harness MCP tools (
harness_get,harness_update) for all operations. - [CREDENTIALS_UNSAFE]: While the skill discusses credentials (API keys, tokens), it follows secure practices by requiring the use of Harness secret references (
<+secrets.getValue(...)>). It explicitly prompts the user to create secrets via the appropriate secure skill if they do not exist, preventing the hardcoding of sensitive values in pipeline YAML. - [COMMAND_EXECUTION]: The skill generates pipeline YAML configurations for various security scanners (Gitleaks, Semgrep, Snyk). These are executed within the controlled Harness CI environment as standard pipeline steps rather than arbitrary shell commands on the agent host.
- [DATA_EXFILTRATION]: There are no indicators of unauthorized data movement. All operations are confined to the Harness platform infrastructure, and scanner outputs are directed to the official Security Tests tab.
- [REMOTE_CODE_EXECUTION]: No remote code execution patterns were detected. The skill relies on pre-configured, native, or commercially supported scanners within the Harness ecosystem.
- [METADATA_POISONING]: The metadata fields correctly identify the author as Harness and describe the skill's purpose without deceptive instructions.
Audit Metadata